Wallet Watch: 2,990 ETH Hits Tornado Cash as Ledger Tells CryptoBilis Buyers to Move Seeds
Fourteen addresses, a bridge to ZEC, then a mixer: where the CryptoBilis implant money went, per on-chain detective Specter.
An address tied to the implant in a CryptoBilis-linked Ledger wallet sent 2,990 ETH to Tornado Cash[1]. The deposits landed on October 9 and 10[1]. The haul was worth about $7.45 million, per on-chain detective Specter[1].
The funds first went to 14 addresses, then through NEAR Intents into ZEC[2]. Specter said the coins were still moving on October 11[3].
Ledger said all confirmed cases in the October 9 drain involve devices sold through CryptoBilis[4]. CryptoBilis is a reseller in Southeast Asia[4]. Ledger said its own systems and direct sales channels were not hit[5].
What to do: do not set up an unused CryptoBilis device[6]. If already set up, move to a new seed on a Ledger device[7].
Who gains, who loses
Receipts
An attacker address associated with the unauthorized hardware implant in a CryptoBilis-linked Ledger wallet deposited 2,990 ETH into Tornado Cash between October 9 and 10, 2026.
“According to on-chain detective Specter on their personal channel, an attacker address associated with the unauthorized hardware implant in a Ledger hardware wallet linked to CryptoBilis deposited 2,990 ETH, worth approximately $7.45…”
Before the Tornado Cash deposits, the attacker dispersed the related funds across 14 addresses.
“Monitoring data shows that the attacker had previously withdrawn the related funds in a dispersed manner to 14 addresses, then used NEAR Intents to bridge and convert the funds to the ZEC network, and further carried out…”
Specter reported that the attacker was still moving and concealing the related funds as of October 11, 2026.
“Currently, the attacker is still continuously moving and concealing the related funds.”
Ledger said that all confirmed cases connected to the October 9 draining incident involved devices sold through the Southeast Asia reseller CryptoBilis.
“To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis.”
Ledger said its systems and direct sales channels remained unaffected.
“Our systems and direct sales channels remain unaffected.”
Ledger advised CryptoBilis buyers not to initialize unused devices.
“For CryptoBilis buyers: do not initialize unused devices.”
Ledger advised CryptoBilis buyers who had already set up devices to move to a new seed on a Ledger device.
“If already set up, move to a new seed on a device from Ledger.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.