PeckShield Traces $3.89 Million in Ledger Theft Funds to Binance Deposits

PeckShield said about $3.89 million in crypto linked to the thefts affecting Ledger customers of reseller CryptoBilis reached Binance deposit addresses on Tron over the two days preceding its Oct. 11 alert.

The security tracker reported transfers of 3.685 million $USDT and 615,000 TRX, valuing the latter at about $204,000. It described the destinations as “Binance deposit addresses,” putting an exchange-account trail alongside the funds previously traced through Tornado Cash and the $USDD stablecoin.

For victims, the distinction is between tracing money through blockchain wallets and identifying the exchange accounts credited with deposits. Blockchain analytics firm Bitquery’s separate investigation identifies Binance as a potential source of those account records. But it cautions that intermediary wallets on the route also handle other clients’ money: a deposit trail does not by itself identify the thief or establish how much can be recovered.

An Exchange Lead, Not a Recovery

Bitquery reported that five wallets with trading patterns resembling over-the-counter services received $USDT after 5.1 million $USDD linked to the theft was converted back into $USDT on Oct. 10. It traced 5.2 million $USDT in subsequent payments from those intermediaries into three Binance deposit addresses by the morning of Oct. 11.

Those are gross flows through intermediaries, not a measure of stolen money recovered. “The $USDT they sent to Binance includes other people's money, so the thief's exact share there cannot be fixed,” Bitquery wrote. Its figures should not be added to PeckShield’s estimate.

The exchange route follows efforts to move funds beyond the reach of $USDT issuer Tether. The Defiant previously reported a 2 million $USDT conversion into $USDD through its peg stability module. Tether’s $USDT freeze controls do not extend to $USDD. Separately, MistTrack reported about 463 ETH entering Tornado Cash from an incident-linked address on Oct. 10.

Bitquery estimates Tether froze $10 million in $USDT across the wider theft cluster. That earlier action does not establish a freeze of the newly reported Binance deposits; neither PeckShield’s alert nor Bitquery’s report confirms Binance has frozen those deposits.

The fund movements come as Ledger investigates the affected devices. In an Oct. 10 update, the hardware-wallet maker said one impacted user’s device contained an “unauthorized hardware implant,” while saying it had no indication its own security infrastructure, systems or services had been compromised. Ledger said CryptoBilis had stopped selling all hardware-wallet inventory until the investigation concludes.