Key Takeaways
- • Approximately $92.9 million was stolen from 311 wallets linked to Ledger hardware wallets purchased through Southeast Asian retailer CryptoBilis, according to on-chain analysis firm Bitquery, with Ledger confirming unauthorized electronic components in one victim's device but no intrusion into its own systems.
- • Bitquery reports approximately $10 million in USDT has been frozen, with losses spread across Bitcoin, Ethereum, and TRON.
- • Salus traced 4,970 ETH (about $12.4 million) from a wallet tied to the July 2026 Triple-A breach into Tornado Cash in 56 split transactions on October 9.
- • Japan's Financial Services Agency asked financial institutions, including crypto asset exchange operators, to move early to IC chip scanning for identity verification ahead of the April 1, 2027 reform that abolishes document-image verification.
- • India's Enforcement Directorate arrested media group chairman Rakesh Kumar Gupta over alleged money laundering of 1.68 billion rupees, with suspected use of crypto assets and Hawala channels; guilt has not been established.
Summary
The largest development in this briefing is the estimated $92.9 million theft from roughly 311 wallets tied to Ledger hardware wallets, according to Bitquery's on-chain investigation. The losses are concentrated on units bought through the Southeast Asian retailer CryptoBilis and span Bitcoin, Ethereum and TRON. Ledger has confirmed unauthorized electronic components in at least one victim's device but says no intrusion into its own systems has been confirmed. The figure is an analyst estimate, not a final tally. Bitquery reports that approximately $10 million in USDT has been frozen, which is the clearest recovery signal so far. The episode highlights that hardware wallets can be compromised if devices are tampered with during distribution.
Separately, blockchain security firm Salus reported that 4,970 ETH (about $12.4 million) moved from a wallet associated with the attacker in the Triple-A breach of July to the mixer Tornado Cash. The transfers occurred on October 9 and were split into 56 transactions: 49 of 100 ETH and 7 of 10 ETH. Tracing funds into a mixer is feasible, but correlating them with withdrawal destinations is considerably harder, and the transfer alone does not establish where the funds end up.
In Japan, the Financial Services Agency has asked financial institutions and others to strengthen cybersecurity and non-face-to-face identity verification, and to adopt IC chip scanning early rather than waiting for April 1, 2027. The FSA says document-image verification will be abolished in principle at that point, and crypto asset exchange operators are reportedly within scope. Officials and analysts note that tighter onboarding will not necessarily stop misuse of existing accounts or laundering through overseas exchanges or peer-to-peer channels.
Other items include a Mie Prefecture case in which a woman in her 30s in Iga City transferred about 36.4 million yen in crypto assets in seven installments between July 24 and August 31 to individuals posing as police and prosecutors, according to police. In India, the Enforcement Directorate arrested Rakesh Kumar Gupta, chairman of a media group, over alleged laundering of 1.68 billion rupees, including suspected receipt of over 20 million rupees in cash via crypto assets and Hawala. A five-day detention has been granted, and the charges remain at the investigation stage.
Separately, blockchain security firm Salus reported that 4,970 ETH (about $12.4 million) moved from a wallet associated with the attacker in the Triple-A breach of July to the mixer Tornado Cash. The transfers occurred on October 9 and were split into 56 transactions: 49 of 100 ETH and 7 of 10 ETH. Tracing funds into a mixer is feasible, but correlating them with withdrawal destinations is considerably harder, and the transfer alone does not establish where the funds end up.
In Japan, the Financial Services Agency has asked financial institutions and others to strengthen cybersecurity and non-face-to-face identity verification, and to adopt IC chip scanning early rather than waiting for April 1, 2027. The FSA says document-image verification will be abolished in principle at that point, and crypto asset exchange operators are reportedly within scope. Officials and analysts note that tighter onboarding will not necessarily stop misuse of existing accounts or laundering through overseas exchanges or peer-to-peer channels.
Other items include a Mie Prefecture case in which a woman in her 30s in Iga City transferred about 36.4 million yen in crypto assets in seven installments between July 24 and August 31 to individuals posing as police and prosecutors, according to police. In India, the Enforcement Directorate arrested Rakesh Kumar Gupta, chairman of a media group, over alleged laundering of 1.68 billion rupees, including suspected receipt of over 20 million rupees in cash via crypto assets and Hawala. A five-day detention has been granted, and the charges remain at the investigation stage.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.