Researcher Tayvano has traced approximately $100 million to $103 million in stolen cryptocurrency linked to a supply-chain attack on Ledger hardware wallets sold through CryptoBilis. The funds were distributed across roughly 530 addresses spanning seven different blockchains.
The breakthrough came from analyzing gas payment patterns. The attacker used an associated wallet to cover transaction fees across multiple transactions, creating a traceable link that revealed the operation's infrastructure.
How the funds were distributed
According to the research findings, about three-quarters of the stolen value sat in USDT on the Tron network, with the remainder spread across other chains and assets. Investigators identified wallets holding approximately $38.6 million in ETH and $16.9 million in BTC. Tether, the issuer of USDT, froze $10 million of the stablecoin tied to the theft.
Zcash privacy protections confirmed
The researcher emphasized that Zcash's cryptographic privacy protections remained intact. Rather than breaking the underlying mathematics, the Zcash portion of the trail was traced by matching 108 exact value exits to incoming batches—funds entered the shielded pool in specific amounts and exited in identical amounts, revealing a pattern left by operational mistakes rather than protocol vulnerabilities.
This distinction is significant: a flaw in Zcash's cryptography would represent a protocol-level problem affecting all users, whereas the pattern identified here reflects poor operational security by a single operator.
Supply-chain attack details
The theft originated from Ledger hardware wallets sold via CryptoBilis, making it a supply-chain compromise rather than a wallet vulnerability. After draining the funds, the attacker faced the standard challenge of laundering visible cryptocurrency by scattering it across multiple addresses, chains, and assets, including routing portions through privacy tools.
Implications for investigators and stablecoin issuers
The case demonstrates that metadata often matters more than encryption in tracking cryptocurrency. Fee funding patterns, timing, and transaction amounts can link addresses even when the transactions themselves are obscured.
For stablecoin issuers, Tether's $10 million freeze illustrates a leverage point unique to centrally issued tokens. With the majority of stolen value in USDT on Tron, issuers can create chokepoints unavailable for decentralized assets.
Remaining questions center on recovery: how much of the approximately $103.4 million can be recovered, and whether the identified ETH and BTC holdings can be frozen or seized, will determine if this tracing work results in funds returned to victims.
