Crypto market today: Tether freezes $10M tied to Ledger thefts
Analytics firms trace $93 million to $94.5 million stolen from wallets tied to CryptoBilis-sold Ledger devices; Tether has frozen $10 million in USDT linked to the theft.
| Metric | Figure |
|---|---|
| Traced by Bitquery | $93.2 million |
| Wallets (Bitquery) | 315 across six blockchains |
| Estimate by YFarmX | $94.5 million |
| Addresses (YFarmX) | 521 across seven blockchains |
| USDT frozen by Tether | $10 million |
| Still traceable onchain (Oct. 11) | About $81 million |
Tether has frozen $10 million in USDT tied to the theft from wallets linked to Ledger devices sold by the reseller CryptoBilis, a development that matters for crypto market today because it shows the one lever issuers hold over stolen stablecoins. Blockchain analytics firms put the haul at $93.2 million to $94.5 million, and Ledger said Sunday that its investigation is still underway.
How much was taken
Bitquery said it traced $93.2 million, mostly in USDT and TRON tokens, drained from 315 wallets across six blockchains. Security research platform YFarmX reported a higher total of $94.5 million from 521 addresses across seven chains. Both figures rest on public blockchain data. Ledger has not confirmed a loss total and did not immediately respond to a request about whether it is weighing reimbursement for affected users.
Ledger has confirmed an unauthorized hardware implant in at least one affected device. It did not say whether the wallet that was stolen from was compromised the same way, or how the units were tampered with.
Why the freeze is significant
Stablecoin issuers can block tokens linked to crime, unlike bitcoin or ether, which is why the Tether action stands out. Bitquery confirmed the freeze. Tether did not immediately respond to a request for comment.
The freeze covers a small share of the total. Bitquery said roughly $81 million could still be traced onchain as of Oct. 11, while some of the funds had passed through Tornado Cash and Zcash, two routes that complicate tracking.
Dispute over responsibility
Ledger has characterized the problem as confined to CryptoBilis and advised the reseller’s customers not to set up unused devices. Those already using one should move assets to a new device with a newly generated recovery phrase, it said.
That framing has drawn pushback because the reseller was listed as authorized on Ledger’s website. One X user wrote that it was “a Ledger incident” rather than a CryptoBilis incident, reflecting a broader argument over who answers for losses in an authorized sales channel.
Different from April’s phishing case
The episode is separate from an April campaign involving a fake Ledger Live app on Apple’s App Store, which drained at least $9.5 million after users entered recovery phrases. This time the attacker appears to have obtained the keys needed to empty hundreds of wallets directly.
What to watch
Further freezes by stablecoin issuers, any move by exchanges to flag laundered funds, and a formal loss figure from Ledger are the next markers. A reimbursement decision would indicate how the company assigns responsibility for its reseller network.
Prepared with AI assistance from public sources and reviewed under our editorial policy. Not investment advice.
