Skip to main content
Crypto News Week

Crypto markets, protocols and policy

Tether freezes $10 million tied to CryptoBilis Ledger theft

Tether froze $10 million in USDT linked to tampered Ledger devices sold by CryptoBilis, while blockchain analysts traced more than $100 million in thefts.

The Crypto News Week Editors3 min read

Tether freezes $10 million tied to CryptoBilis Ledger theft

$10 million in USDT linked to the CryptoBilis Ledger theft has been frozen by Tether, according to blockchain analytics firm Bitquery’s investigation. That is the amount now blocked across 20 wallets; Bitquery’s latest count puts the total stolen at $102 million from 324 wallets across six blockchains. The freeze stops those tokens from moving, but it does not return them to victims.

The theft involved Ledger hardware wallets sold through CryptoBilis, a reseller operating in Southeast Asia. Ledger said it found an unauthorized hardware implant in one affected device. The company has not confirmed a total loss figure.

How did Tether block the stolen USDT?

Tether can block addresses holding USDT, preventing those tokens from being transferred. Bitquery says Tether blocked 37 addresses linked to the theft; 20 still held USDT, with $10 million now frozen. The freeze began about ten minutes after the first public post identifying the theft, according to the firm’s on-chain analysis.

Some stolen funds moved before they could be frozen. Bitquery traced USDT through swap services into ETH, which was then sent through Tornado Cash, a transaction mixer, and Zcash. Some funds later emerged as USDC and were moved before Circle could freeze them, the firm reported.

How much was stolen, and who was affected?

Bitquery’s updated tally is higher than early estimates because it includes additional drained wallets and activity on more chains. The firm says the theft took assets from 324 wallets on TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. Ledger has said every confirmed case involves devices sold through CryptoBilis, but it has not confirmed Bitquery’s figures.

The device issue raises a different risk from a software flaw: a compromised wallet may expose its recovery phrase during setup. Ledger said it found one device with an implant and explained that it copied the 24-word phrase during initial setup, according to CoinDesk’s report. A recovery phrase controls access to the wallet, so anyone who obtains it can move the assets.

What should CryptoBilis customers do?

Ledger advised customers not to set up unused devices bought through CryptoBilis. Customers who have already used one should create a new recovery phrase on a new device and move their funds, the company said.

The frozen USDT remains blocked, but recovery is a separate step. Bitquery notes that Tether may later destroy frozen tokens and reissue them, while the investigation into the theft and the route taken by other assets continues.

References