The Ledger reseller drain, through NEAR Intents
On October 9, 2026, Ledger said it was investigating fund losses reported by people who bought devices through CryptoBilis, a reseller in Southeast Asia, and asked the reseller to stop selling. Ledger said its own systems were not breached and has not confirmed a cause or a total. Independent researchers estimate the losses at between about $72 million and $93 million across several chains.
This page does not retell the investigation. It takes one address that investigators published and shows what Trace can check about it yourself, and where the trail cannot be followed.
The address, and who named it
Bitquery’s write-up of the case lists 0x816d5ee17db1495d1409f135b98ff3edc5f3cdf8 among the Ethereum wallets it describes as holding funds that came back out of Zcash on October 10. That attribution is Bitquery’s, built on matching amounts and times. Bitquery itself rates the link between the stolen funds and these payouts as strong but not proven. Nothing on this page establishes who controls the wallet.
Open the wallet in Trace, then use Check NEAR Intents in the sidebar.
What NEAR Intents reports
NEAR’s Intents Explorer lists 14 completed swaps into this wallet, all on October 10 between 11:04 and 12:34 UTC. Every one swapped ZEC for USDC on Ethereum:
| Swaps | 14, all completed |
| ZEC in | 909.49949924 ZEC, about 52 to 72 ZEC per swap |
| USDC out | 1,110,263.815937 USDC |
| Paid in at | 14 separate single-use transparent Zcash addresses (t1…) |
| Paid out from | NEAR Intents’ Ethereum bridge wallet 0x2cff890f0378a11913b6129b2e97417a2c302680 |
What Ethereum confirms
A swap report is a claim by NEAR. Check on chain reads each payout transaction’s receipt on Ethereum and requires a USDC Transfer event, emitted by USDC’s own contract, paying this wallet exactly the reported amount. All 14 match, in blocks 26,161,649 to 26,162,129. The USDC really did arrive, in the amounts NEAR reports, from NEAR’s bridge wallet.
Where the trail stops
Each swap began with ZEC sent to a single-use transparent Zcash address. Bitquery’s reading is that those coins had just passed through Zcash’s shielded pool after leaving Tornado Cash. A shielded Zcash transaction hides its sender, recipient and amount, so no explorer, including this one, can draw a line from the stolen ETH to these deposits. The connection rests on amounts and timing, which is why it is reported as likely rather than proven.
NEAR’s record does not name a visible sender either. Each swap’s refund address, where ZEC would have gone back had the swap failed, is a shielded Zcash unified address (u1…), so it reveals nothing about who paid in.
That is the honest shape of this case: the edges are public and checkable, and the middle is not. The same property that protects an ordinary person’s savings also hides this hop.
What this page does not claim
It does not identify anyone, and it does not say this wallet holds stolen funds. It reports what NEAR Intents and Ethereum record about one published address, as observed on October 11, 2026. Loss figures, wallet lists and their attribution come from the investigators below and may change as the case develops.
Sources: The Block on Ledger’s statement, Bitquery’s investigation, Protos on the loss estimates.
Edition 1 · October 11, 2026. Swap data from NEAR’s Intents Explorer; payouts checked against Ethereum receipts from a public RPC. Corrections should name the address or transaction and the disputed statement; use the Support link in the site footer.