Tether freezes $10M linked to CryptoBilis Ledger theft

CryptoBilis Ledger buyers should leave unused devices uninitialized and move funds from devices they have used to a new recovery phrase: Tether has frozen $10 million in USDT linked to the theft, while investigators now trace $102 million taken from 335 wallets. Ledger has confirmed an unauthorized hardware implant in one affected device, but has not confirmed the total losses.

The freeze blocks some of the traced USDT, but it does not return funds to victims or secure a wallet whose recovery phrase may be exposed.

How much was stolen, and how much did Tether freeze?

CoinDesk reported on Oct. 12 that Tether had frozen $10 million in USDT tied to the theft, citing confirmation from blockchain analytics firm Bitquery. Bitquery’s updated investigation, verified Oct. 16, counts $102 million taken from 335 wallets across six chains; its earlier estimate was $93.2 million. Ledger has not confirmed a total loss figure.

Bitquery says Tether froze the USDT across 20 wallets. The freeze matters because the issuer can block USDT balances, while Bitcoin and ether do not have an issuer with the same control. It does not mean the frozen tokens have been returned to affected wallet owners, and the sources report no reimbursement plan.

The stolen assets moved across several networks and services. Bitquery traced some USDT through bridges and swaps, while other funds were converted into USDD and ETH; it says Tether cannot freeze USDD. As of Oct. 16, Bitquery estimated about $81 million could still be found on-chain, though that figure includes funds in varied locations and is not a recovery estimate.

What should CryptoBilis Ledger buyers do now?

Ledger advised CryptoBilis customers not to set up unused devices. Those who have already used one should create a new recovery phrase on a new device and transfer their assets to it, according to CoinDesk’s report. Bitquery says to follow Ledger’s advice even for devices bought before July.

A recovery phrase is the set of words that can restore access to a wallet; someone who has it can spend the wallet’s funds without the original device. Ledger has confirmed an implant in one affected device, and Bitquery reports that Ledger later explained how it could copy the phrase during setup. The investigation has not established that every drained wallet was compromised through an implant.

Moving funds requires action by the wallet owner, and these reports do not give a single cost: any network transaction fees will depend on the assets and chain used. If you hold USDT on TRON, Bitquery advises checking wallet permissions in a block explorer for keys you do not recognize. Do not send more funds to a drained wallet; Bitquery warns that the thief may still control its key.

CoinDesk’s report on the Tether freeze and Ledger’s response and Bitquery’s updated on-chain investigation detail the claims and their limits.

Source material

• CoinDesk’s report on the Tether freeze and Ledger’s response — coindesk.com
• Bitquery’s updated on-chain investigation — bitquery.io