Tether Freezes $10M in USDT Linked to CryptoBilis Ledger Drain

Tether blacklisted addresses tied to the theft from wallets on Ledger devices sold by CryptoBilis, leaving $10 million in USDT stuck in 20 wallets, according to on-chain tracing by Bitquery. The figure comes from Bitquery's reading of the chain, not from a statement by Tether.

For victims, a frozen coin is not a returned coin. Bitquery puts the limit plainly:

"A block stops the coins moving. It does not send them back to victims, though Tether can later destroy blocked coins and reissue them."

So the $10 million is out of the thief's hands, but nothing has gone back to the people who lost it. Ledger has offered no repayment plan to affected buyers.

Tether Blocked 37 Addresses in Two Hours

The drains began on TRON on 9 October. Within 47 minutes the same thief had emptied wallets on Ethereum, BNB Chain, Polygon, Solana and Bitcoin, Bitquery's timeline shows.

Tether moved quickly once the theft became public. Bitquery says it started blocking linked addresses about ten minutes after the first public post, and blacklisted 37 of them between 12:09 and 14:10 UTC. Twenty of those still held half a million USDT each, which is where the $10 million figure comes from.

One reversal followed. At 15:30 UTC Tether lifted the block on four wallets that Bitquery identifies as THORChain's TRON vaults, the pools the cross-chain swap protocol uses to hold funds.

Most of the Money Moved Out of Tether's Reach

The freeze caught a fraction of the haul. Tether can only block USDT, and the thief moved fast to get out of it. Bitquery traced two exits:

• 20 million USDT crossed to Ethereum through the USDT0 bridge
• 23.7 million was swapped into USDD, a different stablecoin that Tether cannot freeze, and most of that was later swapped into ETH through THORChain

From there the trail runs into mixers. Over four days the thief put about 6,680 ETH into Tornado Cash and sent most of what came out on through Zcash, Bitquery says.

One pocket is still exposed. Two wallets Bitquery describes as likely the thief's hold 2.38 million USDC, which Circle, the stablecoin's issuer, has the power to freeze. Bitquery did not report any Circle action.

One Implant Confirmed, $102 Million Counted

The early reported loss figure of $93.2 million is already out of date. On 12 October Bitquery raised its count to $102.0 million taken from 324 wallets across TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon, after finding an 8.8 million USDT drain it had missed. It says about $82 million could still be found on-chain that day.

Ledger has not confirmed any total. What it has confirmed is narrower. On 10 October it said one victim's device "contained an unauthorized hardware implant", which Bitquery calls the first confirmed cause, covering one device so far. Our earlier report covers the implant Ledger found in a CryptoBilis device.

Whether the other drained wallets were compromised the same way is not confirmed. CryptoBilis is Ledger's reseller in Indonesia, Malaysia and the Philippines. Ledger asked it to stop all sales and told recent buyers not to set up their devices.

The open questions for holders are the same ones they were on 9 October: how many devices carried an implant, and whether anyone will make victims whole. The $10 million Tether holds is the only part of the money that a single company can still give back.