Tether freezes $10 million tied to CryptoBilis wallet drains

Tether froze $10 million in USDT linked to crypto wallet drains involving devices sold by Ledger reseller CryptoBilis, blocking some of the stolen funds from moving. The freeze followed drains reported on Oct. 9, 2026. CoinDesk reported that Ledger found an unauthorized hardware implant in at least one affected device.

How much was stolen, and how much did Tether freeze?

Blockchain data firm Bitquery’s later count puts the theft at $102 million across 335 wallets on six networks. That is higher than the roughly $93 million estimate reported earlier; Ledger has not published its own loss total. Bitquery’s investigation says Tether froze $10 million in USDT across 20 wallets.

Bitquery says Tether blocked 37 addresses linked to the theft. The remaining 17 did not hold the $10 million included in its frozen total. A block prevents the USDT in an address from being sent. It does not return the tokens to victims.

How were the devices and wallets linked?

Ledger said all confirmed cases it had identified involved devices sold through CryptoBilis, a Southeast Asian reseller. The drains began on Oct. 9. Ledger said its own systems and direct sales channels were not affected, according to CoinDesk.

Bitquery traced stolen funds across TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. It found that most of the early losses were USDT on TRON. The firm also tracked some stolen USDT being exchanged for other assets or routed through services that move tokens between networks.

Ledger’s finding of an implant in one device points to physical tampering, but it does not establish how every affected wallet was compromised. The company advised CryptoBilis customers not to set up unused devices and to move assets from devices they had already used to a new device with a newly generated recovery phrase, CoinDesk reported.

Does the freeze mean victims will get their money back?

No. The $10 million remains frozen, but the block itself is not a repayment. Bitquery said the attacker moved other funds through several services and that about $81 million could still be found on-chain as of Oct. 16. That is an estimate of traceable funds, not a confirmed recovery. The investigation and the effort to follow the remaining assets are ongoing.

References

• CoinDesk reported — coindesk.com
• Bitquery’s investigation — bitquery.io