Researcher Traces $100M in Stolen Crypto Linked to Ledger Supply-Chain Attack

In a significant development, researcher Tayvano has traced around $100 million to $103 million in stolen cryptocurrency associated with a supply-chain attack on Ledger hardware wallets sold through CryptoBilis. Notably, the tracing was achieved without compromising Zcash's privacy features.

The investigation revealed that the stolen funds were distributed across approximately 530 addresses on seven different blockchains, with about 75% of the value held in USDT on the Tron network. The analysis also identified wallets containing around $38.6 million in ETH and $16.9 million in BTC. Tether, the issuer of USDT, has since frozen $10 million linked to the theft.

Central to the tracing was the attacker's use of an affiliated wallet for gas payments, which provided a crucial link between the various addresses involved. Tayvano emphasized that Zcash's shielded transactions, designed to obscure sender, receiver, and amount, remained intact throughout the process. The tracing relied on matching 108 exact value exits to incoming batches, demonstrating that while the privacy coin's cryptography held firm, operational security flaws can still leave traces.

This incident, stemming from a supply-chain attack rather than a direct wallet hack, highlights the challenges of tracking stolen crypto. The attacker’s strategy involved dispersing the funds across multiple addresses and blockchains, complicating recovery efforts. Investigators are now left to ponder how much of the $103.4 million can be recovered and whether the identified ETH and BTC holdings can be frozen or seized.