Beosin said the Ledger hardware wallet supply-chain attack that took place on Oct. 9-10 caused losses of more than $86 million, with victim addresses mainly linked to buyers who purchased devices from CryptoBilis, an authorized Ledger reseller in Southeast Asia. The company said it used Beosin Trace to examine the main flows of stolen funds currently visible on-chain, covering about $43 million.
Timeline and attack method
According to the analysis, former Mt. Gox CEO Mark Karpelès wrote on Sept. 16 that a Ledger Nano X wallet had been fitted with a spy module.
On Oct. 8, Karpelès posted again with details of the implant, saying wallets bought through unofficial sales channels could be modified with a spy chip capable of monitoring the screen and exfiltrating seed phrases. Those posts drew broad attention across the crypto community.
On Oct. 9-10, assets from a large number of Ledger wallets were transferred out and consolidated across Ethereum, Tron, Bitcoin, Solana, and other chains. Ledger later said it was investigating reports of lost funds involving Southeast Asian users who had bought devices from CryptoBillis, and asked the reseller to halt all sales and shipments.
Beosin said the attack worked because Ledger’s Secure Element can protect private keys from direct extraction, but it cannot stop peripheral hardware from capturing what appears on the screen. The modified devices could still pass Ledger’s Genuine Check because the attackers did not alter the original secure chip, leaving the verification system unable to detect physical changes made to external hardware.
Ethereum: some ETH moved into Tornado Cash
Beosin identified the following Ethereum collection addresses used by the attackers:
- 0x69c8f401cfc6cd40ac94691d6d7c48e3b7a47841
- 0x033636e45d519bebb7b5c2520ca6ce56fbdb4f7a
- 0x83aeac166f6832ae3500000a24510a95a052a599
Address 0x033636e45d519bebb7b5c2520ca6ce56fbdb4f7a collected 1,026.9 ETH, worth about $2.574 million. Address 0x83aeac166f6832ae3500000a24510a95a052a599 collected 700 ETH, worth about $1.754 million. Beosin said neither pool of funds had been moved further at the time of publication.
Address 0x69c8f401cfc6cd40ac94691d6d7c48e3b7a47841 collected 1,141.5 ETH, worth about $2.855 million. Of that total, 441.5 ETH had already been transferred out, and the funds were split into batches and sent to Tornado Cash. As of publication, 411.5 ETH had been deposited into the mixer.
Tron: some USDT frozen, some swapped into USDD
On Tron, Beosin listed the following collection addresses:
- TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C
- TBkcUMYC7CkTK99tkTnaStQVBastfrs9d9
- TCGE3xp6YGRKXxDZiLfysgJW3f22KfMNsW
- TSDWtuZ2pARUVz4v3PkL2hi3iXPjowAr5a
The stolen assets on Tron were TRX and USDT. Beosin said Tether had successfully frozen about $9.347 million in USDT. Even so, part of the stolen stablecoins had already been converted into USDD before the freezes took effect. From address TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C, a total of 5 million USDT was swapped into USDD.
Address TSDWtuZ2pARUVz4v3PkL2hi3iXPjowAr5a collected 6.15 million USDT. Of that amount, 4 million USDT moved through a series of transfers and was then exchanged into USDD through the USDD-USDT PSM and SunSwap. The remaining funds were moved onward through cross-chain protocols including Near Intents and Bridgers. The stolen TRX, worth about $223,000, was also entirely converted into USDD.
Beosin said the laundering route resembled a pattern it had previously observed in its analysis of the movement of NewCoin guarantee funds. To avoid Tether freezes, illicit funds within the Tron ecosystem often use DeFi protocols on Tron, including USDD[io], SunSwap, and Justlend, along with the decentralized stablecoin USDD.
Bitcoin: large BTC balances remain in collection wallets
On Bitcoin, address bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl collected 92.5 BTC, worth about $7.673 million, with no further movement observed so far.
Address bc1qqnkwurxs99xkx5t4yffqhq3u6qwy0qpjyujtm9 collected 111.28 BTC, worth about $9.231 million, and those funds had also not moved further at the time of publication.
A third address, bc1qgqheemzla77pesl227hdtgf5ykz62d0zvld26n, collected 9.96 BTC. Beosin said the attackers had started splitting and moving that portion, with about 3.52 BTC already routed through Near Intents in a cross-chain privacy transaction.
Ongoing monitoring and prior Ledger incident
Beosin said all related addresses have now been tagged and remain under continuous monitoring. Its KYT and Trace systems will keep tracking activity tied to the hacker wallets and any subsequent fund movements.
The report also noted that Ledger had previously suffered a software supply-chain attack. In that earlier case, the attacker obtained access to a former employee’s Github account through phishing, while Ledger had not revoked that employee’s code access. A malicious version of the Connect Kit library was then published, leading users to sign transactions that drained their assets. This latest case, by contrast, was described as a hardware-level supply-chain attack.
Beosin said the incident exposed a core security problem again: the safety of a hardware wallet depends not only on the chip inside the device and on user behavior, but also on whether every link in the supply chain is secure and trustworthy.
