After the wallet thefts among customers of a Ledger reseller, the stablecoin issuer Tether responded and froze USDT addresses. The freeze only works in part: some of the loot was swapped into
After the wallet thefts among customers of a Ledger reseller, the stablecoin issuer Tether responded and froze USDT addresses. The freeze only works in part: some of the loot was swapped into the stablecoin USDD, and Tether's reach does not extend there. The episode shows briefly what a freeze function achieves in stablecoins and where it ends. For your own balance this is no side issue, because the question of who can stop your token in an emergency also decides who can stop it when you are the one affected.
A stablecoin is a token whose price is pegged to a currency, usually the US dollar. It is issued by a company that manages the backing and sets the rules of the token. That is precisely where the freeze option at issue here comes from.
Following the thefts, Tether placed more than 20 addresses on a blacklist and locked up around $10 million in USDT in the process. Crypto Briefing reports this with reference to the movements of the affected wallets. The funds stay on the addresses but can no longer be transferred.
Technically a blacklist function sits behind this. The function is written into the token's program code and allows the issuer to exclude individual addresses from transfers. How far Tether reserves this right for itself, and which contractual clause it rests on, we took apart in a separate article on Tether's freeze clause. The core point: the decision rests with the issuer, not with a court and not with the holder.
The blocked sum is small measured against the total damage. The episode does show, however, that a centrally issued stablecoin works differently from a coin without an issuer. With Bitcoin there is no body that could shut down an address. With USDT there is one.
On October 9, according to Crypto Briefing, roughly 14.7 million USDT were swapped into about 14.6 million USDD through the exchange platform SUN.io. USDD is a stablecoin of its own that runs on the Tron network and is not issued by Tether. The difference between the two sums is the discount such a swap costs.
With the change of token, Tether's reach ends. A blacklist only ever works inside the token for which it is kept. As soon as a balance passes into another token with another issuer, the old list is meaningless, even if the address stays the same. The same report names an additional smaller movement of 2 million USDT for the same wallets, traced separately.
Here lies the lesson of the case, and it holds regardless of how the investigation turns out. A freeze is not a net over the whole market but a valve in a single line. Leave the line and you leave the valve behind. That does not make freeze functions worthless, because their effect arrives fast and without a court. It does make them a tool with sharply limited reach.
For a holder the same property turns around. A token whose issuer can freeze stolen goods can in principle freeze your balance too. A token without the function protects you in one case and leaves you alone in the other. Which stablecoins exist and how they differ in backing and control is set out in our overview of stablecoins.
On the total damage the estimates diverge, and that belongs to the picture. The on-chain investigator Specter initially put the suspected thefts at more than $86 million. The security firm MistTrack later arrived at losses closer to $90 million. CryptoSlate reports both, while also recording that these estimates are not confirmed and that investigators have not proven for every wallet that it belongs to the same episode. Crypto Briefing names a range of about $86 million to $93 million from more than 300 wallets.
The range stands here as a range on purpose. Pulling it together into a round number asserts a precision that does not exist. Ledger itself has, according to CryptoSlate, confirmed no damage figure and has not said how many devices could be affected at all. We described the core case as it stood on October 9 in our article on the theft among Ledger buyers.
The larger part of the loot has not disappeared but is visible. According to Crypto Briefing's tally, the flagged wallets still hold around $70.6 million. The largest item is 11,406 Ether worth about $28 million, plus 213 Bitcoin for roughly $17.6 million. Also listed are 13.65 million USDD and 10.91 million USDT, part of which is frozen.
That every one of these movements is publicly traceable easily leads to a misunderstanding. Open bookkeeping does not mean recoverability. An address can be flagged, watched and coloured red in every analysis tool while the owner still disposes of it freely, as long as the token has no freeze function or the function is not used.
On October 9 Ledger said it was following up reports that customers had lost balances after buying devices from the reseller CryptoBilis. According to CryptoSlate's account, the company asked the reseller to halt sales and shipping. CryptoBilis is described there as an authorised reseller that was listed in Ledger's directory for Malaysia, Indonesia and the Philippines.
What is under investigation is the possibility of an attack through the supply chain. That means a device could have been altered before it reached the buyer. On the reported state of affairs this is not proven. CryptoSlate records explicitly that so far no confirmed evidence links built-in components to the thefts. Changpeng Zhao placed the situation as follows: “Based on information so far, it seems to be localized to a supply chain attack with one vendor.”
Customers who bought from this reseller in the past 90 days were advised specifically: a device not yet set up should not be put into operation. A device already set up should be emptied, by moving the balance to a new device with a fresh recovery phrase. The recovery phrase is the sequence of words from which all the keys of a wallet can be restored. Whoever knows it disposes of the balance, no matter where the device is.
Around 430 Ether worth about $1.07 million were routed through Tornado Cash, according to Crypto Briefing. A mixer of that kind throws the deposits of many users together and pays them out to new addresses, which breaks the trail between origin and destination. Compared with the $70.6 million still lying in the open, that is a small part.
The direction is recognisable all the same. Someone who gets around a blacklist by changing token, and someone who uses a mixer, are working on the same thing: they are looking for the stretch on which neither an issuer nor an observer can intervene. That stretch exists, and it is the reason recoveries stay partial successes in cases like this.
A freeze works only in the line that built it in. Change the line and you leave the valve behind.
That leaves the question of whether a German investor comes into contact with USDD at all. For this we counted the offering of a trading platform authorised in the European Union and went through all the assets listed there and all trading pairs: 856 assets and 1,460 pairs. USDD is listed there, but with only three trading pairs. USDT comes to 55 pairs, USDC to 54. DAI and RLUSD, issued by Ripple, stand at five each, PYUSD at three. cryptoticker.io compiled this analysis itself on October 12, 2026.
The result is clearer than it first sounds. USDD is reachable, but a fringe asset. The great mass of German investors' stablecoin balances sits in USDT and USDC, and both have an issuer with the option to freeze. Anyone choosing a platform by offering and authorisation will find the differences in our comparison of crypto exchanges.
The uncomfortable case is not that of the perpetrator but that of the uninvolved third party. Anyone who receives USDT from an address that later lands on a blacklist can be caught up in it without knowing. There is no deadline within which a freeze has to be lifted, and no appeal procedure in the usual sense either. What Tether's terms say about this, and how much latitude the company grants itself, is in our article on the freeze clause for USDT.
In practical terms: the shorter a large stablecoin balance sits in a place you do not control alone, the smaller the risk. A stablecoin is a means of parking money and paying with it. As a store for large sums over long periods it carries a risk that has nothing to do with price swings.
The second part of this case concerns not the stablecoin but the device. A hardware wallet protects the private key by generating it itself and never handing it out. That calculation only works if the key really does come into being at your end. If a device was altered before delivery or prepared with a sequence of words already known, a third party knows your keys from day one, and every precaution afterwards comes to nothing.
That is why the purchase route is a security question and not a price question. Undamaged packaging is a weak sign here, because films and seals can be reproduced. What is reliable is what the device itself does during setup: it has to generate a new sequence of words and ask you to confirm it. A device that arrives with a finished phrase, or has one enclosed, is unusable in every case. What else matters in the choice is set out in our comparison of hardware wallets.
A new recovery phrase on a new device is the only step that genuinely ends possible knowledge carried over from the supply chain.
The case supplies a rule that reaches beyond it. A freeze works inside a token and ends at its border. That makes USDT partly recoverable in a theft and your own balance attackable in principle. Three steps follow from that.
What the investigation at Ledger yields remains open, as does whether the route from reseller to device can be proven. Whether anything comes back from the $70.6 million in flagged wallets also remains open. The two sentences about how far a freeze function reaches, by contrast, are already settled.
(As of October 12, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
