KEY FINDINGS
- Most of the money is still visible. About 82% of the stolen value sits in wallets the attacker controls, mostly ETH plus the 203.79 BTC that have never moved. Another 10% is frozen.
- TRON USDT left TRON within hours via THORChain, the USDT0 bridge, Relay, Chainflip, Bitget, HiFiSwap and NEAR Intents, and became ETH. Before that, $23M was cycled through USDD, which Tether cannot freeze.
- Tornado Cash → Zcash → USDC round trip. … has been deposited into Tornado so far, and deposits were still happening on 13 Oct. Of that, … (…) was traced back out. Most was swapped into shielded Zcash, and about $11M then came back as USDC/ETH through NEAR Intents (timing and amount match).
- "Custodial" swap services are traceable. Orders at HiFiSwap, Bitget, SWFT and Aeroswap match payouts 1:1 within seconds to minutes, at a constant exchange rate.
- Cash-out is under way. Deposits went to HitBTC, ChangeHero and Binance, and about $3.5M went to OTC-broker-like wallets on TRON. That includes 893k USDT on 14 Oct, swapped from ETH through Bitget within minutes.
- The earliest attacker action was at 03:55 UTC: a permission lock-out key on a TRON victim wallet, about an hour before the time previously reported.
LEADS FOR FREEZING & ATTRIBUTION
- Circle: 2.63M USDC in three attacker wallets that has not been frozen: 0x4600…2a6a, 0x3635…ee17, and since 14 Oct 0x5a93…5108 (248,893 USDC).
- Tether: 1.35M USDT that has not been frozen, at TMAXFF…BLicYy, plus 50,801 USDT at TApkaRr…kP (14 Oct). On 14 Oct the attacker sent 893k USDT, paid out by Bitget for 383 ETH, to the OTC-broker-like wallet TQvTASbf…bXy.
- NEAR Intents: 800k USDT from two failed swaps was never refunded. Its refund address is the attacker's own wallet.
- Binance: an established deposit address, in use since March 2026, received 27 ETH: 0x5D77…B211. This is the strongest identity lead.
- Bybit: a withdrawal on 24 Sep funded the attacker's TRON control wallet (tx b284a254…).
- HitBTC, ChangeHero, Bitget, SWFT, Aeroswap, HiFiSwap, Relay, Chainflip: their account and order records cover the deposits shown in the map. All exchanges should flag the BTC wallets and the Ethereum holding wallets.
If you are a victim: report to local police and to Ledger, and beware of "fund recovery" offers. They are a common follow-up scam.
EVERY TRACED TRANSFER
| time (UTC) | chain | from | to | amount | USD | note | tx |
|---|
METHOD & CAVEATS
- Data. Public explorers and node APIs only: mempool.space, TronGrid, Blockscout, and public RPC nodes for Ethereum, BNB Chain, Polygon and Solana. Cross-chain swaps were resolved through the public status APIs of Relay, NEAR Intents and LI.FI. THORChain swaps were resolved from the memos written on-chain.
- Line styles. A solid line is either a transfer between wallets on the trail or a swap resolved from a service's own record (API or memo). A dashed line is a high-confidence match: a payout matched to its deposit by timing and a constant exchange rate (HiFiSwap, Bitget, SWFT, Aeroswap, Chainflip), a Tornado withdrawal attributed by the demixing heuristics, or a NEAR payout from the Zcash round trip. A dotted line is a medium match.
- Mixers. Tornado deposits cannot be mathematically linked to their withdrawals. A withdrawal counts as confirmed only when it later merged into known attacker wallets. The high-confidence ones combine the excess pool flow over a baseline week, withdrawal bursts to fresh wallets, shared gas sources, and identical onward swaps to Zcash.
- Victims' privacy. Victim wallet addresses and their transaction hashes are deliberately not published. Victims appear only as totals per chain, and so do unidentified senders, who may also be victims.
- Values. USD figures are estimates at the time of each transfer, and balances "now" come from an automated wallet watch. Native BNB/POL movements are not covered by the keyless sources, a gap of about 59 BNB.
- This is independent research. It is not legal advice and not an official statement by Ledger or any service mentioned. Corrections are welcome as GitHub issues.