Ledger Theft Stolen USDT Moves Into USDD, Bypassing Tether Freeze

Stolen USDT Swapped Into USDD on Tron

Funds linked to the recent Ledger user thefts were converted from 2 million USDT into USDD on Oct. 9, moving that portion of the money outside Tether's USDT freeze controls, according to Tron blockchain records.

Blockchain analytics firm Bitquery traced the conversion through USDD's stability module. Security firm Hacken confirmed that Tether's freeze tool does not apply to USDD, making the swap a direct route away from recovery mechanisms.

Key Numbers From the Incident

• 2 million USDT was swapped into USDD in four transactions of 500,000 each, between 7:26 a.m. and 7:32 a.m. ET on Oct. 9.
• Bitquery estimates 14.9 million USDT total had been swapped into USDD across the wider incident.
• Bitquery estimates Tether froze $10 million across 20 wallets, against a broader estimate of $92.9 million stolen.
• MistTrack, a tracking platform, linked the theft to address TK6DWN…XT6C and reported losses approaching $90 million.

How the Funds Moved

Tracking platform MistTrack linked address TK6DWN…XT6C to the Ledger thefts. Tron transfer records show that address sent about 10 million USDT to an intermediary wallet, which then sent 2 million USDT to another address that exchanged it for an equal amount of USDD in four separate transactions.

This represents one traced conversion route, not a complete picture of all funds moved during the incident.

Why the Freeze Matters — and Doesn't

Tether can freeze USDT on the blockchain, preventing it from being moved or spent. However, once those funds are swapped into USDD, Tether's freeze has no effect on them. USDD is a separate stablecoin issued on Tron, not controlled by Tether.

Bitquery's investigation noted that even frozen USDT may later be destroyed and reissued rather than returned to victims. A blacklist action alone does not guarantee recovery.

What Ledger Has Said

Ledger said it was investigating losses among Southeast Asian customers who bought devices from reseller CryptoBilis and had asked the reseller to pause sales and shipments. Its notice did not establish how the funds were taken.

Ledger advised buyers from the past 90 days who had not initialized their devices to delay setup. Customers who had already done so should consider moving assets to a new Ledger signer with a new seed phrase.

What Remains Unclear

It is not yet clear how much of the stolen USDT was successfully converted into USDD before tracking firms and Tether responded. The $10 million frozen figure is an analyst estimate from Bitquery, not an announced repayment to customers. No official timeline for victim recovery has been provided.

What Happens Next

No next steps have been announced by Tether, Ledger, or law enforcement in the supplied material. Victims' ability to recover funds depends on whether frozen USDT can be reissued and returned, or whether swapped USDD can be traced and recovered through other means.

Sources

• The Defiant

Read also: Ledger Says Southeast Asia Reseller Linked to $86 Million Drain