Tether freezes $10 million tied to CryptoBilis wallet theft

Tether froze $10 million in USDT linked to the CryptoBilis wallet theft, blocking the tokens across 20 wallets as investigators traced funds taken from Ledger users. Blockchain analytics firm Bitquery said it counted $102 million stolen from 335 wallets across six chains as of Oct. 16, a higher tally than the earlier $93 million estimate.

Bitquery’s on-chain investigation said Tether blocked 37 addresses tied to the theft, with $10 million in USDT held across 20 of them. Tether’s freeze prevents transfers from those addresses, but does not itself return the tokens to victims.

How were the CryptoBilis wallets drained?

Ledger said an affected user’s device contained an unauthorized hardware implant, and later explained that the implant copied recovery words during setup. Ledger said all confirmed cases involved devices sold through CryptoBilis, a Southeast Asian reseller.

Bitquery’s tracing found that dozens of wallets signed the same request within seconds and said one actor appeared to hold the keys to the drained wallets. Its investigation tracks transfers across TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon; the chain data alone cannot establish how every wallet’s keys were obtained.

How much of the stolen crypto remains frozen?

The frozen $10 million is one part of the larger theft. Bitquery said the attacker moved funds through services including THORChain and Tornado Cash, and had swapped $23.9 million in USDD into ether; USDD cannot be frozen by Tether.

CoinDesk reported the freeze on Oct. 12, citing investigators’ tracing and Ledger’s statements about affected devices. Ledger did not confirm a total loss figure in that report. Bitquery’s later count reflects additional wallets and transfers it identified, so the $93 million figure in early reports is not the latest estimate.

Sources

• on-chain investigation — bitquery.io
• reported the freeze on Oct. 12 — coindesk.com