Millions in Crypto Stolen from Ledger Users, Perpetrator Evades Freezes by Converting to USDD
A sophisticated operation targeting Ledger hardware wallet users has resulted in the theft of an estimated $86 million to $93 million from over 300 wallets. The perpetrators appear to have strategically converted a significant portion of the stolen Tether (USDT) stablecoins into Decentralized USD (USDD) to circumvent Tether’s ability to freeze the assets.
On-chain investigators, including Specter and MistTrack, traced the illicit funds across multiple blockchains, including Ethereum, Tron, and Bitcoin, on October 9, 2026.
Tether, the issuer of USDT, was quick to respond, blacklisting over 20 addresses associated with the stolen assets and freezing approximately $10 million in USDT. However, the suspected attacker adapted rapidly. On the same day, using the SUN.io platform, they swapped roughly 14.7 million USDT for approximately 14.6 million USDD. While this conversion incurred a slight value loss, it effectively moved the funds beyond Tether’s direct control, as USDD operates outside Tether’s freeze mechanisms.
The Ethereum portion of the stolen assets followed a different path. Around 430 ETH, valued at approximately $1.07 million, was reportedly laundered through Tornado Cash, a privacy-enhancing mixer. Some of these funds were subsequently traced to hot wallets belonging to the cryptocurrency exchange Binance.
Remaining Stolen Assets Valued at Over $70 Million
Despite the successful evasion of freezes for a substantial portion of the funds, the wallets linked to the thefts are estimated to still hold approximately $70.6 million in various cryptocurrencies. The breakdown of these remaining assets includes:
- Ethereum (ETH): Roughly 11,406 ETH, valued at about $28 million.
- Bitcoin (BTC): 213 BTC, worth approximately $17.6 million.
- Decentralized USD (USDD): 13.65 million USDD, valued at about $13.65 million.
- Tether (USDT): 10.91 million USDT, a portion of which has been frozen by Tether.
Ledger Investigates Potential Supply-Chain Compromise
The wave of thefts has been linked to Ledger hardware wallets purchased through CryptoBilis, a reseller operating in Southeast Asia, specifically in Indonesia, Malaysia, and the Philippines.
In response, Ledger has launched an investigation into a potential supply-chain compromise and has suspended all sales through CryptoBilis. The company has advised customers who recently purchased wallets from the reseller to transfer their funds to new wallets with freshly generated seed phrases as a precautionary measure.
Sophisticated Operation Highlights Stablecoin Freeze Limitations
Investigators described the operation as highly planned and targeted, rather than random. The coordinated draining of over 300 wallets, followed by the strategic segregation of assets based on their susceptibility to freezes, underscores the attackers’ meticulous approach. The conversion of USDT to USDD after Tether’s intervention highlights a significant vulnerability in stablecoin freeze capabilities. Tether’s blacklisting mechanism is limited to USDT, allowing other stablecoins like USDD to bypass such controls.
This incident is not the first time Tether’s blacklisting has prompted illicit actors to shift funds to USDD. In September 2026, a sanctioned marketplace reportedly moved its assets to USDD after Tether froze over $45 million in linked USDT.
The reported movement of some stolen funds into Binance hot wallets places centralized exchanges in a position to potentially identify and hold these deposits, provided they can be accurately traced and linked to the illicit activity.
