Ledger reseller hacker sends $1.07M in ETH to Tornado Cash, $270K to Binance

A hacker suspected of targeting customers of the Ledger wallets from the reseller CryptoBilis sent 430.2 ETH worth approximately $1.07 million to Tornado Cash via four different wallets, as per Onchain Lens’ report dated October 9, 2026.

Additionally, $270,280 was sent to Binance. Investigators were able to view the transactions, but seeing the flow of funds is different from stopping it.

Four wallets into the mixer, a hot wallet at the exchange

Though Tornado Cash does make tracking deposits back to withdrawals tougher, it has not eliminated the possibility of tracing the funds through other avenues.

In a report on October 9 from Onchain Lens, it was revealed that $256,567 in USDT and close to $13,710 in TRX had been sent to Binance, with another transfer of $22,390 USDT already comprising part of the total sum in USDT. The funds were reportedly placed in a hot wallet at Binance.

Funds can still be frozen in the possession of the exchange; however, getting those funds back is another story altogether.

Tether freezes USDT as wallets shift into USDD

Tether was able to freeze some of the USDT funds that were connected with the possible theft. Other funds were supposedly changed to USDD through the SUN.io platform and its Peg Stability Module. Frozen USDT could not be swapped with anything.

A TokenPost report from October 9 valued the assets of the suspected hacker at around $70.60 million in ETH, BTC, USDD and USDT. While the wallets monitored by Arkham provide a closer view of the assets, the valuation indicated in the report is not the actual amount of funds allegedly lost.

According to the FATF’s report from March 2026, stronger measures are necessary in order to ensure the freezing and blocking of all questionable stablecoin transactions. Yet, usage of USDD demonstrates that criminals have the capacity to shift funds outside the scope of such rules.

Ledger is still investigating, and the $90M figure is not confirmed

On October 9, Ledger announced that they were looking into claims about Southeast Asian CryptoBilis customers and had requested the vendor to stop the distribution of the devices. Customers who bought products within three months were advised not to use the new devices. In addition, current customers were advised to move their assets to a new signer with a new seed phrase.

According to an article by The Block, which was published on October 9, the estimates provided by tanuki42 and Specter ranged from $72 million to $86 million and were based on analysis of blockchain activity. The estimates reported by Binance News on the same day put the figures at $90 million. However, none of these mentions have been confirmed as actual estimates and may refer to different wallets.

Changpeng Zhao, one of the co-founders of Binance, has put forward the theory of a vendor-specific attack on the supply chain. Mark Karpelès, once the CEO of Mt. Gox, has talked about the likelihood of device tampering. However, neither of the theories has been validated or confirmed.

Why mixers and stablecoin swaps keep beating recovery efforts

TRM Labs reported more than $700 million in Tornado Cash inflows through mid-June 2026, over 20% of mixer activity. Its July review counted 207 hacks and $972 million stolen in H1. Cryptopolitan previously reported that Tornado Cash appeared in 42% of exploits studied by Global Ledger.

For wallet owners, the biggest concern is the supply chain. Ledger has not confirmed device tampering. Its findings, Binance’s response and further wallet movements may determine how much can be recovered.