Tether Freezes $10M Linked to Ledger Wallet Draining Incident

Tether freezes $10 million USDT linked to the Ledger wallet draining incident, which involved compromised hardware wallets sold by Southeast Asian reseller CryptoBilis. The incident resulted in cryptocurrency losses worth tens of millions of dollars, while blockchain investigators continue tracing the stolen funds across multiple networks.

Blockchain analytics firm Bitquery traced the stolen funds across multiple networks and identified 20 addresses holding approximately $10 million in frozen USDT. The freeze followed reports that users had lost cryptocurrency after using compromised hardware wallets.

However, the freeze does not mean victims have recovered their funds. Investigators continue to examine the theft and track the remaining assets.

Tether Freezes USDT Linked to Crypto Theft

Tether, the issuer of the USDT stablecoin, can freeze tokens at specific blockchain addresses through its issuer-controlled mechanisms.

In this incident, blockchain investigators identified addresses linked to the Ledger wallet draining attack. Tether then blocked USDT at some of those addresses, preventing transfers of the affected tokens.

According to Bitquery, Tether blocked 37 addresses linked to the theft. Twenty of those addresses held a combined $10 million in USDT when investigators reported the freeze.

The action highlights one advantage of issuer-controlled stablecoins: issuers can intervene when they link tokens to suspected criminal activity.

However, this capability also distinguishes USDT from cryptocurrencies such as Bitcoin. Bitcoin has no central issuer that can freeze individual wallet balances at the protocol level.

Ledger Wallet Draining Incident Linked to CryptoBilis

The incident emerged on October 9, 2026, when cryptocurrency users reported drained wallets. Investigators later linked confirmed cases to Ledger hardware wallets sold through CryptoBilis, a reseller operating in Southeast Asia.

Ledger subsequently confirmed that at least one affected device contained an unauthorised hardware implant.

The company said every confirmed case linked to the October 9 incident involved devices sold through CryptoBilis. Ledger also stated that its internal systems and direct sales channels remained unaffected. The company asked CryptoBilis to suspend sales and shipments while the investigation continued.

The discovery has raised concerns about supply-chain security. Hardware wallets protect users’ private keys, but compromised devices can undermine that protection if attackers gain access to sensitive recovery information.

Nevertheless, investigators have not publicly established whether the same mechanism explains every reported wallet loss.

Blockchain Investigators Trace More Than $90 Million

The estimated scale of the theft has grown as blockchain analysts identified additional affected wallets and transactions.

Bitquery initially reported approximately $93.2 million in suspected losses across several blockchain networks. Subsequent updates revised the figures as analysts traced more transactions. Ledger has not confirmed a final total.

The stolen assets included USDT and other cryptocurrencies across networks such as TRON, Bitcoin and Ethereum.

Some funds passed through cryptocurrency mixing services or moved between different digital assets. These transactions made the money trail more difficult to follow.

Blockchain analysis can help investigators trace transactions, but it cannot automatically identify the people controlling the receiving addresses. Nor does tracing funds guarantee their recovery.

The $10 million frozen by Tether therefore represents only a portion of the reported stolen funds, not the total amount recovered.

What the Freeze Means for Affected Users

Tether’s intervention may prevent ordinary transfers of the frozen USDT. However, the freeze does not automatically compensate victims whose wallets were drained.

The return of funds depends on further developments, including the investigation, legal proceedings and decisions about how authorities or other relevant parties will handle the frozen assets.

Meanwhile, Ledger has advised affected customers to take precautions with potentially compromised devices.

Customers who purchased devices through CryptoBilis but have not yet set them up should follow Ledger’s official security guidance instead of initialising them. Users who have already used potentially affected devices should contact official support and consider moving their assets to a trusted device with a newly generated recovery phrase.

Users should never share their 24-word recovery phrase with anyone claiming to offer recovery assistance. Scammers may exploit the incident by impersonating Ledger support or promising to retrieve stolen funds.

Stablecoin Freezes Highlight the Trade-Off Between Control and Security

The incident highlights a distinctive feature of centralised stablecoins such as USDT.

Unlike Bitcoin, USDT has a corporate issuer that can block specific addresses under certain circumstances. This capability gives the issuer a tool to respond to suspected theft, sanctions violations and other risks.

However, the ability to freeze tokens also means users depend partly on the issuer’s policies and intervention decisions.

For cryptocurrency holders, the incident reinforces the importance of understanding wallet security and the risks associated with how a device was purchased and configured.

A hardware wallet can offer strong protection, but the security of its supply chain remains equally important.

You may also like : OKX CEO Criticises CZ Over Binance’s $800M Crypto Crash Compensation

Editorial Takeaway

Tether’s decision to freeze $10 million in USDT linked to the Ledger wallet draining incident marks a significant development in efforts to trace the stolen assets.

However, the frozen funds represent only part of the reported losses. Freezing tokens does not guarantee their return to affected users.

As investigators continue tracing transactions and examining compromised devices, the case highlights two important issues for the crypto industry: the need for stronger supply-chain safeguards and the role stablecoin issuers can play in responding to suspected theft.

The outcome will depend on the ongoing investigation and whether investigators can identify, freeze and ultimately return more of the stolen assets to their rightful owners.