Tether has frozen $10 million in USDT connected to the $93 million CryptoBilis Ledger exploit, according to a CoinDesk report on the issuer's action.

The freeze targets funds that on-chain investigators traced to the exploit, which drained roughly $93 million from victims of the CryptoBilis attack involving Ledger hardware wallet infrastructure. Tether's intervention blocks the attacker's ability to redeem or transfer the frozen USDT through compliant channels, a tactic the company has used repeatedly to disrupt laundering flows after major thefts.

What does the freeze accomplish?

When Tether blacklists a wallet address, it places the address on the chain-level blacklist enforced by USDT smart contracts on chains that support that functionality. On Ethereum and Tron — the two networks where the bulk of USDT circulates — transfers from blacklisted addresses fail at the contract level. The attacker cannot move the frozen $10 million without Tether lifting the freeze.

The move does not recover the funds for victims by itself. It freezes them in place. Recovery typically requires law enforcement action, a court order, or a negotiated process through which Tether redeems the frozen tokens and returns proceeds to identifiable victims — a process that has played out in prior incidents, including the 2016 Bitfinex hack, where Tether ultimately assisted in freezing and, in later years, helped facilitate returns.

The remaining balance of the stolen $93 million — roughly $83 million not covered by this freeze — may sit in other assets, other chains, or addresses Tether cannot reach. Funds converted to bitcoin, ether or privacy assets fall outside any issuer's unilateral control.

Why issuer freezes matter post-exploit

Stablecoin issuers occupy a unique enforcement position in crypto market structure. Unlike protocol developers or exchanges, they can unilaterally immobilize their own tokens anywhere those tokens circulate, provided the chain supports blacklist enforcement. That capability has made Tether a de facto chokepoint in post-hack investigations, working alongside analytics firms and law enforcement to trace stolen proceeds.

For the CryptoBilis exploit specifically, the $10 million freeze signals that a meaningful share of the stolen haul moved into USDT at some point — a laundering step that investigators were able to detect and act on. Attackers often prefer converting stolen funds into stablecoins for temporary safekeeping before bridging to other chains or off-ramping through exchanges with weak controls.

What comes next?

Expect follow-on action in three areas: additional address freezes as investigators trace more of the stolen $93 million, exchange-level freezes if the attacker attempts to deposit flagged funds, and possible coordination with law enforcement in the relevant jurisdictions. Tether has historically worked with authorities to convert freezes into actual restitution, and victims' recovery here will likely depend on that pipeline rather than the blacklist alone.