A major cryptocurrency theft has taken a new turn after Tether froze approximately $10 million in USDT linked to an incident involving compromised Ledger hardware wallets. The case has raised fresh concerns about cryptocurrency supply-chain security, the risks associated with third-party resellers and the growing role of stablecoin issuers in tracing stolen digital assets.
Blockchain analytics firm Bitquery identified 20 addresses holding the frozen USDT, while investigators continued tracking funds connected to the reported wallet-draining incident. Initial estimates placed suspected losses at approximately $93.2 million across multiple blockchain networks, although the total remains subject to further investigation.
The incident has drawn particular attention because the affected devices were reportedly sold through CryptoBilis, a Southeast Asian cryptocurrency hardware wallet reseller. Ledger has confirmed that at least one affected device contained an unauthorised hardware implant, adding a new dimension to concerns about the security of cryptocurrency storage devices.
Although Tether’s intervention could prevent the frozen tokens from being transferred, it does not mean affected users have recovered their money. Investigators are still examining the transactions, tracing the remaining assets and working to establish the full extent of the losses.
Tether Freezes $10 Million in USDT Across 20 Wallet Addresses
Tether, the company behind the USDT stablecoin, has frozen tokens associated with addresses linked to the reported Ledger wallet-draining incident.
According to Bitquery, Tether blocked 37 addresses connected to the theft. Of those addresses, 20 held a combined total of approximately $10 million in USDT when the freeze was reported.
The action demonstrates how an issuer-controlled stablecoin can be used to restrict the movement of funds suspected of being connected to criminal activity.
Unlike decentralised cryptocurrencies such as Bitcoin, USDT operates under an issuer-controlled framework that allows Tether to freeze tokens at designated blockchain addresses under certain circumstances. This can help limit the movement of suspected stolen funds while investigators examine a case.
However, the intervention has important limitations. Freezing cryptocurrency does not automatically identify the individuals responsible for a theft, establish ownership of every affected asset or ensure that victims will receive compensation.
The $10 million freeze should therefore be viewed as one step in the investigation rather than a resolution of the incident.
How the Ledger Hardware Wallet Incident Unfolded
The incident emerged on October 9, 2026, when cryptocurrency users began reporting that their wallets had been drained.
Subsequent investigations linked confirmed cases to Ledger hardware wallets sold through CryptoBilis, a reseller operating in Southeast Asia.
Ledger later confirmed that at least one affected device contained an unauthorised hardware implant. The discovery raised concerns that the problem may have originated in the device supply chain rather than through a conventional online attack alone.
Hardware wallets are designed to help protect cryptocurrency private keys by keeping sensitive information isolated from internet-connected devices. However, that protection depends on the integrity of the hardware and the security of the device throughout its production, distribution and setup.
A compromised device can undermine those safeguards and expose users to risks they may not anticipate when purchasing what appears to be a legitimate product.
Ledger stated that every confirmed case linked to the October 9 incident involved devices sold through CryptoBilis. The company also said its internal systems and direct sales channels remained unaffected.
As a precaution, Ledger asked CryptoBilis to suspend sales and shipments while the investigation continued.
The findings have placed renewed emphasis on the importance of purchasing cryptocurrency security devices through trusted channels. Nevertheless, investigators have not publicly established whether a single mechanism explains every reported wallet loss, and the precise circumstances of all affected transactions remain under examination.
Blockchain Investigators Trace More Than $90 Million in Suspected Losses
The reported scale of the incident has increased as blockchain analysts have identified additional transactions and potentially affected wallets.
Bitquery initially estimated suspected losses at approximately $93.2 million across several blockchain networks. The figures have been revised as analysts continued tracing transactions, and Ledger has not confirmed a final total.
The assets reportedly involved included USDT and other cryptocurrencies transferred across networks such as TRON, Bitcoin and Ethereum.
Tracing funds across multiple blockchains can be challenging because stolen assets may move through numerous addresses, be exchanged for different cryptocurrencies or pass through services designed to obscure transaction trails.
Investigators may be able to follow the movement of funds on public blockchains, but transaction records do not automatically reveal the real-world identities of the people controlling the receiving addresses.
The use of cryptocurrency mixing services and transfers between different digital assets can further complicate efforts to reconstruct the money trail.
Blockchain analytics can help investigators identify suspicious transactions, connect addresses and locate funds that may still be accessible. However, identifying a transaction is not the same as recovering the assets.
Against this backdrop, the $10 million in frozen USDT represents only a portion of the suspected losses reported so far. It should not be interpreted as the total amount recovered or as evidence that all remaining funds have been located.
Will Victims Recover Their Frozen Cryptocurrency?
For affected cryptocurrency users, the most important question is whether the frozen USDT will eventually be returned.
Tether’s intervention may prevent ordinary transfers of the affected tokens, limiting the ability to move those assets while the investigation progresses. However, freezing funds and returning them to their rightful owners are separate processes.
The eventual outcome may depend on further investigative findings, applicable legal procedures and decisions concerning the ownership and disposition of the frozen tokens.
Until those questions are resolved, affected users should not assume that the funds have been recovered.
The situation also highlights the importance of caution when seeking help after a cryptocurrency theft. Scammers frequently exploit high-profile security incidents by impersonating wallet manufacturers, customer support teams or blockchain investigators.
Some may promise to recover stolen assets in exchange for upfront payments or request sensitive information under the guise of verifying ownership.
Users should never disclose their 24-word recovery phrase to anyone claiming to offer technical support or fund recovery. A legitimate support representative should not need this phrase to investigate a device-related issue.
Anyone affected by the incident should use official support channels and remain wary of unsolicited recovery offers.
What Ledger Users Should Know About Hardware Wallet Security
The incident serves as a reminder that hardware wallet security extends beyond the device itself.
A hardware wallet can provide strong protection when properly designed and used, but its effectiveness depends on the integrity of the hardware, the security of the setup process and the protection of recovery information.
For customers who purchased devices through CryptoBilis, following Ledger’s official security guidance is particularly important.
Users who have not yet set up potentially affected devices should avoid initialising them until they have received appropriate instructions from official support. Those who have already used a potentially affected device should contact Ledger through its verified support channels to determine the appropriate next steps.
Where a device is suspected to be compromised, moving assets to a trusted wallet may be necessary. However, users should first establish a safe process for doing so, ideally using a trusted device and a newly generated recovery phrase that has not been exposed to the potentially compromised hardware.
A new recovery phrase should be generated securely and never reused if there is reason to believe the original has been compromised.
More broadly, cryptocurrency holders should verify the authenticity and provenance of hardware wallets, avoid second-hand or unverified devices and follow manufacturers’ security instructions carefully.
These precautions cannot eliminate every risk, but they can help reduce exposure to attacks involving compromised equipment or stolen recovery information.
Tether’s Freeze Highlights the Trade-Off Between Stablecoin Control and Decentralisation
The incident also underscores a fundamental difference between issuer-controlled stablecoins and decentralised cryptocurrencies.
USDT has a central issuer that can freeze tokens at specific addresses under certain conditions. This capability can provide a practical response when funds are linked to suspected theft, potentially restricting their movement before they are transferred elsewhere.
Bitcoin, by contrast, has no central issuer capable of freezing individual balances through a comparable issuer-controlled mechanism at the protocol level.
The distinction presents both advantages and trade-offs.
For investigators, the ability to freeze certain stablecoin holdings may help contain suspected criminal proceeds. For users, however, it means that access to USDT can be affected by decisions made by the issuer under its applicable policies and procedures.
The incident illustrates how different cryptocurrency designs distribute control and responsibility in different ways. While issuer intervention may support efforts to restrict suspicious transactions, it does not replace effective device security, sound investigative procedures or a clear process for resolving ownership claims.
What Happens Next in the Ledger Wallet Theft Investigation?
Tether’s decision to freeze approximately $10 million in USDT marks a significant development in the effort to track cryptocurrency linked to the reported Ledger wallet-draining incident.
Yet major questions remain unanswered, including the final scale of the losses, the precise mechanism behind the compromised devices and whether additional assets can be identified and frozen.
Blockchain investigators continue tracing transactions across multiple networks, while the reported hardware implant has raised broader questions about supply-chain safeguards in the cryptocurrency industry.
The case demonstrates that protecting digital assets requires more than securing private keys against online attacks. It also requires confidence in the devices used to manage those keys, reliable purchasing channels and effective responses when suspicious activity occurs.
For victims, the priority remains determining whether the frozen assets and any subsequently located funds can be returned. Until that process advances, the freeze represents a restriction on the movement of certain tokens, not a guarantee of reimbursement.
As the investigation continues, the incident may serve as an important reminder to cryptocurrency users and industry participants alike: security depends not only on blockchain technology, but also on the integrity of the systems and devices through which people access it.
Disclaimer: This article is for informational and educational purposes only and should not be considered financial, investment or legal advice. Figures and incident details are based on the information available at the time of writing and may change as the investigation progresses. Cryptocurrency investments and self-custody arrangements carry significant risks. Readers should verify important developments through official sources and consult qualified professionals before making financial or legal decisions.
