Key takeaways
- Bitquery estimates $102 million stolen across six blockchains
- Ledger confirms an unauthorized implant in one device
- On-chain findings reveal gaps in earlier theft estimates
Early estimates emerged on October 9, when independent researchers identified suspicious transfers from wallets associated with CryptoBilis customers. Initial findings suggested losses exceeding $72 million before additional addresses pushed the reported figure above $86 million.
A subsequent Bitquery investigation increased the estimated total to $93.2 million, covering Tron, Bitcoin, Ethereum, Solana, BNB Chain and Polygon.
According to Bitquery, Tron accounted for approximately $70.5 million in losses, followed by $16.8 million on Bitcoin and $3.7 million on Ethereum. Researchers counted funds leaving affected wallets rather than subsequent movements between attacker-controlled addresses, reducing double-counting risks.
Blockchain Evidence Points to Coordinated Activity
Bitquery identified unusual transaction patterns suggesting coordinated wallet drains. On Tron, 25 wallets reportedly authorized the same request within three seconds, while investigators documented two weeks of small test transactions preceding the October 9 incident.
The findings resemble broader concerns surrounding hardware wallet vulnerabilities, although blockchain records cannot independently establish how the attackers obtained private keys.
Investigators also traced 2,990 ETH through Tornado Cash and Zcash, illustrating how stolen assets can move through privacy-focused infrastructure. Similar fund movements have complicated investigations into stolen Bitcoin from other hardware-wallet incidents.
Bitquery reported that Tether froze approximately $10 million in USDT across 20 wallets. The intervention highlights the stablecoin freeze powers available to centralized issuers, although freezing funds does not automatically return them to victims.