Suspect in Ledger reseller breach routes $1.34 million through Tornado Cash and Binance

Of the $1.34 million traced so far ^[16], the smaller portion is the one still sitting where it can be frozen. The Tornado Cash leg went through four separate wallets ^[1]. A mixer makes deposits harder to match to withdrawals, though Cryptopolitan notes it has not closed off tracing by other routes ^[9]. The Binance leg, $256,567 in USDT and about $13,710 in TRX, went to an exchange hot wallet ^[2][3]. An exchange can freeze what it holds, and getting the money back to victims is a separate process ^[10]. That deposit is about 20% of the traced total ^[17].

Tether froze some of the linked USDT, and the frozen tokens could not be swapped ^[4]. The FATF said in a March 2026 report that stronger measures were needed to freeze and block suspect stablecoin transactions ^[11]. Cryptopolitan argues the move into USDD ^[5] shows how funds can be shifted outside the scope of such rules ^[12].

Set against what the suspect appears to hold, the outflows are small. TokenPost valued the suspect's assets at about $70.60 million in ETH, BTC, USDD and USDT, a figure Cryptopolitan cautions is not the amount lost ^[6]. The money sent to the mixer and the exchange is 1.9% of it ^[18]. The low and high published loss estimates sit $18 million apart ^[20], about 13 times everything traced into Tornado Cash and Binance ^[19]. At the $90 million figure, this one incident would equal about 9% of the $972 million TRM Labs counted stolen across 207 hacks in the first half of 2026 ^[15][22]. TRM also counted more than $700 million of Tornado Cash inflows through mid-June, over 20% of mixer activity ^[14].

Ledger has not confirmed that any device was tampered with ^[13]. Binance co-founder Changpeng Zhao has put forward a vendor-specific supply-chain attack, and former Mt. Gox chief executive Mark Karpeles has raised device tampering, but Cryptopolitan reports neither theory has been validated ^[21]. If Ledger confirms tampering at the reseller, the risk sits in the purchase channel, and every signer bought through a reseller carries a possible re-keying bill. Forensics pointing away from the hardware would make the vendor halt and the seed rotation ^[7][8] a precaution. The third possibility is that the estimates describe different wallets ^[20], so the loss shrinks and the cause stays open.

I think the channel reading is the stronger one on this record. Ledger's response targeted Southeast Asian customers of a single vendor who bought within the past three months ^[7], the narrow scope a channel problem would call for. The counter-case is that a manufacturer halts a vendor out of caution whatever it later finds. A Ledger finding that the CryptoBilis devices were untampered would undo the channel thesis.