Ledger Attackers Move $7.45 Million in Ether Into Tornado Cash

Attackers linked to the CryptoBilis Ledger hardware-wallet incident moved 2,990.3 Ether (ETH) into Tornado Cash over Oct. 9-10, putting about $7.45 million in cryptocurrency into a privacy-focused service.

Blockchain investigator Specter identified the deposits and traced the funds through multiple addresses and networks. The attackers had first divided the assets among 14 addresses before using NEAR Intents to convert and move the funds into the Zcash network.

Address reuse provided links between parts of the flow. Some withdrawals used wallets that had previously deposited funds, while other transactions originated from wallets connected to addresses that paid gas fees during the original theft.

The movements further obscure assets tied to the Ledger-related security incident. Ledger has confirmed that an affected user's device contained an unauthorized hardware implant and advised customers who bought devices through affected distribution channels and had not initialized them not to use them. Customers who had completed setup were advised to consider moving assets to a newly initialized device with a new recovery phrase.