Ledger dealer hackers sent $1.07 million in ETH to Tornado Cash and $270,000 to Binance

Ledger distributor was hacked: 1.07 million ETH was mixed through Tornado Cash, and 270,000 ETH was transferred to Binance

According to online data provided by researchers tracking the wallet, a hacker related to the intrusion of Ledger hardware wallet distributor has transferred approximately US$1.07 million worth of Ethereum (ETH) to the privacy currency mixer Tornado Cash, and transferred another US$270,000 worth of ETH to the centralized exchange Binance. These two transfers disperse stolen funds to privacy mixers and centralized exchanges, greatly increasing the difficulty of fund recovery.

Transfer of 1.07 million ETH via Tornado Cash to cut off on-chain connections

On-chain records on Etherscan show that a wallet attributed to a Ledger distributor attacker sent approximately $1.07 million worth of ETH to smart contract mixer Tornado Cash. Tornado Cash blurs trading trajectories by pooling and reallocating deposits. The move aims to cut off the chain between stolen funds and any downstream withdrawal addresses.

Tornado Cash works by accepting fixed-denomination ETH deposits and issuing crypto notes that can be redeemed by different wallets, making it more difficult to trace the source of the original funds. Once funds enter the mixer, blockchain analytics companies must rely on heuristics rather than direct address clustering to track the flow of funds. Previously, when Binance founder Zhao Changpeng urged users to quarantine wallets after $86 million was stolen from Ledger distributors, this was the scenario that was worried about: funds were quickly transferred through layers of confusion before the exchange was frozen.

270,000 ETH is transferred to Binance to open a second monetization channel

Another ETH transfer of approximately $270,000 was sent directly to Binance. Unlike the Tornado Cash Path, depositing into a centralized exchange requires receiving wallets to pass through compliance checks on the platform, and under anti-money laundering regulations, if the exchange receives timely alerts, it is obligated to flag and freeze funds associated with known hacking attacks.

This split of funds between the mixer and the exchange suggests that an attacker may be testing multiple monetization paths simultaneously. Among them, the portion transferred to Tornado Cash is about four times the size of the portion transferred to Binance, representing a larger and more difficult to track share of funds in this report.

Impact of destination dispersion on fund tracking

These two different funds 'destinations have different meanings for investigators. Tornado Cash effectively masks the source of the funds, while Binance's deposits retain a potential bottleneck: If the exchange can identify that the deposit wallet is linked to a hacker before the funds are withdrawn, it can freeze the funds and cooperate with law enforcement. Whether this window period remains open depends on the speed with which relevant departments submit freezing requests.

Even if the funds enter the currency mixer, the amount transferred on the chain still has reference value. Blockchain analytics companies can probability-link the output of the money mixer to the original attacker's wallet by cross-checking the deposit time, denomination size, and subsequent withdrawal patterns. Although the Etherscan address history associated with this report provides a starting point for such analysis, the research behind this report does not independently verify wallet ownership or confirm the final disposition of funds.

Supply Chain Risks and Industry Implications

The Ledger distributor incident reminds us that there is a custody risk in the supply chain of hardware wallets, which is the risk that the device itself is designed to eliminate. Infected distributors may embed malicious firmware or block mnemonics before the device reaches the buyer, giving users a false sense of self-hosting security. As Ledger continues to expand financial services within its devices, firmware and distributor integrity are becoming increasingly important to a growing user base.

Bitcoin's UTXO model and its relatively transparent memory pool make the movement of large-scale stolen funds easier to track than transfers on many EVM chains, in part because Bitcoin's analytical tools are more mature. The ETH capital flows reported here span mixers and exchanges, explaining why attribution on Ethereum requires a combination of exchange cooperation and probabilistic chain analysis rather than relying solely on direct tracking.