Tether Freezes $10 Million in USDT Linked to $93 Million Ledger Wallet Exploit

Stablecoin issuer halts funds tied to hardware-wallet hack

Tether has frozen $10 million in USDT linked to a crypto theft that drained wallets connected to Ledger hardware devices sold through its authorized reseller, CryptoBilis. Blockchain analysts estimate the total amount stolen reaches approximately $93 million, though Ledger has not confirmed the full figure.

The incident, first reported on October 9, 2026, involves physical tampering with hardware wallets. Ledger is a company that makes devices people use to store their crypto safely offline. A hardware wallet is a physical gadget that holds private keys, which are like secret passwords needed to access crypto assets.

Key numbers from the investigation

• Blockchain analytics firm Bitquery traced $93.2 million linked to the exploit across 315 wallets on six blockchains.
• Security research platform YFarmX reported a slightly higher figure of $94.5 million stolen from 521 addresses across seven blockchains.
• The stolen assets were mostly USDT and TRON tokens.
• Tether froze $10 million in USDT tied to the theft.
• As of October 11, roughly $81 million could still be traced onchain, though some funds had moved through privacy tools like Tornado Cash and Zcash.
• Ledger confirmed an unauthorized hardware implant in at least one affected device.

What Ledger says

Ledger told CoinDesk on Sunday that investigations into the theft are still underway. The company confirmed it found an unauthorized hardware implant in at least one device sold through CryptoBilis. However, Ledger did not say whether the stolen wallet was compromised in the same way or explained how the devices were tampered with.

Ledger also did not respond to a CoinDesk request confirming the total amount stolen or stating whether it is considering a reimbursement plan for affected users.

In guidance to affected customers, Ledger advised users not to set up unused devices and urged those already using a device from CryptoBilis to transfer their assets to a new device with a newly generated recovery phrase, which is a backup sequence of words used to restore access to a crypto wallet.

Ledger stated that every confirmed case involves devices sold by the Southeast Asian reseller. However, critics point out that CryptoBilis was listed as an authorized sales channel on Ledger's own website, raising questions about the company's responsibility.

What blockchain analysts report

Bitquery confirmed the Tether freeze and noted that stablecoin issuers have the ability to block tokens linked to criminal activity, unlike bitcoin or ether, which cannot be frozen by anyone except their original holders.

Both Bitquery and YFarmX based their estimates on public blockchain data, not on a confirmed Ledger loss total. The two firms disagreed slightly on the amount stolen and the number of affected addresses, which reflects differences in their detection methods rather than a confirmed official figure.

Why the Tether freeze matters

Stablecoins like USDT are designed to hold a steady value, typically pegged to the US dollar. Because Tether is a centralized company that issues these tokens, it has the power to freeze wallets it identifies as linked to crime. This is a significant advantage in pursuing stolen funds compared to decentralized cryptocurrencies like bitcoin, where no single entity can freeze transactions. The $10 million freeze represents one of the larger stablecoin freezes tied to a hardware wallet exploit.

Uncertainty that remains

Several important questions are still unresolved. The total amount stolen has not been confirmed by Ledger and differs between analyst reports. It is unclear how many devices were tampered with or whether the unauthorized implant was a targeted attack or part of a broader supply chain compromise. Ledger has not announced any reimbursement plan. Tether also did not respond to CoinDesk's request for comment on the freeze.

What happens next

Ledger said investigations remain ongoing. No specific timeline for conclusions or remediation has been announced. Users with devices purchased through CryptoBilis have been advised to move their assets to newly generated keys before setting up or continuing to use their current devices.

Sources

• CoinDesk

Read also: Tether Freezes $1.45M in USDT on THORChain, Then Reverses the Move