Ledger CryptoBillis Hack: $72.9M Still in Attacker-Controlled Addresses

The concentration of stolen funds in attacker-controlled wallets, rather than immediate full laundering, suggests a deliberate holding pattern that keeps the assets traceable yet unspent. The partial Tornado Cash transfers show a preference for mixing only what is needed to fund operations, leaving the bulk exposed to chain analytics. For counterparties and exchanges, the practical risk is tainted-asset exposure if those balances ever move. Whether the remaining holdings stay dormant or are gradually layered out is the open question.