Independent RWA research desk · Status: operationalMethodology & corrections · Submit a story
RRWA Crypto WatchNEWS · DATA · PROJECT RESEARCHGet the weekly briefing
RWA Watch · Fact checked

Ledger incident losses near $90 million as Tether freezes linked USDT, MistTrack says

The freeze highlights the need for robust supply chain security and raises concerns about the limitations of centralized control in crypto.

By RWA Crypto Watch Editorial Team · Published Oct 9, 2026, 3:29 PM UTC · Updated 2026-10-09 · Risk level: medium
Sources checked: Oct 9, 2026, 5:01 PM UTC

This article may contain affiliate links. Commercial relationships are disclosed in the affiliate policy.

What happened

Blockchain tracker MistTrack puts reported losses from the Ledger security incident near $90 million, and says Tether has frozen USDT held at addresses linked to the case. The figure moved from more than $86 million, cited earlier on October 9 by on-chain analyst Specter, as tracking continued. Ledger says it is investigating and has asked reseller CryptoBilis to suspend all sales and shipments of Ledger devices during the investigation. Affected customers reportedly bought the devices through CryptoBilis in Southeast Asia.

Reported details

  • MistTrack puts reported losses near $90 million as Ledger asks reseller CryptoBilis to halt device sales and shipments.
  • Specter said they traced the addresses receiving the stolen funds and identified inflows from hundreds of victim wallets across several major blockchains, including Ethereum, TRON and Bitcoin.
  • Mark Karpeles, the former CEO of Mt. Gox, said the incident looked potentially connected to an issue he was already investigating, and asked affected users to send photographs of their Ledger circuit boards. He had previously warned about devices containing a surveillance implant with a SIM card. The connection remains unconfirmed.
  • Changpeng Zhao said the losses may be linked to a supply chain attack involving a single vendor, and that a small number of buyers may have received counterfeit or tampered devices.

Why this matters

This is a hardware-security story rather than a software one, and that changes who carries the risk. If the compromise sits in a physical device or its supply chain, no amount of on-chain hygiene protects a holder whose signing machine was never trustworthy to begin with. The counterparty named in the reports is a reseller, not Ledger’s own manufacturing line, which is exactly why halting one distributor’s shipments is the proportionate first response. The open question is whether the same hardware reached buyers through other channels; neither linked report establishes that.

Evidence boundary

The scope is limited to what the linked reports state, and where two of them diverge both positions are recorded without either being picked in advance. The $90 million figure is MistTrack’s running estimate and was still moving upward during the day; Karpeles’s board-tampering theory is his own and is explicitly unconfirmed.

What to verify

Look for a Ledger statement naming the reseller relationship and whether other distributors were involved. If a hardware teardown or attestation of the affected batch appears, that is the evidence that would settle the implant question.

Sources and editorial check time

This information is educational and is not financial, legal, or tax advice.

Sources