Suspect address related to theft from Ledger dealer CryptoBillis has transferred 430.2 ETH to Tornado Cash via 4 wallets
Onchain Lens reports that a suspect address related to the theft from Ledger dealer CryptoBillis has transferred 430.2 ETH, worth approximately $1.07 million, to Tornado Cash through 4 wallets. The total amount involved is reportedly close to $90 million. This transfer occurred after Tether froze part of the related funds.
The same monitoring indicates that the suspect exchanged part of the USDT for USDD via SUN.io and USDD's PSM, with additional funds entering Binance's hot wallet. Onchain Lens calls for Binance to investigate these transfers and freeze the related accounts. The monitoring post did not provide results on whether Binance has already frozen these accounts.
The marked suspect wallet still holds approximately $70.6 million, consisting of 11,406 ETH (about $28.35 million), 213.371 BTC (about $17.65 million), 13.646 million USDD (about $13.65 million), and 10.909 million USDT (about $10.91 million). The 430.2 ETH is a small portion that has been transferred out, not the entirety of the $70.6 million.
These associations remain tracking labels. Ledger has not confirmed the $90 million nor the device tampering. The equipment disclosed by Karpelès in Malaysia has not been individually matched in Onchain Lens's figures. Tether's freeze only applies to the listed USDT and does not cover the portion already exchanged for USDD, nor does it cover Bitcoin and Ethereum.
CryptoBillis has been requested to suspend sales and shipments. Buyers who have not initialized within the past 90 days are advised not to set up; if already set up, they are advised to change to new mnemonic phrases and transfer to new signing devices. The dealer list includes Malaysia, Indonesia, and the Philippines.
This is not a market transaction but a movement of assets from marked addresses. The sender is the suspect wallet, while the recipients are the Tornado Cash contract, the USDD exchange path, and Binance's hot wallet. The event is driven by on-chain movements following the freeze. Beneficiaries are holders who have kept USDT outside of freezeable addresses; those under pressure are the 10.909 million USDT still in the marked wallet and funds that can be reviewed by the exchange after entering the hot wallet, as the $70.6 million has not yet been officially confirmed as belonging to the same attacker.
The valuation of 11,406 ETH is approximately $28.35 million, and the recently transferred 430.2 ETH is only a small part of that. The balance is still changing, and the figures need to be verified.
Source: Public information
ABAB AI Insight
The stolen funds have been rerouted after the freeze, following a fixed sequence. After the U.S. Treasury sanctioned Tornado Cash in 2022, Ethereum could still enter the contract, while stablecoins shifted more towards exchanges with issuers. On October 9, 2026, Onchain Lens reported that after Tether froze part of the Ledger-related USDT, 4 wallets transferred 430.2 ETH, approximately $1.07 million, while records of USDT being exchanged for USDD and entering Binance's hot wallet also appeared.
The $70.6 million balance complicates recovery efforts. The 11,406 ETH and 213.371 BTC are not on Tether's blacklist. The 13.646 million USDD is already exchanged stablecoins, while the 10.909 million USDT is still potentially freezeable. The portion entering Binance's hot wallet is subject to exchange custody, prompting Onchain Lens to call for an investigation. Entry into the hot wallet does not equate to the account being frozen.
This can be compared to the funds that entered Tornado Cash in batches after the Ronin hack in 2022, and the approximately 3.5% that was frozen after the Bybit hack in 2025. Currently, it is in the moving phase: sales have been halted, and the attacker's identity has not been confirmed by Ledger. Control lies with the address still holding 213 BTC and 11,000 ETH, not with the USDT that has already been blacklisted.
Essentially, pricing power is split by asset and custody location. Issuers can stop their coins, mixing contracts and another stablecoin provide paths for continued movement, while exchange hot wallets put some back into reviewable accounts. The mechanism is that freezing only changes the direction of USDT, not the balance of Bitcoin and Ethereum. The 430.2 ETH is a visible fragment that has left, while the $70.6 million remains to be verified.