Key Highlights

  • A supply-chain attack on devices sold by a Ledger reseller reportedly led to stolen Ether being moved into Zcash (ZEC), according to a blockchain analytics report that is not yet fully published.
  • Losses tied to the affected devices are estimated at USD 86 to 93 million, a range that is an estimate and has not been verified by the analytics firm in a full report.
  • The stolen Ether was reportedly routed through Tornado Cash and NEAR Intents before reaching ZEC, and the route is described in the report and not independently confirmed.
  • No individuals are named here, the account is reported and unverified, and readers should wait for the full report of the analytics firm before relying on any figure or route.

What Is Reported

A blockchain analytics report describes a supply-chain attack linked to devices sold by a Ledger reseller. Ledger makes hardware wallets, which are devices that store the private keys controlling digital assets. In a supply-chain attack the compromise happens before the product reaches the customer, for instance through tampered devices or altered setup instructions. Losses tied to the affected devices are estimated at USD 86 to 93 million. The estimate is a range, it has not been verified, and the full report of the analytics firm is still awaited. No individuals are named in this article. All details below are reported and unverified, and they may change once the full analysis is published or the companies involved comment.

How the Funds Reached Zcash (ZEC)

According to the report, the stolen Ether was routed through Tornado Cash and NEAR Intents into ZEC. Tornado Cash is a mixing service that pools deposits to obscure the link between sender and receiver, and NEAR Intents is a cross-chain system that lets users express a desired swap and have it fulfilled across networks. Zcash (ZEC) is a digital asset with optional shielded transactions that hide amounts and addresses. Together these steps make tracing harder, which is why investigators watch them. The route is described in the report and has not been independently confirmed, and moving funds into ZEC does not by itself show anything about the asset's own security.

Risks and What to Watch

The first risk is that the estimate changes, since early loss figures often move as analysts trace more wallets. A second is that the route is incomplete, because funds can move through several services. A third is market impact, as large inflows into a privacy asset such as Zcash (ZEC) can affect prices and attract regulatory scrutiny of the services involved. Users of hardware wallets can watch for guidance from Ledger, and any statement from the reseller and the analytics firm. Buying hardware only from official channels is a common security practice in cases like this. Readers should wait for the full report before relying on the USD 86 to 93 million range. Nothing here is advice about Zcash (ZEC) or any other asset.

Where Things Stand

The reported route into Zcash (ZEC) ran from stolen Ether through Tornado Cash and NEAR Intents, after a supply-chain attack on devices sold by a Ledger reseller, with losses estimated at USD 86 to 93 million. All of it is reported and unverified. The full report of the analytics firm should settle the loss figure and the path. Until then, Zcash (ZEC) is the destination in an unconfirmed account, and not a subject of any security finding.