Blockchain security firm PeckShield reported that approximately $3.89 million in stolen assets from compromised Ledger wallets was transferred to Binance deposit addresses on the Tron network. The funds, consisting of 3.685 million USDT and 615,000 TRX, were moved over a two-day period ending October 11, 2026.
This incident is part of a broader campaign that has resulted in total estimated losses between $86 million and $94.5 million. More than 300 wallets across multiple blockchains, including Bitcoin and Ethereum, were affected. The attacks began on October 9, 2026, and have been linked to hardware devices sold by the reseller CryptoBilis.
Ledger has suspended sales through CryptoBilis and confirmed that at least one device was subjected to unauthorized hardware modifications. Tether has frozen approximately $10 million in USDT associated with the theft, though some attackers have converted funds into USDD to circumvent these restrictions.
Investigators face challenges as some stolen assets passed through intermediary wallets that also process funds for other clients. The identification of Binance deposit addresses provides a potential path for law enforcement to link the activity to specific account holders, though the use of mixers further complicates the tracking process.
