Tether freezes USDT linked to suspected Ledger reseller thefts near $90 million

Investigators say losses are nearing $90 million as Ledger probes devices sold by authorized reseller CryptoBilis and fund flows span multiple chains.

Tether freezes USDT linked to suspected thefts tied to Ledger devices sold by authorized reseller CryptoBilis, MistTrack said, as blockchain investigators put losses near $90 million.

In an Oct. 9 statement, Ledger said it is investigating reports that customers lost funds after buying devices from CryptoBilis, an authorized reseller in Southeast Asia, and asked the distributor to pause sales and shipments while the review continues. The company advised buyers from the past 90 days not to initialize unsetup devices, and told those already set up to consider moving assets to a new Ledger initialized with a fresh recovery phrase.

Freeze can only reach part of the haul

MistTrack said it observed Tether freezing addresses linked to the suspected thefts. Because USDT includes administrative controls, Tether can restrict transfers from designated addresses. Once frozen, those tokens cannot move via ordinary transactions unless the restriction is lifted. That containment can slow further movements while investigators work to establish ownership.

The report adds two limits. First, the suspected thefts span several networks and assets beyond USDT, including Bitcoin, Ethereum and Tron, so any freeze can only touch USDT on supported networks. Tether cannot freeze native Bitcoin or Ethereum. Second, freezing tokens does not return them to victims; restitution would require additional verification and coordination with counterparties or authorities. MistTrack has not disclosed the dollar value of frozen tokens, so the share of losses that may be recoverable is unknown.

On-chain investigator Specter said flows from hundreds of suspected victim wallets converged into addresses on Bitcoin, Ethereum and Tron. Specter first estimated the losses at more than $86 million. MistTrack later put reported losses closer to $90 million. The report says those totals have not been independently verified and not every wallet in the tally may stem from the same operation.

Prices as of 2026-10-09 23:02 UTC. Source: CoinGecko.

Probe centers on supply chain risk

Binance founder Changpeng Zhao urged caution, writing: “Based on information so far, it seems to be localized to a supply chain attack with one vendor.” He also called for industry coordination: “I expect and know all BNB ecosystem players (and all industry) to help trace and recover the funds.”

Former Mt. Gox CEO Mark Karpelès is examining whether malicious hardware components were inserted into devices distributed to customers, and asked CryptoBilis to open unsold units for inspection, the report says. Ledger’s own security documentation acknowledges that its Genuine Check verifies a device’s Secure Element but may not detect physical modifications elsewhere, meaning a tampered unit could still pass authentication if the original chip remains intact.

The report says there is no confirmed evidence that hardware implants caused the thefts. Ledger has not disclosed how many devices may be affected or the attack method. With the freeze size undisclosed and funds spread across chains, investigators are working to trace remaining balances before they move further.

Source: CryptoSlate.
This article was written with AI assistance and reviewed by an editor.
This content is for informational purposes only and does not constitute financial advice.