CryptoBilis Ledger Breach Leads to $95 Million Theft, $10 Million Recovered or Frozen

The CryptoBilis Ledger drainer continues to move the stolen cryptocurrency, moving $13.84 million (roughly Rs. 13.18 crore) in the past 48 hours, following the detection by Arkham Intelligence of $95.35 million (roughly Rs. 90.79 crore) worth of theft through 1,486 addresses. Based on the report from Arkham Intelligence, the heists happened between October 7 and 9, and the majority of the crypto was stolen within 51 minutes on October 9. It reported that $30.44 million (roughly Rs. 28.98 crore) is still left in the wallets belonging to the thief, including $10 million USDT frozen by Tether.

Arkham Traces Stolen Funds Across Tron, Ethereum, Bitcoin and Other Networks

Its investigation tracked the stolen crypto money through multiple blockchain platforms, noting transactions made using USDT, Bitcoin, Ethereum, and USDD. This comes just about three weeks following Ledger's probe into reports of disappearing funds for people who had bought hardware wallets from Southeast Asian distributor CryptoBilis. According to Arkham, the theft happened mainly on October 9, starting at 05:07:48 UTC. In 51 minutes, the hacker made off with $80.60 million (roughly Rs. 76.73 crore), including $58.19 million (roughly Rs. 55.40 crore) in USDT through 335 transactions on the Tron blockchain.

Meanwhile, 112 Bitcoin addresses made transactions totalling 203.26 BTC, amounting to $16.73 million (roughly Rs. 15.93 crore), within a single block, at 05:54 UTC. Additionally, $14.14 million (roughly Rs. 13.47 crore) in USDT were sent to the attacker's Tron wallets by 15:00 UTC. The inquiry revealed smaller-scale transactions prior to the attack. From October 7 to October 8, the attacker made transactions totalling 7.41 BTC, estimated to be worth USD 610,000, from 137 addresses.

The earlier assessments for the amount lost have varied. Blockchain analytics company Bitquery has estimated that the amount lost is USD 102 million from 335 wallets in six different blockchains, according to an investigation done on October 16. Ledger has not been able to independently confirm the total amount lost and the number of customers affected.

Following the hack, the attacker initiated the process of transforming and transferring the assets across blockchain networks. Arkham tracked at least $69.19 million (roughly Rs. 65.88 crore) through the swap and bridging transactions, out of which $20.37 million (roughly Rs. 19.39 crore) was USDT transformed to USDD on Tron.

$20 million (roughly Rs. 19.05 crore) of USDT was transferred from Tron to Ethereum via USDT0. Some other transfers were made to convert USDT and USDC from Tron, BNB Chain, and Polygon to ETH, where USD 8.95 million was transferred via Relay, $5.91 million (roughly Rs. 5.63 crore) through Chainflip, and $13.96 million (roughly Rs. 13.29 crore) through others.

Earlier in October, Ledger stated that it found a suspicious piece of hardware inside its customer's cryptocurrency wallet, following its investigation on October 10 into the thefts linked to CryptoBilis, where estimated losses are more than $86 million (roughly Rs. 8,229 crore). According to a public notice by Ledger Support, the compromised equipment was owned by a customer who is part of an investigation that is currently underway.