Tether has frozen $10 million worth of its USDT stablecoin in connection with a theft that drained as much as $93 million in assets from Ledger hardware wallets sold by the reseller CryptoBilis. The freeze comes as investigators continue to trace the flow of stolen funds and as Ledger maintains that the incident is confined to devices sold by a single third-party vendor.

What Ledger has confirmed so far

Ledger, the French cryptocurrency wallet maker, has yet to comment on the size of the losses. The company has said that every case it has identified involves devices sold by CryptoBilis, a third-party vendor that operated in Malaysia, Indonesia and the Philippines. It has also stressed that there are no signs of compromise of Ledger's own systems, services or direct sales. That distinction matters because the security model of a hardware wallet rests on the device reaching its owner untampered, with private keys that never leave it.

The case has also taken on a physical tampering dimension beyond software-related vulnerabilities. On October 10, the firm stated that one affected user owned a device with an unauthorized physical implant installed — the first evidence of physical compromise of Ledger wallets in this case.

The company's message to buyers is clear: anyone who purchased a CryptoBilis device within the last 90 days and has not yet configured it should leave it untouched. Those currently using such a device should transfer their coins to another device with a new recovery phrase. The emphasis on a fresh phrase is the crux of the advice: recovery words are the master backup for a hardware wallet, and a wallet can be restored on any compatible device from the phrase alone. Purchasing only through official channels and verifying a device's authenticity at setup are the standard defenses against this kind of pre-sale tampering.

How investigators tallied the losses

The loss figures are attributed to on-chain analysts rather than Ledger. Bitquery estimated that the attack siphoned $93.2 million 315 wallets across six separate blockchains, primarily in USDT and TRON coins. The security platform YFarmX put the number higher, claiming the attack took $94.5 million from 521 wallets on seven different blockchains. Both estimates were based on public chain data.

According to Bitquery's analysis, most of the stolen money was on TRON, at around $70.5 million, with another $16.8 million in Bitcoin and $3.7 million in Ethereum, plus much smaller amounts on BNB Chain, Polygon and Solana.

The operation is claimed to have been planned for months: the addresses involved in the theft were created on September 25 and made dozens of trial transfers until early October. The major movement took place on October 9, when Bitquery says the attackers rewrote the permissions on 30 TRON wallets before transferring roughly 203.8 BTC from 111 Bitcoin wallets within a single block an hour later. Such an operation can only be carried out if the attacker possesses the necessary keys.

That matters because stablecoin issuers are able to blacklist tokens used for illegal activity. Bitquery, which verified the Tether freeze, reported that about $81 million in traceable tokens remained on-chain as of October 11, though some funds have already passed through the mixing services Tornado Cash and Zcash. Tornado Cash pools transactions together to obscure their trail, while Zcash offers shielded transfers designed to hide the sender, recipient and amount — which is why how much of the traceable remainder ends up frozen, and whether any of the mixed funds can still be followed, is the natural next question in the case.

Pushback over an authorized reseller

Ledger's characterization of the situation as a CryptoBilis issue has not gone unchallenged. The reseller displayed an official Ledger badge on its website, which critics say makes Ledger responsible for the situation. "It's not a CryptoBilis incident, it's a Ledger incident," said X user MyCryptoParadise, who told the company to "take ownership of this mess." The dispute touches on a structural feature of the hardware wallet business: manufacturers rely on resellers to widen distribution, but every added intermediary is a link in the chain that the maker does not directly control.

There is also a backstory to the reseller's ownership. According to co-founder Arravind Prabu, CryptoBilis was acquired in March 2026, and the entire team transferred all system access during the acquisition, as quoted in Learning Crypto. The company's reported records show the only new investor was registered in China. So far, no link has been established between the thefts and the ownership change, and the investigation found no tampering tied to the new investors.

CryptoBilis has suspended sales and deliveries of all brands it sells and has shut down its brick-and-mortar stores in all three countries.

The implant Mark Karpelès pulled apart

Perhaps the most definitive look at the tampered hardware comes from Mt. Gox founder Mark Karpelès. Karpelès disassembled a Ledger Nano X purchased in Malaysia and, as reported by Learning Crypto, discovered additional components hidden under the screen: a cellular modem, an eSIM and a tiny chip that could intercept what is displayed on the screen.

When a wallet is set up, the recovery words are displayed on that screen. A component capable of intercepting the display data could transmit those words over the mobile network, allowing the wallet to be recreated elsewhere and its funds stolen. An implant of this kind is an example of a supply-chain attack, in which a device is altered somewhere between manufacture and delivery rather than compromised remotely — and because the parts sat beneath the screen of a unit that worked normally, they would have been hard for an ordinary buyer to spot. It has yet to be proven whether all of the devices contained such components, and whether further implanted units will surface remains an open question in the investigation.

It should be noted that this case is distinct from a separate theft reported in March, which occurred in April, when phishers used the Ledger Live application on Apple's App Store to steal at least $9.5 million.