A hacker linked to a Ledger hardware wallet reseller breach reportedly moved $1. 07 million in Ether to Tornado Cash and a separate $270,000 in ETH to Binance, according to on-chain data flagged by researchers tracking the wallet.
A hacker linked to a Ledger hardware wallet reseller breach reportedly moved $1.07 million in Ether to Tornado Cash and a separate $270,000 in ETH to Binance, according to on-chain data flagged by researchers tracking the wallet. The two transfers split the stolen funds between a privacy mixer and a centralized exchange, complicating recovery efforts.
Ledger Reseller Hacker Routes $1.07 Million in ETH Through Tornado Cash
On-chain records surfaced via Etherscan show a wallet attributed to the Ledger reseller attacker sending approximately $1.07 million worth of ETH into Tornado Cash, the smart-contract mixer that obscures transaction trails by pooling and redistributing deposits. The move is consistent with an effort to break the on-chain link between the stolen funds and any downstream withdrawal address. For related coverage, see GCCI 2026 Profile: Korea's Crypto Market Explained.
Tornado Cash works by accepting ETH deposits in fixed denominations and issuing a cryptographic note that can be redeemed by a different wallet, making the original source harder to trace. Once funds enter the mixer, blockchain analytics firms must rely on heuristics rather than direct address clustering to follow the money. When Binance’s CZ urged users to quarantine wallets following the $86 million Ledger reseller breach, the concern was precisely this scenario: funds moving quickly through obfuscation layers before exchanges could freeze them. For related coverage, see France Votes to Tax Bitcoin-to-Stablecoin Swaps: What Happens Next.
$270,000 in ETH Sent to Binance Adds a Second Cash-Out Route
A second transfer of approximately $270,000 in ETH went directly to Binance. Unlike the Tornado Cash leg, a deposit to a centralized exchange requires the recipient wallet to pass the platform’s compliance checks, and exchanges are obligated under anti-money-laundering rules to flag and freeze funds tied to known hacks if alerted in time. For related coverage, see Glassnode Warns 31.2% of Bitcoin Supply Faces Quantum Risk.
The split between a mixer and an exchange suggests the attacker may be testing multiple liquidation paths simultaneously. The Tornado Cash portion, at roughly four times the size of the Binance transfer, represents the larger and harder-to-track share of the reported movement.
What the Split Destination Means for Tracing the Funds
The two destination types carry different implications for investigators. Tornado Cash effectively obscures provenance, while a Binance deposit preserves a potential chokepoint: if the exchange identifies the deposit wallet as linked to the hack before withdrawal, it can freeze the funds and cooperate with law enforcement. Whether that window remains open depends on how quickly the relevant authorities filed a freeze request.
On-chain transfer amounts remain useful even after mixer entry. Blockchain analytics firms can cross-reference deposit timing, denomination sizes, and subsequent withdrawal patterns to probabilistically link mixer outputs to the original attacker wallet. The Etherscan address history tied to the reported hacker wallet provides a starting point for that analysis, though the research underlying this report did not independently verify the wallet attribution or confirm final fund disposition.
The Ledger reseller incident is a reminder that hardware wallet supply chains carry custodial risk that the devices themselves are designed to eliminate. Compromised resellers can embed malicious firmware or intercept seed phrases before a device reaches the buyer, leaving users with a false sense of self-custody. Ledger has continued expanding its on-device financial services, making firmware and reseller integrity increasingly consequential for a growing user base.
Bitcoin’s UTXO model and its comparatively transparent mempool make large theft movements easier to track than many EVM-chain transfers, in part because Bitcoin analytics tooling is more mature. The ETH movements reported here, split across a mixer and an exchange, illustrate why attribution on Ethereum requires combining exchange cooperation with probabilistic on-chain analysis rather than direct tracing alone.
Additional source references: source document 1.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
