Tether Freezes $10 Million in USDT Linked to $93 Million CryptoBilis Ledger Exploit
Tether has frozen $10 million worth of USDT linked to one of the biggest crypto thefts of the year. The money is tied to the CryptoBilis Ledger exploit, in which attackers drained around $93 million from hundreds of wallets across Asia.
The move is the latest step in a fast-moving case that has shaken hardware wallet users and pushed crypto thefts in October 2026 past $116 million.
What happened in the CryptoBilis case
CryptoBilis was an authorized reseller of Ledger hardware wallets. The company sold devices in Indonesia, Malaysia and the Philippines. Ledger confirmed on October 10 that at least one affected device contained an unauthorized hardware implant — a small change made to the device before it reached the buyer.
Attackers used these tampered devices to steal funds from more than 300 wallets. Most of the stolen money sat on the TRON network (about $70.5 million), with the rest spread across Bitcoin and Ethereum.
Blockchain analysts say the attack was planned for months. The attack wallets were created in late September, and test transfers were made in early October. On October 9, the attackers changed the permission settings on a TRON wallet and moved more than 200 BTC out of 111 Bitcoin wallets in a single block.
Ledger has told users that its own systems and direct sales channels were not affected. All confirmed cases involve devices sold by the same reseller.
Tether freezes $10 million in USDT
After tracing the stolen funds, Tether blacklisted 37 addresses connected to the theft. This froze about $10 million in USDT, blocking the attackers from moving that part of the money.
Tether often works with law enforcement to freeze stolen stablecoins. In this case, the quick action stopped the flow of at least some of the illicit funds on major blockchains. Investigators are still tracing the rest of the stolen money.
The freeze shows one of the key differences between stablecoins and plain crypto. Because Tether can blacklist addresses, stolen USDT can be stopped — something that is much harder with stolen Bitcoin or Ethereum.
A record month for crypto hacks
The CryptoBilis exploit is the largest hack of October 2026 so far. According to security firm CertiK, crypto thefts in the first twelve days of October have already reached $116.1 million across 26 incidents. Another exploit, 79thVault on BNB Chain, accounts for about $12.5 million of that total.
For the full year, more than $2.81 billion has been stolen in crypto attacks, the figures show. Hardware tampering cases like CryptoBilis remain rare but costly, because they strike at the devices users trust to keep their keys safe.
What wallet owners should do
Ledger has given clear advice to customers. Do not set up a Ledger device bought from CryptoBilis in the last 90 days. If you already set one up, move your funds to a new recovery phrase on a device bought directly from the manufacturer.
Security experts add one more rule: never share your 24-word recovery phrase with anyone. No real Ledger employee will ever ask for it.
Tether expands in Latin America
In a separate move on the same day, Tether announced an investment in EFY Finance to grow institutional use of USDT and its US-regulated dollar token USA₮ across Latin America. The investment is part of EFY Finance’s seed round and aims to connect stablecoins more closely with traditional finance in the region.
The two stories together show Tether’s current role in crypto: fighting crime with its freeze powers on one hand, and pushing stablecoin adoption into new markets on the other.
What to watch next
Investigators are still following the remaining stolen funds, and more address freezes may follow. For users, the lesson of the CryptoBilis case is simple: buy hardware wallets only from the manufacturer, and treat any unexpected device behavior as a red flag.