Tether Freezes $10 Million in USDT Tied to $93 Million Ledger Reseller Theft

The stablecoin issuer Tether froze $10 million in USDT on October 11 after investigators linked the funds to a major theft from hardware wallets sold by authorized Ledger reseller CryptoBilis. The freeze marks one of the largest recent enforcement actions by the company.

Blockchain analytics firms say the attack ranks among the biggest wallet compromises of the year. Estimates differ, but both reports describe a carefully planned operation that moved tens of millions of dollars in minutes.

What happened with CryptoBilis

CryptoBilis is an authorized reseller of Ledger hardware wallets. In recent days, owners of devices bought through the reseller reported that their funds had disappeared.

Ledger later said it found an unauthorized hardware implant inside at least one affected device. An implant is a hidden component placed inside the wallet during assembly or packaging. It can steal the secret recovery phrase and let attackers move the crypto stored on it.

The company told affected customers to stop using devices bought from the reseller and to move their funds to newly generated wallets. It has not confirmed a final total for the losses.

How much was stolen

Two blockchain analysis firms published estimates that differ slightly:

• Bitquery said about $93.2 million was drained from 315 wallets across six blockchains. Most of the stolen funds — around $70.5 million — were on the TRON network, followed by about $16.8 million in Bitcoin and $3.7 million in Ethereum.
• YFarmX put the figure higher: about $103.4 million stolen from 530 addresses across seven chains.

On-chain data suggests the crime was planned months ahead. Attack addresses were created in late September 2026, followed by small test transfers in early October. On October 9, the attackers changed the permission settings of a TRON wallet and then moved about 203.8 BTC from 111 Bitcoin wallets inside a single block. This pattern points to attackers who already held the private keys of the victim wallets.

Tether’s $10 million freeze

Tether responded by blacklisting 37 addresses, including funds from 20 addresses, freezing $10 million in USDT tied to the theft. When Tether adds an address to its blacklist, the token contract rejects any transfer in or out. The coins stay where they are and cannot be moved, even by the person who holds the private key.

The company says these freezes disrupt the flow of stolen money and give investigators time to trace it across blockchains. In practice, the freeze also slows down any attempt to wash the funds through mixers or exchanges.

A pattern of heavy-handed freezes

This is not the first time Tether has used its freeze power in recent days — and the story explains why “Tether” is trending:

• On October 9, Tether blacklisted four USDT vaults used by the cross-chain protocol THORChain on TRON, freezing about $1.45 million. Trading on the TRON route stalled and roughly $363,000 in payouts sat in a queue. THORChain said it received no warning. Hours later, the addresses came off the blacklist with balances untouched.
• On October 5, the Boston payments firm Conduit sued Tether in a US court, saying the company froze $2.76 million of its USDT in September 2025 and never explained why. Conduit says the freeze forced layoffs and office closures, while Tether kept earning interest on the reserves behind those same tokens.

Tether’s ability to freeze any wallet at the contract level is one of the most debated parts of crypto. Supporters say it helps recover stolen funds. Critics say it breaks the idea of permissionless money, since one company can stop anyone’s balance without a court order.

What this means for everyday users

The CryptoBilis case is a reminder that hardware wallets are only as safe as the hands that made them. Buying from unknown or unauthorized sellers is a known risk, but even an authorized reseller was compromised here.

Simple steps reduce the risk: buy directly from the manufacturer when possible, check the packaging for tampering, and never trust a wallet whose recovery phrase arrived pre-printed. If a device looks odd or behaves strangely, move funds to a fresh wallet before it is too late.

Investigators are still tracing the stolen funds. Whether the $10 million freeze leads to recoveries for victims will depend on how much of the money stays in traceable wallets — and how quickly attackers try to cash out the rest.