Ledger hack scare nears $90 million as Tether moves to freeze stolen USDT

Blockchain analysts report that suspected thefts tied to Ledger wallets are nearing $90 million as Tether intervenes to freeze USDT stablecoins connected to the security breach.

In an announcement made on Oct. 9, the hardware wallet manufacturer stated that it was looking into reports of missing customer funds following purchases made through CryptoBilis, an authorized Southeast Asian reseller.

As a precautionary measure, the hardware maker requested that the distributor halt all sales and shipments of its devices while the inquiry remains ongoing.

Furthermore, Ledger recommended that buyers who acquired devices from CryptoBilis within the last 90 days refrain from setting them up if they had not yet started the initialization process.

Individuals who had already set up their wallets were strongly advised to transfer their crypto holdings to a newly purchased Ledger device configured with a fresh recovery phrase.

CryptoBilis is a recognized Ledger reseller

CryptoBilis is listed in Ledger’s official directory of authorized distributors for Malaysia, Indonesia, and the Philippines. Consumers typically purchase through official channels to minimize the danger of obtaining altered or counterfeit hardware.

Binance founder Changpeng Zhao has taken notice of the situation, urging consumers to remain vigilant, particularly those who recently acquired a Ledger product.

Writing on X, he stated:

“Based on information so far, it seems to be localized to a supply chain attack with one vendor.”

He noted that a limited group of buyers might have received tampered or counterfeit hardware, while reaffirming Ledger’s strong historical security track record.

Zhao also appealed for broader cooperation throughout the digital asset sector to track down the alleged perpetrators and retrieve the missing funds.

He added:

“I expect and know all BNB ecosystem players (and all industry) to help trace and recover the funds.”

At the same time, former Mt. Gox CEO Mark Karpelès is examining whether unauthorized hardware parts were integrated into units supplied to consumers.

Karpelès called on CryptoBilis to unbox several unsold Ledger units so their internal circuit boards could undergo examination for spying mechanisms or other unapproved alterations.

This concern highlights a specific constraint within Ledger’s device verification procedure.

The company’s security guidelines note that its Genuine Check utility validates the device’s Secure Element, but it cannot guarantee the detection of physical modifications elsewhere on the board if the core security chip stays intact.

Consequently, a physically altered unit could successfully pass authentication even if foreign components are present inside.

There is no confirmed proof that malicious hardware modifications caused the reported incidents. Ledger has not clarified how many units might be affected, nor has it confirmed whether the breach stemmed from counterfeit goods, physical interference, or a different attack vector.

Tether freezes funds as investigators race to contain losses

While Ledger evaluates the potential root cause of the compromises, on-chain analysts are working to trace and restrict the flow of stolen digital assets.

An on-chain researcher known as Specter reported that transaction tracking revealed incoming transfers from hundreds of potential victim wallets to various addresses across the Bitcoin, Ethereum, and Tron networks.

The analyst’s initial figures suggested losses surpassed $86 million, though blockchain security firm MistTrack later adjusted the estimated losses closer to $90 million.

Those figures have not received independent verification, and analysts have not yet confirmed whether every wallet counted in these totals fell victim to the exact same operation.

MistTrack reported witnessing Tether freeze USDT connected to the event, noting that multiple impacted individuals reached out to their team seeking assistance.

The freezing action presents a potential recovery path because USDT incorporates administrative features allowing Tether to block transactions originating from specific addresses.

Once an address is frozen, users cannot transfer the impacted USDT through standard blockchain operations unless the freeze is lifted.

This capability helps stop stolen capital from moving to other wallets or getting swapped for alternative cryptocurrencies while experts work to confirm rightful ownership.

Nevertheless, this intervention has certain boundaries.

The suspected thefts cross multiple blockchain networks and involve assets that go beyond USDT. Tether cannot directly freeze native Bitcoin or Ethereum, meaning analysts must rely on assistance from centralized exchanges, custodians, and law enforcement if those funds reach identifiable platforms.

Moreover, freezing USDT does not automatically send the tokens back to their original owners. Returning funds would necessitate additional validation and coordination alongside relevant legal authorities and counterparties.

MistTrack did not disclose the monetary value of the blocked tokens, making it impossible to calculate what fraction of the nearly $90 million in reported losses might eventually be retrieved.

This ambiguity places added urgency on security specialists to trace the whereabouts of the remaining assets before they get scattered through subsequent transactions.

Frequently Asked Questions

• What caused the suspected Ledger wallet thefts? Investigators are currently examining a potential supply chain attack linked to CryptoBilis, an authorized Ledger reseller in Southeast Asia.
• How much money was lost in the incident? Blockchain security firms estimate that reported losses are approaching $90 million across multiple cryptocurrencies.
• Can Tether recover all the stolen funds? Tether has frozen certain amounts of USDT, but it cannot freeze native assets like Bitcoin or Ethereum without external coordination and law enforcement assistance.