Tether Freezes $10M in USDT Tied to $93M CryptoBilis Ledger Theft

A $93 Million Drain Across Six Chains

Tether (USDT) price held its dollar peg through Monday's session as the issuer moved against stolen funds, freezing $10 million in USDT connected to the drain of Ledger hardware wallets sold by the reseller CryptoBilis. The freeze was verified on-chain by the analytics firm Bitquery, which has tracked the outflows since the drains first surfaced on October 9. Bitquery's running count stands at an estimated $93.2 million siphoned from 315 wallets across six blockchains, while the security research platform YFarmX, reading the same public chain data, reported a higher tally of $94.5 million from 521 addresses on seven chains. Neither figure comes from Ledger, which has not confirmed a total loss, so each remains an analyst estimate rather than an audited number.

Bitquery's breakdown attributes most of the loss to TRON at around $70.5 million, with an additional $16.8 million in Bitcoin (BTC) and $3.7 million in Ethereum (ETH), plus smaller amounts on BNB Chain, Polygon and Solana. The on-chain timing suggests months of preparation: addresses tied to the theft were set up on September 25 and rehearsed with dozens of trial transfers through early October. On October 9, attackers reportedly rewrote permissions on 30 TRON wallets, then moved some 203.8 BTC out of 111 Bitcoin wallets inside a single block about an hour later, a sequence that works only if the attacker already holds the private keys. The freeze cuts in where a chain-level theft cannot be reversed, because a stablecoin issuer can blacklist tokens tied to crime at the address level, a lever neither Bitcoin nor Ethereum offers its own holders. Bitquery estimated roughly $81 million in traceable tokens was still on-chain as of October 11, though some funds had already passed through the crypto mixer Tornado Cash and through Zcash.

Ledger Points to a Physical Implant

Ledger said on Sunday in a statement posted on X that the investigations are still under way, three days after the drains first surfaced. Its confirmed account so far is narrow: every case identified involves devices sold by CryptoBilis, a third-party vendor that operated in Malaysia, Indonesia and the Philippines, and there is no evidence that Ledger's own systems, services or direct sales channels were compromised. On October 10, the company reported that at least one affected device carried an unauthorized physical implant, the first hardware-level evidence in the case. A public teardown by Mt. Gox founder Mark Karpelès went further. Taking apart a Ledger Nano X bought in Malaysia, he found components hidden under the screen: a cellular modem, an eSIM and a small chip able to intercept what the display shows. Recovery words appear on that screen during setup, so a component reading the display could relay the phrase over the mobile network and let a thief rebuild the wallet elsewhere. It is not yet proven that every affected device carried such parts.

The authorized-reseller relationship is fueling the criticism. CryptoBilis carried an official Ledger badge on its website, and X user MyCryptoParadise wrote that “It’s not a CryptoBilis incident, it’s a Ledger incident,” asking the company to at least take ownership of the mess. CryptoBilis co-founder Arravind Prabu has said the company was acquired in March 2026 and that the whole team handed over system access during the deal; the only new investor on record was registered in China, and no connection between that ownership change and the thefts has been established. The reseller has suspended sales and deliveries across the brands it carries and closed its stores in all three countries. Ledger told buyers of CryptoBilis devices from the past 90 days not to set up unused units, and urged current users to move assets to a new device with a newly generated recovery phrase, advice that lines up with the broader security threats facing hardware wallets.

Blacklist Leverage, Open Questions

Our reading of the on-chain record is that the theft sits at the key layer, not the chain layer. The rehearsal transfers from September 25, the permission rewrite on 30 TRON wallets and the single-block sweep of 203.8 BTC all require captured keys, and the implant design Karpelès described would supply exactly that if it is confirmed across more devices. The freeze also shows the stablecoin lever at work: a blacklisted USDT balance is inert on any crypto exchange that honors the block, a control the issuer used when it burned and reissued $9.02M in USDT for a government forfeiture, and one federal officials applied to $1 billion in Iran-linked Tether (USDT). Ledger has published no confirmed loss total. The count stands where the trackers left it on October 11: Bitquery at an estimated $93.2 million from 315 wallets, YFarmX at a reported $94.5 million from 521, with roughly $81 million still traceable and the maker's own audited figure still missing.