Blockchain security firm PeckShield has traced approximately $3.89 million drained from compromised Ledger hardware wallets to deposit addresses linked to Binance on the Tron network. The transfers, flagged on October 11, 2026, occurred over a two-day period and included roughly 3.685 million USDT and 615,000 TRX.
The flagged amount represents only a portion of a much larger theft. Total losses from the incident are estimated between $86 million and $94.5 million, affecting more than 300 wallets across several blockchains including Bitcoin and Ethereum. The majority of the damage occurred in USDT on Tron.
The drains began on October 9, 2026, with the common thread linking the largest losses: devices purchased from CryptoBilis, a Southeast Asian reseller of Ledger hardware. Ledger has paused sales through CryptoBilis and confirmed that at least one of the compromised devices showed signs of unauthorized hardware modifications.
Earlier on October 11, approximately $10 million in USDT had already been sent to Binance deposit addresses, according to PeckShield's research. Some of the stolen funds reportedly passed through intermediary wallets that also handle assets belonging to other clients.
Tether Response and Attacker Adaptation
Tether moved to freeze addresses associated with the attack, freezing approximately $10 million in USDT. The attacker appears to have anticipated this action, swapping some funds into USDD, a different stablecoin, in an apparent attempt to circumvent Tether's freeze capabilities.
Mixing services have also been employed in the theft campaign, blending funds from multiple sources to obscure transaction trails.
Investigation Path Forward
The Binance deposits represent a potentially significant development for victims and investigators. Centralized exchanges can theoretically connect deposit addresses to account holders, providing law enforcement with a concrete investigative lead.
The involvement of intermediary wallets complicates matters. If these addresses serve multiple customers, any freeze or account action risks affecting uninvolved users, and establishing clear proof of attacker ownership requires careful analysis.
Key developments to monitor include whether Binance or authorities take action on the flagged deposit addresses, how much of the estimated $86 million to $94.5 million in losses can be realistically traced or frozen, and additional disclosures from Ledger regarding the scope of CryptoBilis device tampering.
