Tether Freezes $10 Million Worth of USDT Related to $93 Million CryptoBilis Ledger Theft

Tether Freezes USDT Related to CryptoBilis Ledger Theft

In response to a large-scale theft of cryptocurrency involving the hardware wallet Ledger, Tether has swiftly frozen $10 million worth of USDT (by blacklisting 37 related addresses, including funds from 20 addresses) related to the stolen funds.

This action has successfully disrupted the flow of illicit funds on major blockchains to some extent.

Estimated Damage Exceeding $100 Million and On-Chain Analysis of the Method

Estimates of the scale of the damage vary slightly among analysis firms, but all indicate a significant impact.

According to an initial report by blockchain analysis firm Bitquery, approximately $93.2 million was illicitly drained from 315 wallets across six chains. Most of the stolen funds were from the TRON network (approximately $70.5 million), followed by Bitcoin (approximately $16.8 million) and Ethereum (approximately $3.7 million).

Additionally, another security platform, YFarmX, revised its figures based on the latest data, stating that assets totaling $103.4 million were stolen from 530 addresses across seven chains.

Analysis of on-chain data reveals that the crime was meticulously planned months in advance. Attack addresses were created in late September 2026, and experimental transfers were repeatedly conducted in early October. On October 9, the attackers altered the permission settings of a TRON wallet and swiftly moved approximately 203.8 BTC from 111 Bitcoin wallets within a single block.

Such operations indicate that the attackers had complete control over the private keys necessary for wallet recovery.

The Full Picture of Ingenious Physical Tampering Implants

Why did the private keys leak externally? The clue lies in the "physical tampering" of the device itself.

All wallets affected by this incident were sold through the third-party authorized dealer CryptoBilis, which operates in Malaysia, Indonesia, and the Philippines. Mark Karpelès, the founder of Mt. Gox, disassembled and inspected the problematic Ledger Nano X and discovered that a cellular modem, eSIM, and a microchip for intercepting screen displays were hidden behind the display.

When users perform the initial setup, a recovery phrase is displayed on the screen. This tampering component, or implant, sent the displayed phrase to the attacker's server via mobile phone lines, enabling remote recovery and theft of the wallet.

Acquisition Drama of Authorized Dealers and Discussions on Responsibility

CryptoBilis, at the center of the incident, was acquired by a China-based company in March 2026, and the former management transferred access rights to the entire system. At this point, a direct causal relationship between the acquisition and the incident has not been established, but the company has closed all physical stores and completely halted product delivery and sales.

On the other hand, criticism of Ledger's response is intensifying. The company explains that there was no breach of its own systems or direct sales channels, attributing the issue to problems specific to the dealer. However, since the official badge was displayed on CryptoBilis's site, users are voicing that it is Ledger's responsibility for not monitoring its official dealers.

Ledger has strongly urged users who purchased devices from this dealer within the last 90 days to refrain from using unconfigured devices and to immediately generate new phrases for devices in use to transfer assets to a separate environment. Although some tracking and freezing have progressed due to the blacklist function of issuers like Tether, part of the funds has been obfuscated through mixer services like Tornado Cash, and investigations into the complete resolution of the incident are ongoing.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.