Attackers Move $7.45 Million in ETH to Tornado Cash Amid Ledger Incident
Written with artificial intelligence.
On October 9-10, attackers linked to the CryptoBilis Ledger hardware wallet incident deposited 2,990.3 ETH, valued at approximately $7.45 million, into Tornado Cash. The funds were previously withdrawn to 14 addresses and converted across chains for privacy protection.
Overview of the Incident
According to blockchain investigator Specter, attackers associated with the CryptoBilis Ledger hardware wallet incident deposited a significant sum of 2,990.3 ETH into Tornado Cash between October 9 and 10. This amount is worth around $7.45 million.
Fund Movement and Conversion
Monitoring data reveals that the attackers initially withdrew the funds to 14 different addresses. They subsequently used NEAR Intents to convert the funds to the ZEC network, further obscuring their trail. Notably, some withdrawal transactions reused wallet addresses that were also used for deposits, indicating possible address correlation during the fund transfer process.
Ongoing Investigation
As the funds have been moved and concealed through multiple on-chain routes, the investigation continues. This follows the earlier revelation of a supply chain security incident involving Ledger, where it was confirmed that an affected user's device had unauthorized hardware implanted. Ledger is currently collaborating with relevant parties and law enforcement on the matter. They have advised users who purchased devices from the impacted distribution channels and have not yet initialized them not to use them. For users who have completed setup, it is recommended to migrate assets to new devices using a new recovery phrase.