How an Independent On-Chain Analyst Traced $75M From the Ledger Drain
By Iaros Belkin, Founder of Belkin Marketing, based on the investigation by Phil Grushyn who dig deeper into the Ledger Drain story.
On 9 October 2026, at 05:41:18 UTC, 500,000 USDT moved into USDT0. That was the first rail deposit of the Ledger CryptoBilis drain. At 05:54 came the first sweep into the two main Bitcoin collectors.
Within hours, everyone had an opinion about who was to blame. Very few people had read the chain.
Phil Grushyn had. He’s an independent on-chain analyst, and he published his trace openly, with every address and transaction hash.
What Actually Happened with the Ledger Drain!?
Ledger says the affected hardware wallets were sold through one reseller, CryptoBilis, to users in South East Asia.
Ledger’s position moved in three steps. On 9 October it said it was investigating losses. On 10 October it confirmed an “unauthorized hardware implant” in one impacted user’s device. On 11 October it said every confirmed case involved devices sold through CryptoBilis.
Neither Ledger nor the report gives a dollar total. What Phil Grushyn traced, chain by chain: 75,494,920 USDT on TRON. 220.57 BTC swept from 326 wallets into four collectors. 6,758.3 ETH sent into Tornado Cash in 560 deposits. Don’t add those up. Part of the ETH is the far end of the USDT, so a sum would count some money twice.
Seven Exits and One Freeze
Seven bridges and swap services moved the USDT. USDT0 took 20.00M. THORChain 18.13M. Relay 9.50M, Chainflip 5.91M, NEAR Intents 2.20M. Then the two small ones, Bridgers (0.60M) and HiFiSwap (0.36M). Of all that, 50.13M USDT is matched to payouts on the destination chain.
Tether was fast. Between 12:09:39 and 12:09:45 UTC on 9 October, it blacklisted 31 attacker wallets, and one more at 14:10:51. 10,000,001.11 USDT sits frozen on 20 wallets, read at 18:46 UTC on 12 October.
The two main Bitcoin collectors haven’t moved. They hold 111.28 and 92.51 BTC and have never spent a satoshi. The two smaller collectors, which swept from 7 October, did move funds, and 10.43 BTC now sits on three downstream wallets. Five wallets hold 214.21638709 BTC in all.
The 17 Ethereum wallets held 18,993.32 ETH at 18:46 UTC on 12 October. Most of the Tornado Cash total, 6,678.3 ETH, came from the main depositor wallets. On 12 October another 80 ETH went in. On 13 October one wallet sent another 240 ETH through three new wallets. And the 899.71 ZEC paid to shielded addresses came from 445.2 ETH that left Tornado.
The Distinction Most Hack Reports Skip
Phil Grushyn rates every link High or Medium. At 20:49:21 UTC on 9 October, nine TRON wallets sent 8,806,905.13 USDT to one address in a single block. In my reading, the transfers are not in doubt. What is rated Medium is the link between that sweep and the drain, which rests on timing and pattern. The report’s own definition is short: “Medium = an inference from High facts.”
“This happened” and “this was the attacker” are two different claims. Most write-ups mash them. Keeping them apart is what makes a trace usable by an exchange, a compliance team, or a court.
The European Angle
Ledger is a French company. So which exits can actually name the attacker?
Exchange accounts. Six HitBTC deposit addresses took 313.18 ETH. A Binance account received 3.30M USDT through a pass-through service, though that account may belong to the service. 4.29M USDC went into a vault tagged as Bitget’s cross-chain bridge.
The report lists every deposit address. Each exchange can confirm whether those accounts sit with an EU-regulated entity. Tether is outside the EU.
What Wallet Owners Should Take From It
- Choosing wisely where you buy a hardware wallet is part of its security.
- Watch for dust. The second Bitcoin collector received four 583-sat transfers that the report reads as address poisoning, so never copy an address from your transaction history.
- Speed matters too. Tether froze about six and a half hours after the first rail deposit, and the rails had already been used. Report fast.
The whole trace is in Phil Grushyn’s Ledger / CryptoBilis drain report. Remember: a private report helps one client. A public record helps everyone.
This article was written by Iaros Belkin, founder of Belkin Marketing, a boutique intelligence firm executing strategic media partnerships, international expansion, and executive positioning via VVIP events including Davos WEF, and Strategic Media Partner at Irish Tech News.
See more breaking technology stories here.
