PeckShield Traces $3.89 Million from Ledger Wallet Drain to Binance Deposits

Blockchain security firm PeckShield has reported that around $3.89 million drained from compromised Ledger hardware wallets has been routed to Binance deposit addresses on the Tron network. The transfers were flagged on October 11, 2026, occurring over a two-day period and involving approximately 3.685 million USDT and 615,000 TRX.

This incident is part of a much larger theft campaign, with total losses estimated between $86 million and $94.5 million, affecting over 300 wallets across various blockchains, including Bitcoin and Ethereum. The majority of the losses were concentrated in USDT on the Tron network, with the draining activities commencing on October 9, 2026. A significant factor in this incident is that many of the compromised devices were purchased from CryptoBilis, a Southeast Asian reseller of Ledger hardware, prompting Ledger to halt sales through this distributor.

Ledger has confirmed unauthorized hardware modifications in at least one of the affected devices and has advised users to adopt new security measures. In response to the theft, Tether has frozen approximately $10 million in USDT linked to the attack. However, the attacker has attempted to evade these measures by converting some funds into USDD, a different stablecoin.

The identification of Binance deposit addresses provides a potential avenue for recovery, as centralized exchanges can link these addresses to account holders, allowing law enforcement to take action. Nonetheless, the presence of intermediary wallets complicates the situation, as these addresses may also handle funds belonging to other clients.

As the investigation unfolds, key points to monitor include whether Binance or authorities will act on the flagged deposit addresses, the extent to which the estimated losses can be traced or frozen, and any further updates from Ledger regarding the number of compromised devices sold through CryptoBilis.