PeckShield Links $3.89 Million in Ledger Theft Funds to Binance Deposits

Theft Funds Arrive at Binance After Stablecoin Detour

Blockchain security firm PeckShield reported on Oct. 11 that roughly $3.89 million in cryptocurrency tied to thefts affecting Ledger hardware wallet customers reached Binance deposit addresses on the Tron network. The transfers include 3.685 million USDT and 615,000 TRX, valued at about $204,000.

The money moved over the two days preceding the alert. PeckShield identified the destinations as Binance deposit addresses, giving investigators an exchange-account lead alongside funds previously traced through Tornado Cash and the USDD stablecoin.

Key numbers from the trace

• PeckShield identified transfers of 3.685 million USDT and 615,000 TRX (about $204,000) reaching Binance deposit addresses on Tron.
• Bitquery separately traced 5.2 million USDT into three Binance deposit addresses by the morning of Oct. 11.
• Five wallets with trading patterns resembling over-the-counter services received USDT after 5.1 million USDD was converted back to USDT on Oct. 10.
• Bitquery estimates Tether froze $10 million in USDT across the wider theft cluster earlier.
• Neither PeckShield's alert nor Bitquery's report confirms that Binance has frozen the newly reported deposits.

How the money moved

The exchange route follows earlier efforts to move funds beyond the reach of USDT issuer Tether. The Defiant previously reported a 2 million USDT conversion into USDD through a peg stability module. Tether's USDT freeze controls do not extend to USDD, a separate stablecoin.

Separately, MistTrack reported about 463 ETH entering Tornado Cash from an incident-linked address on Oct. 10. Tornado Cash is a tool that obscures transaction trails on the Ethereum blockchain, making it harder to follow where money goes.

What the trace confirms

PeckShield's alert confirms that stolen funds linked to Ledger and reseller CryptoBilis thefts reached Binance deposit addresses on Tron. Bitquery's investigation adds a separate trail showing USDT flowing through intermediary wallets into Binance. These are confirmed blockchain movements recorded on public networks.

Where the trail gets murky

Bitquery cautioned that intermediary wallets on the route also handle other clients' money. A deposit trail does not by itself identify the thief or establish how much of the deposited money belongs to the theft. The analytics firm noted that the USDT sent to Binance includes other people's money, so the thief's exact share cannot be determined.

Bitquery also stated that its figures represent gross flows through intermediaries and should not be added to PeckShield's estimate as a measure of stolen money recovered.

Why this matters for victims

For victims, the distinction between tracing money through blockchain wallets and identifying the exchange accounts credited with deposits matters. The exchange lead gives investigators a potential source for account records, but Bitquery noted that Binance has not been confirmed as having frozen these deposits. Without a confirmed freeze or identification of the thief's exact share, recovery remains uncertain.

Ledger is still investigating. In an Oct. 10 update, the hardware-wallet maker said one impacted user's device contained an "unauthorized hardware implant" and that it had no indication its own security infrastructure, systems, or services had been compromised. Ledger also said CryptoBilis had stopped selling all hardware-wallet inventory until the investigation concludes.

Sources

• The Defiant