Ether stolen from Ledger buyers went through Tornado Cash and Zcash, but analysts still linked what went in to what came out

What happened in four days

The story began on October 9: buyers of Ledger hardware wallets purchased through the reseller CryptoBilis had most of their coins drained within the first hour. We covered how it came to light in our first report on the thefts from CryptoBilis customers, and then in our breakdown of the hardware implant that Ledger confirmed.

The damage estimate has grown since then. Bitquery's investigation, updated on October 12 at 14:00 UTC, puts it at $102.0 million from 324 wallets across six networks: TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. The researcher YFarmX counts $103.4 million from 530 addresses. Ledger has not confirmed a total.

Next the thief went to work on the trail. By Bitquery's count, about 6,680 ETH was sent into Tornado Cash between October 9 and 12:

As of 12:52 UTC on October 12, part of the ether from the last wave was still inside the mixer, while 2,180 ETH had come out and turned into 4,334 ZEC.

How Tornado Cash deposits and withdrawals were linked

Tornado Cash works like a shared pot with fixed denominations: 1, 10 or 100 ETH. You put a coin into the pot and later take an identical one out to a different address. The blockchain sees the deposit and sees the withdrawal, but not which withdrawal belongs to which deposit.

That protection works when time passes between the deposit and the withdrawal and other people's coins move through the pot in the meantime. This case was different. According to Bitquery, the withdrawals came in the same denominations as the deposits, one for one, and the first withdrawal of each batch happened about a minute after the deposit. When a series of identical deposits and a series of matching withdrawals follow each other minutes apart, there is little left to guess about whose coins they are.

The analysts' conclusion is cautious: the mixer "hid little", but they describe the match in amounts and timing as "strong evidence but not proof".

How the Zcash shielded pool entry and exit were linked

From the mixer the ether went to NEAR Intents, a cross-chain swap service, which exchanged it for ZEC. The coins entered the Zcash shielded pool and left it to different addresses, after which the same service paid out USDC for them.

Inside the Zcash shielded pool, the sender, the recipient and the amount really are hidden. But the pool has a boundary. How many coins went in and how many came out is visible to everyone, otherwise the network could not verify that nobody had printed new ZEC. That boundary is exactly where the trail was picked up:

• On October 9, six wallets swapped ether for ZEC in 41 lots. According to Bitquery, the amounts entering the pool and leaving it matched down to the smallest unit of ZEC (zatoshi);
• On October 10, each of the 28 lots came back as two equal halves that together kept 99.75% of what went in;
• YFarmX reported matching 108 withdrawals out of 108 to their batches, also down to the smallest unit.

So the shielded pool did not fail: nobody saw what happened inside. Behavior failed. The coins went in and came out almost immediately in the same amounts, just cut in half.

For the third wave, on October 11-12, the link is weaker. Bitquery rates it as "moderate to strong" for two wallets and "moderate" for the third, and says outright that the destination wallets are tied to the thief by amounts and timing, which is not proof.

What was frozen and what could not be stopped

Only coins that have an issuer can be frozen.

• USDT. Tether began blocking addresses about ten minutes after the first public report of the thefts and blacklisted 37 addresses. On 20 of them, $10.0 million is frozen. We showed how an issuer does this technically in the case of the USDT freeze in THORChain vaults.
• USDC. The thief emptied five wallets holding USDC received on October 9 and 10 before any freeze could happen. As of October 12, Bitquery lists two wallets with 2.38 million USDC that Circle can still block.
• USDD. The thief moved about $23.9 million into USDD, a stablecoin on the TRON network that Tether cannot block, and then swapped most of it for ether.
• ETH and BTC. There is nobody who can freeze them.

In total, by Bitquery's estimate, about $82 million of the stolen funds can be located on the blockchain as of October 12. Two days earlier it was $97 million: the difference is sitting in the mixer and in the shielded pool.

A European thread is developing separately. An X user going by Johannes reported finding the same implant in a wallet bought at European retail. In its October 11 update, Ledger repeated that all confirmed cases involve devices from CryptoBilis. According to Decrypt and Bitcoin.com News, the company has not yet responded publicly to the European reports.

What this teaches people who use privacy coins honestly

Privacy in crypto is not for thieves but for ordinary people: so that a salary, savings and purchases cannot be read by any passerby from an address. This case is useful precisely for them, because it shows where the tool ends and behavior begins.

The tool hides the link between addresses. It does not hide coincidences. If 12.3456 ZEC went into the pool and twenty minutes later 12.3456 ZEC came out, the cryptography did its job, but arithmetic gave away the rest. Zcash developers themselves have long warned about this: a withdrawal of the same amount soon after a deposit is easy to link.

Monero has no such boundary inside the network: amounts are hidden in every transfer, not only in some of them. But at the moment of a swap into another coin, what goes in and what comes out is still visible on the other blockchain, whichever crypto exchange you use. We covered this in more detail in the guide on whether Monero can be traced and in the comparison of Monero and Zcash.

And a second lesson, about services. A swap service sees the addresses and amounts of its own transactions, and a stablecoin with an issuer can be frozen in any wallet. A privacy coin shields your balances from prying eyes, but it does not make stolen money clean.

How to buy Zcash or Monero without registration

At VertEXchange, you buy privacy coins without an account, email or phone number. You pick a pair, paste your wallet address and see the rate and the amount you will receive before you send anything. The coins go straight to your own address: VertEXchange does not hold them.

• The fixed rate holds for about 15 minutes while the transfer confirms.
• You can set a refund address: the coins go back there if the exchange does not go through.
• Personal fields of the transaction are deleted 24 hours after it completes, and your exchange history is stored only in your browser.
• A support chat is on every page, and questions are handled by exchange code.

For Zcash, the form accepts a transparent address, one that starts with t1 or t3. You can move the coins into the shielded pool afterwards in your own wallet, as explained in the guide to Zcash addresses: t1, z and unified. The simplest option is to buy Zcash with bitcoin to your own address, and if you need a coin where amounts are always hidden, you can exchange BTC to Monero without registration.

FAQ

Can coins be traced after Tornado Cash?

Not directly: a mixer breaks the link between a deposit and a withdrawal. But if withdrawals follow deposits right away and in the same denominations, they get matched by timing and count. That is what happened with the theft from Ledger buyers.

Does Zcash hide the transaction amount?

Inside the shielded pool, the sender, the recipient and the amount are hidden. Entering the pool from a transparent address and leaving it to a transparent address are both visible, amounts included.

How did analysts link the Zcash entry and exit?

By matching amounts and timing. According to Bitquery, lots left the pool as two equal payments, and the amounts matched down to the smallest unit of ZEC.

Is it proven that the destination wallets belong to the thief?

No. Bitquery calls the matches strong evidence but not proof, and rates the link for the October 11-12 wallets as moderate.

How much of the stolen money has been frozen?

As of October 12, Tether has frozen $10.0 million in USDT across 20 wallets. Another 2.38 million USDC sits in two wallets that Circle can block.

Can ETH or bitcoin be frozen?

No. These coins have no issuer controlling balances. They can only be stopped at an exchange or a service where they arrive.