Blockchain tracker MistTrack reported on Oct. 9 that Tether has frozen USDT held at addresses linked to a wave of wallet-draining thefts from Ledger users, with losses approaching $90 million.
The freeze is the first concrete recovery lever in a case that surfaced on the same day, when on-chain analyst Specter estimated more than $86 million had been taken from hundreds of victim wallets across Ethereum, TRON and Bitcoin. Both figures are single-tracker estimates from a fast-moving investigation, not audited totals, and the gap between them reflects hours, not methodology.
For victims, that centralized control is the good news. USDT moved into the suspect addresses can be frozen by Tether at the address level, which means some portion of the near-$90 million may be recoverable rather than simply gone. MistTrack said affected users have contacted its team for assistance and it is actively following up on their cases.
The same property is also the uncomfortable part of the story. A token that one company can freeze at will is a token whose custody is never fully the holder’s, and the incident puts that trade-off on display from both directions in a single day. Tether has issued no statement; the freeze is known only through MistTrack’s on-chain observation, and the dollar value of the frozen USDT has not been disclosed, so the recoverable share of the losses is unknown.
The limits of the freeze are structural. Tether cannot freeze native Bitcoin or Ethereum sitting in those addresses, so any BTC and ETH taken in the same operation stays movable unless exchanges, custodians or law enforcement intervene further down the chain. Whatever portion of the theft was held in USDT is potentially recoverable; whatever was not depends on cooperation nobody can compel unilaterally.
Ledger confirmed on Oct. 9 that it is investigating customer losses tied to purchases from CryptoBilis, an authorized reseller listed in its directory for Malaysia, Indonesia and the Philippines, and said it has asked the reseller to pause all sales and shipments of Ledger devices while the investigation runs. It advised buyers from CryptoBilis in the last 90 days not to initialize unopened devices, and told users who already set up a wallet to move assets to a new device with a fresh recovery phrase.
How the wallets were drained remains unconfirmed. Binance founder Changpeng ‘CZ’ Zhao said the incident appears localized to a supply chain attack involving one vendor, and the thefts continue to be tracked as of Oct. 9.
