Mentioned in This Article
1. Stolen Funds Slip Out of Tether's Reach
Investigators following the proceeds of a large series of hardware wallet thefts say the person behind them has begun converting frozen-prone assets into a token that Tether cannot block. On October 9, 2026, a wallet linked to the thefts used the SUN.io exchange to swap roughly 14.7 million USDT for about 14.6 million USDD, losing only a small amount of value in the process. The reason for the trade appears straightforward: USDD sits outside the blacklist controls that Tether applies to its own stablecoin.
The conversion matters because it shows how quickly a thief can respond once a freeze campaign begins. Tether had already acted against the operation, but the swap moved a sizeable portion of the loot into an asset where that kind of intervention is not available. The episode has revived an old argument about how much protection issuer-level freezes really offer when the funds can be exchanged for a different token within minutes.
The thefts themselves are large. On-chain analysts estimate that between $86 million and $93 million was drained from more than 300 wallets, with the victims connected by the Ledger hardware devices they used. Figures differ between trackers, and the number of affected users has not been firmly established, but every estimate places the incident among the bigger wallet-draining events of the year.
2. Tracing the Money Across Three Networks
Analysts began following the movement of funds on October 9, tracking the assets across Ethereum, Tron and Bitcoin. Two names appear prominently in the tracing work: the researcher known as Specter and the analytics service MistTrack, both of which publish wallet labels and transaction paths that other investigators can check against the chain.
Tether responded by blacklisting more than 20 addresses connected to the theft and freezing about $10 million in USDT. A blacklist entry prevents an address from sending or receiving the stablecoin, which effectively locks the balance in place. The step is one of the few direct tools available to a private issuer, and Tether has used it in many earlier cases involving stolen or sanctioned funds.
The SUN.io swap came on the same day. By moving about 14.7 million USDT into USDD, the operator turned tokens that could have been frozen into tokens that, for now, cannot be. The trade cost a small slice of value, which the thief evidently considered an acceptable price for escaping the blacklist.
Cross-chain tracing of this kind is slow and depends on shared labeling. Analysts compare transaction timing, amounts and address clusters to decide which wallets belong to the same operator, and those judgments are revised as new transfers appear. That is why published totals vary between teams and why the figures in this case should be read as working estimates.
3. Ether, Tornado Cash and Exchange Wallets
The stablecoin route is only one of several. Roughly 430 ETH, worth around $1.07 million, was reportedly sent through Tornado Cash, the mixing service designed to break the visible link between sending and receiving addresses. Mixers complicate tracing because they pool deposits from many users before funds are withdrawn to new addresses.
Some of the funds were also reported to have reached hot wallets operated by Binance. A hot wallet is an exchange-controlled address kept online to process deposits and withdrawals. If stolen assets land in such wallets, a centralized platform could in principle identify the deposits, hold them and cooperate with investigators, provided the link to the theft can be established quickly enough.
That possibility makes the exchange leg of the story different from the decentralized legs. Tornado Cash has no operator who can reverse a transaction, and USDD has no freeze mechanism comparable to Tether's, but a large exchange can restrict an account. Whether any of the deposits can actually be stopped will depend on how fast the platform acts and on the evidence presented to it.
4. What the Thief Still Controls
Analysts estimate that the wallets they have tagged still hold about $70.6 million. The breakdown reported so far includes roughly 11,406 ETH, valued near $28 million, and 213 BTC, worth about $17.6 million. The wallets also contain 13.65 million USDD, equal to $13.65 million, and about 10.91 million USDT, part of which is already frozen.
The listed components add up to slightly less than the headline total, a gap most likely explained by rounding or by the different moments at which balances were priced. Such small mismatches are common in live tracing work, where token prices move and wallets are relabeled as investigators learn more.
What stands out is how the holdings are spread. Instead of leaving everything in a single asset, the operator has divided the proceeds among native coins, a freezable stablecoin and a stablecoin that cannot be frozen. That distribution gives the thief several exit options and reduces the damage if any single intervention succeeds.
Because the balances remain largely intact, the outcome is not settled. Funds that sit in identifiable wallets can still be frozen, claimed or recovered if the holder moves them into a venue that cooperates with investigators. The thief's challenge is to cash out without touching such a venue, and every additional transfer leaves a trail that analysts can study.
5. The Reseller Link and Ledger's Response
The affected devices are tied to CryptoBilis, a reseller that sells Ledger hardware in Southeast Asia, with operations reported in Indonesia, Malaysia and the Philippines. Ledger has said it is investigating a possible supply-chain compromise, meaning tampering that happened somewhere between manufacture and the customer's hands rather than a flaw in the company's own systems.
Ledger has suspended sales through CryptoBilis and advised recent buyers to move their holdings into new wallets created with fresh seed phrases. The company has also said it believes the drained funds are limited to devices sold through that reseller and that it has no indication its own security infrastructure or services were breached. These statements describe the situation as the company understands it today and may change as the inquiry progresses.
The guidance to generate a new seed phrase is significant. A seed phrase is the master backup from which all of a wallet's keys are derived. If a device was altered before it reached a customer, any phrase generated on it could be known to an attacker, so moving assets to a wallet whose phrase was created on a trusted device is the only reliable remedy.
6. Signs of a Planned Operation
Several features of the case point toward careful preparation. Emptying more than 300 wallets, sorting the proceeds by how exposed each asset is to freezing, and sending each category down a different path are not the actions of an opportunistic attacker. The analysis describes the campaign as sophisticated and targeted rather than random.
The distribution of the stolen funds across Ethereum, Tron and Bitcoin reinforces that reading. Each network offers different laundering options, and using all three spreads the investigators' attention. Stablecoins on Tron, for example, can be swapped quickly through decentralized venues, while Ether can be fed into mixers and Bitcoin can be moved in stages.
Even so, the cause of the compromise has not been confirmed. Investigators and the company are still examining how the devices were affected, and conclusions about the method should be treated as provisional until Ledger publishes the results of its review.
The case also illustrates why supply-chain attacks are hard to detect. A tampered device may look and behave like a normal one, so an owner can have little visible warning before funds are loaded. If the attacker already holds the information needed to empty the wallet, the first sign of trouble can be the theft itself.
7. A Gap in Stablecoin Freeze Powers
The USDD swap highlights a structural limit in how stablecoin enforcement works. Tether's blacklist applies only to USDT, so a holder who converts into another token leaves the issuer's reach. In this case Tether froze roughly $10 million, while about $14.6 million in USDD moved beyond its control, a ratio that suggests the thief gained more by swapping than the issuer gained by freezing.
There is a precedent. In September 2026, a sanctioned marketplace reportedly shifted into USDD after Tether froze more than $45 million in linked USDT. Two cases do not make a trend, but they suggest that criminal operators now treat USDD as a standard escape route when freezes begin.
For regulators and stablecoin issuers the lesson is that enforcement tools only work as far as the token that carries them. Policymakers who discuss stablecoin rules often point to freezing capability as a safeguard, yet the safeguard is weaker if a swap venue lets funds hop to a token without it. That tension is likely to feature in future debates over how stablecoins and the venues that trade them should be supervised.
8. What Users Should Do Next
For owners of hardware wallets, the practical advice is simple. Devices bought through unofficial or third-party channels carry a higher risk than those bought directly from the manufacturer, and anyone who purchased through the reseller named in this case should treat the device as potentially compromised and follow the company's instructions.
The wider point concerns how much trust a buyer places in the supply chain. A hardware wallet is only as secure as the path it travels before setup, which is why many security specialists recommend buying from the maker, checking packaging and generating a new seed phrase on a device that has been verified.
The next developments to watch are the findings of Ledger's investigation, any further freezes or seizures involving exchange deposits, and whether the operator continues converting holdings into assets that issuers and platforms cannot easily block. Until those questions are answered, tens of millions of dollars remain in motion on-chain, traced but largely out of reach.