Researcher Tayvano has tracked approximately $103.4 million in stolen cryptocurrency linked to a supply-chain attack involving Ledger hardware wallets sold via CryptoBilis. The investigation revealed that the stolen assets were distributed across roughly 530 addresses spanning seven different blockchains.
The attacker's infrastructure was identified by analyzing the funding sources for transaction fees. By tracing which wallets paid for gas, researchers connected the various addresses used in the operation. Approximately three-quarters of the stolen funds were held in USDT on the Tron network, while other identified holdings included $38.6 million in ETH and $16.9 million in BTC.
Tether has frozen $10 million in USDT associated with the theft. The investigation also tracked funds moved through the Zcash network. Tayvano noted that the privacy protocol of Zcash remained intact, as the trail was uncovered by matching 108 exact value exits to incoming batches rather than through a cryptographic breach.
The findings highlight the role of metadata in blockchain investigations. Patterns in fee payments, timing, and transaction amounts allowed researchers to link addresses despite the use of privacy tools. The potential recovery of the stolen assets remains subject to further efforts to freeze or seize the identified holdings.
