The Approval Was Genuine. The $29M Was Gone in Six Seconds
Twenty-five TRON wallets signed one approval for one address. Six seconds later, $29M in USDT was gone.
On October 9, a drain took $93.2M from 315 wallets across TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon[1].
On TRON, 25 wallets signed one spend for one address within three seconds[2]. Six seconds later, $29M in USDT was gone[3]. Ledger confirmed the next day that one victim’s device held an implant the firm had not approved[4].
BNB Chain lost $1.45M across 27 wallets[5]. Four Solana wallets lost 1,355 SOL and 100,000 USDT, about $250,000[6].
On 10 October, 1,736 ETH went through Tornado Cash and Zcash and came out as USDC[7]. By 06:00 UTC on 11 October, the on-chain trail had shrunk to $81M[8]. 5.35M USDC sat in five wallets Circle could freeze[9].
What to do: revoke any approval to an address the holder does not know — 25 TRON wallets signed one approval for one address[2].
Who gains, who loses
Receipts
On October 9, a theft drained $93.2M from 315 wallets across TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon.
“We count $93.2M taken from 315 wallets on TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon, more than first reported.”
On October 9, 25 TRON wallets signed the same approval for the same address within three seconds, after which $29M in USDT was pulled.
“The record shows 25 wallets signing the same approval for the same address in two blocks, three seconds apart.”
Within six seconds of the first TRON approval, $29 million in USDT had been pulled from the wallets.
“Within six seconds of the first approval, $29 million in USDT had been pulled out, 7 million USDT of it from a single wallet.”
Ledger confirmed on October 10 that one victim's device contained an unauthorized hardware implant.
“On 10 October Ledger said one victim's device "contained an unauthorized hardware implant".”
The theft affected 27 BNB Chain victim wallets and involved $1.41M in USDT and USDC plus 59.8 BNB, valued at $1.45M.
“|BNB Chain|27|$1.41M in USDT and USDC, 59.8 BNB|$1.45M|”
The theft affected four Solana wallets containing 1,355 SOL and 100,000 USDT, valued at about $250,000.
“Between 05:38 and 05:56 UTC the thief emptied four Solana wallets of 1,355 SOL and 100,000 USDT, about $250,000, into three fresh addresses.”
On October 10, an additional 1,736 ETH was sent through Tornado Cash and Zcash, emerging as USDC.
“On 10 October the thief ran another 1,736 ETH through Tornado Cash and Zcash, and it came out as USDC.”
By approximately 06:00 UTC on October 11, the amount of stolen money traceable on-chain had fallen to $81M.
“By about 06:00 UTC on 11 October, the money we can find had fallen to $81M.”
On October 11, 5.35 million USDC linked to the mixed funds was held in five wallets that Circle could freeze.
“Together with the 9 October wallet that has not moved, 5.35 million USDC now sits in five wallets that have never sent a payment.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.