Gas spike detected. Run.
2,990 ETH — roughly $7.45 million at today's tape — just walked into Tornado Cash. Specter, the on-chain investigator, flagged the deposit this week. The wallets trace back to the Ledger hardware supply chain compromise. Not a smart contract exploit. Not a phishing link. Physical devices, seeded before they ever reached a user's hands.
That distinction matters more than the dollar figure. Fourteen addresses fed the mixer across a two-day window, October 9-10. That is not a panic dump. That is scripted dispersal. Someone ran code.
Then they got sloppy. The attacker reused a withdrawal address. Linked a gas wallet. Two moves that handed Specter the thread to pull — after Tornado Cash, after a cross-chain hop through NEAR Intents, after a conversion into shielded ZEC, the exact tool whose whole purpose is to vanish.
Based on my audit experience tracing the 2022 UST decoupling, the fancy tools rarely fail. The humans running them do.
Let's set the board.
Ledger remains the market-share leader in hardware wallets. Its value proposition has always been singular: your private keys never touch the internet. Offline. Air-gapped. Final.
That model assumes one thing nobody audits hard enough — that the device you unbox is the device Ledger built. CryptoBilis, a distributor somewhere in that chain, sits at the center of the assumption right now. Whether it operated as an authorized channel or an independent reseller determines who carries the liability. As of writing, that question is unanswered. That silence is the story.
The washing infrastructure is equally familiar. Tornado Cash — the Ethereum mixer OFAC sanctioned in 2022, saw a court rule the action exceeded authority in 2024, then watched OFAC delist it in 2025 — is back in the headlines for the same reason it always is. It works.
NEAR Intents is the newer piece. An intent-based system routes user goals through solvers rather than a conventional bridge. The on-chain footprint looks nothing like a standard transfer. That structural difference is exactly why it deserves scrutiny here.
ZEC closes the loop. Shielded transactions hide sender, receiver, and amount. For an operator parking illicit value, it is the ideal terminal asset.
This is a bear market. In a bear market, nobody cares about your narrative. They care whether the rails under their assets hold. This event says one rail — the one you physically hold — has a seam.
Now the mechanics. Follow the money.
Fourteen addresses, funded in a tight window. The clustering pattern is programmatic — the split times are too uniform for manual clicks. My read: an automated script did the dispersal, likely to stay under per-address heuristics that flag large single deposits.
Each address fed Tornado Cash. Total: 2,990 ETH. The mixer breaks the on-chain link between deposit and withdrawal — in theory. In practice, it breaks nothing if you make mistakes on the other end.
From the mixer, funds moved through NEAR Intents and converted into ZEC. Three layers of obfuscation: mixer, cross-chain intent, privacy coin. On paper, a strong stack.
Then the OPSEC collapsed. Specter's clustering caught a reused withdrawal address — the same address that had received funds earlier touched the cash-out path again. Separately, a gas wallet linked to the operation appeared on both sides of the chain. Two independent linking points. One careless operator.
Here's the part the market is missing. This does not read like a single-victim theft. Fourteen addresses with concentrated amounts look like aggregated funds from multiple compromised devices — a batch distribution attack, not a targeted hit. If that holds, the victim count is not one. It is many, and none of them know it yet.
The hardware trust model is the real casualty. A user buys a Ledger precisely to remove counterparty risk. The supply chain attack reinstalls it — before the device is even powered on. You cannot patch a device that was compromised before you owned it.
The intent layer worries me more than the mixer. Tornado Cash has been through the regulatory wringer; its use is documented, tracked, understood. NEAR Intents is new, and its solver layer appears to route capital without source screening. If a solver will match a swap without asking where the ETH came from, you have built a laundering lane with a fresh coat of paint.
ERC-20 rush vibes. Proceed with caution. Every new primitive that improves UX also improves the UX of moving dirty money.
Here is the angle nobody is publishing. The consensus take is "privacy tools win again." Wrong frame.
The real signal is that the attacker's skill and the attacker's discipline are mismatched — and that mismatch is repeatable. Pulling off a hardware supply chain implant is genuinely hard. It requires physical access to a manufacturing or distribution step. That is a high-skill, high-logistics operation. Reusing an address and cross-linking a gas wallet is beginner-level.
That combination tells you something specific: the market now contains technically capable actors who are not professional money launderers. They can breach a supply chain but cannot clean the proceeds. That is a more dangerous profile than a cartel, because they are unpredictable and they will get caught — dragging enforcement toward every tool they touched.
The second underreported thread: Tornado Cash's delisting changed the risk calculus. In the sanctions window, using the mixer was itself a red flag. Post-delisting, it is just a tool again. Expect volume to rise, and expect that rise to re-open the legislative fight everyone assumed was settled.
Uniswap V2 moved the needle on how liquidity migrates. The same lesson applies here — new rails absorb flow fast, and compliance catches up slow.
Watch three things. Whether Specter's 14-address cluster expands — more addresses mean a batch attack and a longer news cycle. Whether Ledger names CryptoBilis and owns or disowns the channel. And whether NEAR Intents introduces solver-level address screening before a regulator does it for them.
The devices are in your drawer. The question is whether they were yours before you bought them.