Tether Freezes Large Amounts of USDT Related to Ledger User Theft Incident
The blockchain tracking platform MistTrack reported that Tether is freezing large amounts of USDT in multiple addresses related to the theft incident involving Ledger users. The tracked losses are nearing $90 million. Some affected users have contacted the team, and the case is under follow-up. The post did not specify the exact number of frozen tokens, nor did it disclose the reasons, affected protocols, or the identity of the attackers.
The Defiant linked this freeze to the Ledger user theft. The effect of the freeze is that USDT in the related addresses cannot be transferred out, but this does not mean that the funds have been returned to the users. CryptoBriefing also noted that locking transfers does not automatically result in compensation. Tether's official announcement was not referenced in the MistTrack post.
The loss estimates were raised on the same day. tanuki42 previously estimated losses exceeding $72 million, while Specter later estimated over $86 million, covering Bitcoin, Ethereum, and Tron. MistTrack's nearly $90 million is the updated total tracked amount, not a separate USDT freeze amount. Earlier, Arkham had indicated that the related addresses contained about $16.5 million in Tether, with the rest in Ethereum and Bitcoin.
Ledger's support account has requested Southeast Asian distributor CryptoBilis to suspend sales and shipments. Users who purchased within the last 90 days and have not initialized their devices should not set them up; those who have set them up should consider changing their recovery phrases and transferring to new signing devices. The company has not confirmed the $90 million figure or any device tampering. Decrypt reported that tampering has not been verified.
Lookonchain recorded a single-user case: a user purchased a device from CryptoBilis three weeks ago, deposited $7 million in USDT, and it was transferred out about 10 hours ago. This transaction is listed as one of the potentially largest single losses in this incident, but the MistTrack post did not confirm it separately.
This is not a market transaction but a transfer restriction imposed by the stablecoin issuer on the receiving addresses. There is no buyer; what is restricted is the USDT that has already entered the related addresses. The event is driven by the tracking post and Ledger's suspension investigation. The beneficiaries are users who have not transferred USDT into already set devices or have migrated to new recovery phrases; the pressured parties are those with losses concentrated in Bitcoin and Ethereum addresses, as Tether can only freeze its issued USDT and cannot freeze Bitcoin and Ethereum that have already left.
The nearly $90 million is the tracked loss, while the large amount of USDT is the result of the freeze action. The two figures were not written as the same number by MistTrack.
Source: Public Information
ABAB AI Insight
Tether's freeze is an issuer's authority, not an on-chain consensus. In 2022, it froze USDT related to Tornado Cash in cooperation with law enforcement, and in 2023, it froze addresses related to a human trafficking investigation at the request of the U.S. Department of Justice. The stablecoin contract retains a blacklist function, allowing the issuer to mark addresses as unable to transfer out. On October 9, 2026, MistTrack stated that multiple addresses related to Ledger user theft are being frozen, with tracked losses nearing $90 million.
This $90 million is not the same type of asset. Specter's $86 million spans Bitcoin, Ethereum, and Tron, while Arkham previously identified about $42 million in Ethereum, $17.6 million in Bitcoin, and $16.5 million in Tether. Tether can only freeze USDT. Bitcoin does not have an issuer blacklist, and Ethereum cannot be revoked by Tether once transferred out. The recorded $7 million USDT single-user case falls within the range that can be frozen. The freeze stops further transfers but does not generate refunds.
In comparison, after the Bybit hack in 2025, only about 3.5% of the funds were frozen, and Poly Network managed to recover most of its funds through cooperation with exchanges and issuers. Currently, it is in a transfer restriction phase: CryptoBilis has suspended sales, and the reasons and identity of the attacker have not appeared in the MistTrack post. Control lies with addresses still holding unfrozen Bitcoin and Ethereum, not with USDT that has already been blacklisted.
Essentially, pricing power is divided by asset. The hardware wallet incident moved multiple coins to the same batch of addresses, and the recovery ability depends on whether the coins have an issuer. The mechanism is that the blacklist only covers contracts controlled by Tether, so as the total loss amount rises, the portion that can be frozen remains within the stablecoin slice. Tracking can reach $90 million, but refunds cannot be calculated based on this total.
ABAB News · Cognitive Law
The freeze stops transfers, not the losses themselves.
Coins with issuers can be blacklisted; coins without issuers can only be tracked.
Rising total losses do not mean rising total refunds.