A stablecoin freeze is a race. The issuer can stop tokens it controls, but only while they are still its tokens. In the CryptoBilis Ledger case, the thieves understood that rule better than most victims: before Tether moved, roughly 14.7 million USDT had already been turned into USDD on Tron — a dollar token Tether does not issue and cannot blacklist.
By Monday, October 12, 2026, the picture was clearer. Tether had blacklisted more than 20 addresses and locked about $10 million in USDT. Tens of millions more sat in ETH, BTC and USDD that no single company can freeze.
Key facts
- Tether blacklisted more than 20 addresses and froze about $10 million in USDT linked to thefts from buyers of Ledger devices sold by reseller CryptoBilis, according to Crypto Briefing.
- On October 9, 2026, about 14.7 million USDT were swapped into roughly 14.6 million USDD via SUN.io on Tron before the freeze.
- Loss estimates range from about $86 million to $93 million across more than 300 wallets; MistTrack put the figure near $90 million.
- Flagged wallets still held about $70.6 million, including about 11,406 ETH, 213 BTC, 13.65 million USDD and 10.91 million USDT.
- About 430 ETH (roughly $1.07 million) were routed through Tornado Cash.
- Ledger has not confirmed a total loss figure or how many devices are affected.
What did Tether freeze in the Ledger theft case?
Tether added more than 20 addresses linked to the CryptoBilis thefts to its USDT blacklist and locked roughly $10 million. Frozen tokens stay on those addresses but can no longer be transferred. The freeze covers only USDT — not the ETH, BTC or USDD that the same wallets also control.
According to Crypto Briefing, the flagged wallets still held about $70.6 million after the freeze. That includes roughly 11,406 ETH (about $28 million), 213 BTC (about $17.6 million), 13.65 million USDD and 10.91 million USDT, part of which is now frozen.
The USDD detour
On October 9, the same day Ledger first acknowledged the reports, about 14.7 million USDT were swapped into about 14.6 million USDD through SUN.io. The roughly $100,000 gap is simply what the swap cost. USDD runs on Tron and is not a Tether product, so Tether’s blacklist cannot touch it.
A freeze button only works on the issuer’s own token.
How big are the CryptoBilis Ledger losses?
Estimates cluster around $90 million. On-chain investigator Specter first put suspected thefts above $86 million; security firm MistTrack later estimated losses closer to $90 million, as reported by CryptoSlate. Crypto Briefing gives a range of about $86–93 million drawn from more than 300 wallets.
Ledger has not confirmed a damage figure or how many devices may be affected. The company said on October 9 it was following up reports that customers lost funds after buying from CryptoBilis, an authorised reseller listed for Malaysia, Indonesia and the Philippines, and asked the reseller to halt sales and shipping. We covered the first reports in our October 9 piece on the CryptoBilis drain.
Ledger is investigating a possible supply-chain attack — a device altered before it reached the buyer. Binance founder Changpeng Zhao said that, based on information so far, it seemed “localized to a supply chain attack with one vendor.”
What should Ledger buyers do now?
If you bought a Ledger from CryptoBilis in the past 90 days, don’t set up an unused device. If you already use one, move your funds to a new device bought directly from the manufacturer and generated with a fresh recovery phrase. That is Ledger’s own advice, and it applies regardless of whether your wallet has been touched yet.
- Buy hardware wallets only from the manufacturer or a channel you can verify.
- Never use a device that arrives with a pre-printed or pre-filled recovery phrase.
- Treat the seed as the asset: if there is any doubt about where it came from, rotate it.
Our guide to cold storage options in 2026 covers how to set up a fresh seed safely.
What the freeze tells stablecoin holders
The episode works in both directions. For victims, Tether’s freeze is the only part of the loot anyone could stop quickly. For everyone else, it is a reminder that USDT is a permissioned token: the issuer can lock an address with no fixed deadline and no standard appeal process — as payments firm Conduit argues in its lawsuit over frozen USDT.
That does not make one stablecoin “good” and another “bad”. It means you should know which risks you are holding: issuer freeze risk on USDT and USDC, different design and backing risks on alternatives such as USDD.
What this means for swap users
When you swap through SwapZilla, coins go from your wallet to the provider and straight to the address you choose — SwapZilla never holds them. That model has one hard rule: the destination address and the wallet behind it must be yours and must be clean. A compromised hardware wallet turns any swap into a gift to the attacker.
If you rotate to a new seed, generate the new receiving address first, verify it on the device screen, and only then start the swap. You can compare routes for USDT on Tron, Ethereum or Solana on the how it works page, and our USDT network guide explains what changes between them.
Final thoughts
Roughly $10 million frozen out of about $90 million stolen is a typical ratio. Issuer freezes catch what moves slowly; everything that was swapped, bridged or held in native coins keeps moving. The real defence happened — or failed — weeks earlier, when a device was bought from the wrong shelf.