Ledger Drain Grows to $92.9M as Tether Freezes $10M and Thief Sends 1,254 ETH to Tornado Cash

Published October 10, 2026, 11:30 PKT. Based on Bitquery's forensic investigation published October 9, 2026, Ledger's October 9 statement, and reporting by TokenPost and BeInCrypto.

The suspected theft tied to Ledger hardware wallets sold through Southeast Asian reseller CryptoBilis has grown to at least $92.9 million, according to a forensic investigation by blockchain data firm Bitquery, up from the $86 million first reported. Bitquery said it traced the money across 311 wallets on five blockchains, and found that stablecoin issuer Tether froze $10 million of the stolen USDT while the thief moved 1,254 ether into the Tornado Cash mixer on October 9.

The $93 million forensic count

Bitquery's tally covers TRON, Bitcoin, Ethereum, BNB Chain and Polygon. TRON accounted for the biggest share, with 70.2 million USDT taken from 131 wallets, worth about $70.5 million, the report said. Bitcoin followed with 203.8 BTC ($16.8 million) across 122 wallets, then Ethereum with 1,230 ETH plus USDT, USDC and 10 billion PEPE ($3.7 million) from 33 wallets. BNB Chain lost $1.45 million across 27 wallets and Polygon $580,000 across 13 wallets.

The total is higher than the initial $86 million figure because the thief also drained wallets on BNB Chain and Polygon and used five TRON addresses that did not appear in the public lists researchers circulated on X, Bitquery said.

One thief, three seconds, 311 wallets

The on-chain record points to a single actor holding the keys to every victim wallet, Bitquery wrote. On TRON, 25 wallets signed the same token approval within two blocks, three seconds apart, and within six seconds $29 million in USDT had been pulled, $7 million of it from a single wallet. On Bitcoin, 111 wallets were emptied in a single block at 05:54 UTC on October 9. The first theft landed at 05:07:48 UTC, and the thief had hit all five chains within 47 minutes. The last drain observed was at 16:37 UTC, hours after the theft was publicly reported.

The thief also ran practice transactions for two weeks before the drain, Bitquery said: 21 small test loops on TRON and 20 on Ethereum between September 25 and October 7, with the last two tests running 23 seconds apart.

Tether freezes $10 million

Between 12:09 and 14:10 UTC on October 9, Tether blocked 37 addresses linked to the theft, and 20 of them held $10 million in USDT, according to the report. MistTrack, the on-chain tracking arm of security firm SlowMist, separately confirmed the freeze, BeInCrypto reported. Tether lifted blocks on four OTC-style wallets at 15:30 UTC.

But the freeze caught only part of the haul. The thief swapped 14.9 million USDT into USDD, a stablecoin Tether cannot freeze, and 15.1 million USDD now sits in seven TRON wallets, Bitquery said. The largest single escape route: 20 million USDT crossed to Ethereum through the USDT0 bridge in 40 equal transfers, then five fresh wallets swapped it on UniswapX for 7,994 ETH. More went through swap services Relay.link, HiFiSwap and NEAR Intents, which paid the thief back in ether.

1,254 ether into Tornado Cash

From 15:17 to 15:56 UTC on October 9, the thief sent 1,254 ETH into Tornado Cash in three batches, Bitquery reported. About 14,810 ETH still sat in the thief's wallets as of the report, most of it bought with the stolen USDT. The Bitcoin, roughly 203.8 BTC, had not moved since it was taken. In all, Bitquery said about $79 million of the $92.9 million remained traceable on-chain.

The victims and Ledger's response

Most victims fit inside Ledger's 90-day warning window, but not all. Six in 10 victim wallets first received funds within the 90 days Ledger flagged, and more than 8 in 10 were funded from June 2026 onward, Bitquery found. June alone accounted for 42 TRON victim wallets getting their first coins, just before the 90-day line, which suggests buyers from June should heed Ledger's advice too.

At least one victim was a business: one drained TRON wallet took in 33.5 million USDT from October 1 and paid most of it out to 29 different wallets. One individual victim lost 80 BTC, worth about $6.6 million, from a wallet created on September 29, blockchain tracker Lookonchain reported.

Ledger said on October 9 it was investigating reports that customers lost funds after buying devices from CryptoBilis, which sells in Indonesia, Malaysia and the Philippines, and asked the reseller to immediately pause sales and shipments. The company told customers who bought from CryptoBilis in the past 90 days not to set up devices they had not initialized yet, and urged those who had to consider moving assets to a new Ledger signer with a fresh recovery phrase. Ledger has not said how the keys leaked.

Binance founder Changpeng Zhao suggested the devices may have been tampered with, and former Mt. Gox CEO Mark Karpeles said he found a Ledger device bought in Malaysia containing concealed hardware that could capture recovery phrases during setup, TokenPost reported. No connection between that device and the reported drains has been established, and the cause of the incident remains unconfirmed.

This article is news reporting and is not investment advice.

Sources

• Bitquery, Ledger CryptoBilis Hack: $92.9M Drained, Where It Went (Oct. 9, 2026), primary source for all forensic figures, freeze details and laundering flows
• Ledger, official statement on X (Oct. 9, 2026), primary source for the company's response and the CryptoBilis sales pause
• TokenPost, Ledger Wallet Losses Reach At Least $92.9M Across 311 Wallets (Oct. 10, 2026), secondary source for the loss estimate and the Karpeles device detail
• BeInCrypto via TradingView News, Trader Loses $6.6 Million in Bitcoin After Buying New Ledger Wallet (Oct. 9, 2026), secondary source for MistTrack's freeze confirmation and the 80 BTC victim case