Researcher Tayvano has traced roughly $100 million to $103 million in stolen crypto tied to a supply-chain attack on Ledger hardware wallets sold through CryptoBilis. She was careful to say how she did it: Zcash’s privacy was not broken.
The trail came from gas payments. The attacker covered transaction fees from an associated wallet, and that one habit tied the operation together.
How the trail came together
The scale of the theft is large. The research findings put the Ledger drainer incident at approximately $103.4 million in stolen assets.
Those funds were spread across roughly 530 addresses on seven different blockchains.
About three-quarters of the looted value sat in USDT on the Tron network. The rest was spread across other chains and assets.
Investigators also identified wallets holding approximately $38.6 million in ETH and $16.9 million in BTC. Tether, the issuer of USDT, froze $10 million of the stablecoin linked to the theft.
According to the research findings, the attacker’s decision to use an affiliated wallet for gas payments became the main link between the many addresses. By analyzing who funded those fees, researchers mapped out the attacker’s infrastructure.
What happened on the Zcash side
Zcash is a privacy coin. Its shielded transactions are designed to hide the sender, the receiver and the amount from public view.
Tayvano stressed that those protections held. Nobody cracked the underlying math.
Instead, the Zcash portion of the trail was traced by matching 108 exact value exits to incoming batches. In plain terms, funds went into the shielded pool in certain amounts and came out in identical amounts, and the pattern lined up.
That distinction matters. A flaw in Zcash’s cryptography would be a protocol-level problem for every user. A pattern left by one careless operator is a lesson in operational security.
Background: a supply-chain attack, not a wallet hack
The theft traces back to Ledger hardware wallets sold via CryptoBilis. That makes it a supply-chain attack, where the compromise happens somewhere along the path between the product and the buyer.
Once the funds were drained, the attacker had a familiar problem. Stolen crypto is visible on public ledgers, so the goal becomes scattering it, swapping it and routing parts of it through privacy tools until the trail goes cold.
Spreading value across roughly 530 addresses and seven chains fits that playbook. So does routing part of it through a privacy coin.
What this means
For stablecoin issuers, Tether’s $10 million freeze shows a different kind of leverage. With about three-quarters of the stolen value sitting in USDT on Tron, a centrally issued token gave investigators a choke point that a decentralized asset would not.
For investigators, the case reinforces that metadata often matters more than encryption. Fee funding, timing and amount patterns can link addresses even when the transactions themselves are hidden.
The remaining questions are practical ones. How much of the roughly $103.4 million can actually be recovered, and whether the identified ETH and BTC holdings can be frozen or seized, will determine whether this tracing work turns into money back in victims’ pockets.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.