On-chain analysis indicates the attacker behind recent Ledger wallet hacks has been draining cryptocurrency since at least September 8. Researcher @tanuki42_ identified evidence of prior drains predating the widely reported October 9 incidents, suggesting a longer operational timeline for the malicious actor. The findings point to an ongoing campaign rather than isolated events, with the drainer successfully extracting funds from victims over multiple weeks. This extended activity window highlights persistent vulnerabilities exploited by the attacker before broader community awareness emerged.