Ledger Attacker Sent $7.45 Million to Tornado Cash and Kept Going
Specter traced the split: 14 addresses, NEAR Intents, ZEC, then the mixer. Ledger says it is looking into it.
Wallets tied to the attacker in the CryptoBilis Ledger case sent 2,990.3 ether into Tornado Cash between October 9 and October 10, about $7.45 million[1]. Specter, who tracks chains, says the funds were split across 14 addresses first, then routed through NEAR Intents into ZEC[2]. Some cash-outs reused the send addresses. Others came from wallets tied to the gas payers in the first theft[3]. Those links join the sends and the cash-outs across the wash[4]. The funds kept moving after that[5]. Ledger says it is looking into the supply-chain case behind that hardware wallet[6].
What to do: stay alert to device security risks, per Ledger’s warning[6].
Who gains, who loses
Receipts
Addresses linked to the attacker in the CryptoBilis Ledger hardware-wallet incident deposited 2,990.3 ETH into Tornado Cash between October 9 and October 10, 2026.
“Addresses linked to the attacker in the CryptoBilis Ledger hardware-wallet incident deposited 2,990.3 Ether (ETH) into Tornado Cash between Oct. 9 and Oct. 10, marking a potentially significant laundering step for funds valued at about…”
The attacker had previously distributed the funds across 14 addresses.
“Blockchain investigator Specter said the attacker had previously distributed the funds across 14 addresses before routing them through NEAR Intents and into ZEC for additional privacy processing.”
Some withdrawal transactions reused deposit addresses.
“Some withdrawal transactions reused deposit addresses, while others were initiated by wallets connected to addresses that paid gas fees during the original theft, Specter said.”
The address links connected deposit and withdrawal activity across the laundering process.
“Those links may connect the deposit and withdrawal activity across the laundering process.”
Funds tied to the incident continued to move after the Tornado Cash deposits.
“Funds tied to the incident continue to move as the attacker attempts to conceal their trail.”
Ledger said it was investigating the hardware-wallet supply-chain incident.
“Funds tied to the incident continue to move as the attacker attempts to conceal their trail. Ledger has said it is investigating the hardware-wallet supply-chain incident and warned users to remain alert to device security risks.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.