Tether freezes $10M in USDT linked to $93M CryptoBilis Ledger exploit
Ledger said every confirmed case involves devices sold by the Southeast Asian reseller, but critics say the hardware-wallet maker must answer for an authorized sales channel.
By Olivier Acuna|Edited by Jamie Crawley
Share this article
Summary
As much as $93.2 million in crypto was siphoned from wallets linked to the Ledger devices sold by the reseller CryptoBilis, according to several blockchain analytical and intelligence firms.
Tether has frozen $10 million in USDT tied to the theft, while Ledger said Sunday that the investigations into the theft, first reported three days ago, are still underway.
Ledger confirmed an unauthorized hardware implant in at least one affected device. The company did not say whether the stolen wallet was compromised in the same way or how the devices were tampered with.
Blockchain analysis and intelligence company Bitquery said it traced $93.2 million linked to the Ledger exploit. It said the hackers stole mostly USDT and TRON tokens from 315 wallets across six blockchains. Security research platform YFarmX reported a higher number, saying the attackers siphoned off $94.5 million from 521 addresses across seven blockchains. Both estimates are based on public blockchain data, not a confirmed Ledger loss total.
Ledger did not immediately respond to a CoinDesk request for confirmation of the amount stolen and whether it is considering a reimbursement plan for those affected by the exploit.
The Tether freeze, confirmed by Bitquery, is important because stablecoin issuers can block tokens linked to crime, unlike bitcoin or ether. Bitquery also said roughly $81 million could still be traced onchain as of Oct. 11, while some funds had moved through Tornado Cash and Zcash.
Tether did not immediately respond to a CoinDesk request for comment on the freeze.
Ledger’s effort to characterize the incident as confined to CryptoBilis has drawn pushback because the reseller was listed as authorized on Ledger’s website. “It’s not a CryptoBilis incident, it’s a Ledger incident,” X user MyCryptoParadise wrote. “At least take ownership of this mess.”
The episode is distinct from an April phishing campaign involving a fake Ledger Live app on Apple’s App Store, which drained at least $9.5 million after users entered their recovery phrases. This time, the attacker appears to have obtained the keys needed to directly empty hundreds of wallets.
Ledger advised CryptoBilis customers not to set up unused devices. Those who have already used one should move assets to a new device with a newly generated recovery phrase, it said.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
Sep 24, 2026
Why it matters:
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.