The suspected hacker behind the Ledger distributor CryptoBillis theft has converted USDT to USDD via SUN.io and PSM mechanisms following Tether's freeze of related funds. On-chain data shows the attacker transferred 430.2 ETH, worth approximately $1.07 million, to Tornado Cash across four wallets, with some funds subsequently moved to Binance hot wallets. Arkham-tagged addresses linked to the suspect currently hold approximately $70.6 million in assets. The remaining portfolio consists of 11,406 ETH, 213.37 BTC, 13.65 million USDD, and 10.91 million USDT as the hacker continues to shift holdings amid ongoing fund freezes.