One Approval, 25 Wallets, Three Seconds, $29 Million
One approval signed by 25 wallets in three seconds, then $29 million gone in six.
Bitquery counted $92.9M taken from 311 wallets on five chains: TRON, Bitcoin, Ethereum, BNB Chain and Polygon[1]. Bitquery ties 25 TRON wallets to one approval for one address, in two blocks three seconds apart[2]. Within six seconds of that approval, $29 million in USDT was pulled[3]. One wallet lost $7 million of it[3]. The TRON control address ran 21 test loops in the two weeks before the drain[4]. The Ethereum address ran 20[4]. Tether froze $10.0M and blocked 37 addresses, 20 of which held the $10.0M[5].
What to do: do not start setup on a CryptoBilis device bought in the last 90 days[6]. Move assets to a new signer with a new seed[7].
Who gains, who loses
Receipts
Bitquery counted $92.9M taken from 311 wallets across TRON, Bitcoin, Ethereum, BNB Chain and Polygon in the CryptoBilis incident.
“We count $92.9M taken from 311 wallets on TRON, Bitcoin, Ethereum, BNB Chain and Polygon, more than first reported.”
Bitquery reported that 25 TRON wallets signed the same approval for the same address in two blocks three seconds apart.
“The record shows 25 wallets signing the same approval for the same address in two blocks, three seconds apart.”
Bitquery reported that $29 million in USDT was pulled within six seconds of the first TRON approval.
“Within six seconds of the first approval, $29 million in USDT had been pulled out, 7 million USDT of it from a single wallet.”
Bitquery reported that the TRON and Ethereum control addresses conducted 21 and 20 small test loops respectively during the two weeks before the drain.
“The TRON address did it 21 times and the Ethereum address 20 times.”
Bitquery reported that Tether blocked 37 addresses linked to the theft and that 20 of those wallets held $10.0M.
“Tether blocks 37 addresses linked to the theft; 20 of them hold $10.0M”
Ledger advised users who bought from CryptoBilis during the previous 90 days not to initiate setup if they had not already done so.
“We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate setup if you have not done so yet,” the firm said.”
Ledger advised users who had already set up a CryptoBilis device to consider moving assets to a new Ledger signer with a new seed.
“If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed).”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.