Ledger theft-linked funds shift from USDT to USDD to dodge Tether freezes
The shift from USDT to USDD underscores vulnerabilities in stablecoin freeze mechanisms, prompting scrutiny on regulatory and security measures.
This article may contain affiliate links. Commercial relationships are disclosed in the affiliate policy.
A wallet tied to a wave of thefts from Ledger hardware wallet users converted millions of USDT into USDD, apparently to move the money beyond Tether’s ability to freeze it. On-chain investigators estimate roughly $86 million to $93 million was drained from more than 300 wallets, and the asset-by-asset routing afterward is what makes the case a study in freeze-capable stablecoin design rather than a simple theft story.
How the money moved
Investigators traced the stolen funds on October 9, 2026 across several blockchains, including Ethereum, Tron, and Bitcoin. Specter and MistTrack were among the on-chain sleuths following the trail.
Tether moved first. The stablecoin issuer blacklisted more than 20 addresses linked to the stolen assets and froze around $10 million in USDT. The suspected perpetrator adjusted quickly: using SUN.io, they swapped roughly 14.7 million USDT into roughly 14.6 million USDD on October 9. The swap gave up a little value, but USDD sits outside Tether’s freeze controls.
The Ethereum side took a different route. About 430 ETH, valued at roughly $1.07 million, was reportedly run through Tornado Cash, and some of those funds reportedly ended up in Binance hot wallets.
What the suspect still holds
The tagged wallets are estimated to still hold about $70.6 million in crypto:
- ETH: roughly 11,406 ETH, worth about $28 million
- BTC: 213 BTC, worth about $17.6 million
- USDD: 13.65 million USDD, worth about $13.65 million
- USDT: 10.91 million USDT, part of which is frozen
That residual balance is the reason the freeze response matters: roughly $13.65 million sits in an asset the issuer who blacklisted the addresses cannot reach, while about $10 million was recovered through the blacklist itself.
The Ledger connection
The thefts have been linked to Ledger hardware wallets bought through CryptoBilis, a reseller based in Southeast Asia operating in Indonesia, Malaysia, and the Philippines. Ledger has opened an investigation into a potential supply-chain compromise and has suspended all sales through CryptoBilis. Ledger told customers who bought wallets recently to move their funds into new wallets with fresh seed phrases.
Why this looks targeted
Draining more than 300 wallets, then sorting assets by freeze risk and moving each type through a different channel, points to planning. Tether froze USDT, so the attacker converted remaining USDT into an asset Tether cannot touch. ETH went through a mixer. The research describes the operation as sophisticated and targeted rather than random.
The stablecoin design gap
The USDT-to-USDD swap highlights a real gap in stablecoin freeze powers: Tether’s blacklist only covers USDT. In this case the freezes caught around $10 million while about $14.6 million in USDD slipped out of reach. This is not the first instance of the pattern — in September 2026, a sanctioned marketplace moved to USDD after Tether froze over $45 million in linked USDT.
Funds reportedly reaching centralized-exchange hot wallets puts platforms in a position to act if they can identify and hold the deposits.
Evidence boundary
Loss estimates, wallet balance figures, and the attribution of the thefts to a specific reseller come from on-chain investigators cited by the reporting, not from issuer or law-enforcement confirmation. The figure of roughly $14.6 million converted into USDD and the $10 million frozen are both estimates at time of writing, and balances move.
What to verify
Corroborate the loss range and the frozen amount against a second on-chain research source, and confirm the current USDT freeze addresses against Tether’s own public list rather than relying on a single outlet’s tally.
Sources and editorial check time
-
Crypto Briefing: https://cryptobriefing.com/ledger-theft-funds-usdt-usdd-freeze/
-
The Defiant: https://thedefiant.io/news/hacks/ledger-theft-funds-shift-into-usdd-beyond-tether-s-freeze-controls
-
Editorial source check time: 2026-10-10T02:31:07.625Z
This information is educational and is not financial, legal, or tax advice.