Ledger hack scare nears $90 million as Tether moves to freeze stolen USDT

Suspected Ledger wallet thefts are approaching $90 million as Tether freezes USDT stablecoin linked to the incident, according to blockchain investigators.

In an Oct. 9 statement, the crypto hardware wallet maker said it was investigating reports that customers lost funds after buying devices from CryptoBilis, an authorized reseller operating in Southeast Asia.

As a precaution, the company asked the distributor to immediately pause sales and shipments of its hardware wallets while the investigation continues.

Ledger also advised customers who purchased devices from CryptoBilis in the past 90 days not to initialize them if they had not yet completed setup.

Those who had already configured their wallets were urged to consider transferring their cryptocurrency to a new Ledger device initialized with a fresh recovery phrase.

CryptoBilis is a recognized Ledger reseller

CryptoBilis appears in Ledger's official reseller directory for Malaysia, Indonesia, and the Philippines. Customers buying through authorized distribution channels generally rely on those relationships to reduce the risk of receiving counterfeit or compromised hardware.

The incident has drawn attention from Binance founder Changpeng Zhao, who warned users to exercise caution, particularly if they had recently purchased a Ledger device.

He wrote on X:

“Based on information so far, it seems to be localized to a supply chain attack with one vendor.”

He suggested that a limited number of customers may have received counterfeit or tampered devices, while emphasizing Ledger's longstanding security reputation.

Zhao also called for cooperation across the cryptocurrency industry to identify the suspected attackers and recover the stolen assets.

He added:

“I expect and know all BNB ecosystem players (and all industry) to help trace and recover the funds.”

Meanwhile, former Mt. Gox CEO Mark Karpelès is investigating whether malicious hardware components were inserted into devices distributed to customers.

Karpelès asked CryptoBilis to open some of its unsold Ledger wallets so their internal circuit boards could be inspected for possible spying implants or other unauthorized modifications.

The concern draws attention to a limitation in Ledger's hardware authentication process.

The company's security documentation acknowledges that its Genuine Check system verifies a device's Secure Element but cannot necessarily identify physical modifications elsewhere in the hardware if the original security chip remains intact.

That means a physically altered device could pass authentication even if it contains unauthorized components.

No confirmed evidence shows that malicious hardware implants caused the reported thefts. Ledger has not disclosed how many devices may have been compromised or established whether the incident resulted from counterfeit hardware, physical tampering, or another attack method.

Tether freezes funds as investigators race to contain losses

While Ledger examines the suspected source of the compromises, blockchain investigators are attempting to trace and restrict the movement of stolen cryptocurrency.

On-chain investigator Specter said transaction analysis identified inflows from hundreds of suspected victim wallets into addresses across Bitcoin, Ethereum, and Tron.

The researcher initially estimated the suspected thefts exceeded $86 million, but blockchain security firm MistTrack later placed the reported losses closer to $90 million.

Those estimates have not been independently verified, and investigators have not established whether every wallet included in the calculations was compromised through the same operation.

MistTrack said it observed Tether freezing USDT linked to the incident and that several affected users contacted its team for help.

The freezing activity offers a potential recovery avenue because USDT includes administrative controls that let Tether restrict transfers from designated addresses.

Once an address is frozen, users cannot move the affected USDT through ordinary blockchain transactions unless the restriction is removed.

That capability can help prevent stolen funds from moving to additional wallets or converting into other cryptocurrencies while investigators work to establish ownership.

However, the intervention has limitations.

The suspected thefts span several blockchain networks and involve assets beyond USDT. Tether cannot directly freeze native Bitcoin or Ethereum, leaving investigators dependent on cooperation from exchanges, custodians, and law enforcement if those assets move into identifiable services.

Additionally, freezing USDT does not automatically return the tokens to their original owners. Any restitution would require further verification and coordination with the relevant authorities or counterparties.

MistTrack has not disclosed the dollar value of the restricted tokens, making it impossible to determine what proportion of the nearly $90 million in reported losses could ultimately be recovered.

That uncertainty puts additional pressure on investigators to identify where the remaining funds went before they are dispersed through further transactions.