Tether has frozen nearly $90 million in USDT connected to thefts targeting buyers of Ledger hardware wallets, according to a report by The Defiant citing blockchain analytics firm MistTrack. The freeze blocks the implicated addresses from moving stolen funds but does not return anything to the victims.

Estimated losses from the incident exceed $86 million, with some tracking services placing the figure closer to $90 million. The case surfaced on October 9, 2026, and centers on Ledger devices purchased through CryptoBilis, an authorized Ledger distributor operating in Southeast Asia. The stolen assets were spread mostly across the Bitcoin, Ethereum and Tron networks.

What did Tether actually do?

Tether's action was a blacklist: the issuer blocked outgoing transfers from addresses tied to the thefts. That stops the USDT portion of the stolen funds from moving anywhere, but locking an address does not, by itself, reimburse anyone. Frozen funds generally require a further step — legal action or a coordinated return process — before they reach rightful owners.

The mechanism exists because USDT differs structurally from Bitcoin. Tether issues the token and retains the ability to blacklist any address, preventing it from sending USDT onward. Over the years, Tether's blacklists have locked up billions of dollars tied to thefts and fraud.

The freeze also covers only part of the stolen haul. Bitcoin moving on its own network has no central issuer that can intervene, which makes Tether's move helpful but partial.

Is this a hardware failure or a supply chain failure?

The exact cause remains unconfirmed. Early speculation points to possible tampering somewhere in the supply chain rather than a flaw in Ledger's core hardware or systems. No evidence has emerged of a broader compromise at Ledger. For now, the concern is focused on devices that passed through a single distributor, CryptoBilis.

Ledger says it is investigating. The company has told customers who bought devices in the last three months not to initialize new hardware and to be careful about moving their assets. Ledger has also urged CryptoBilis to halt all sales and shipments while the review proceeds.

What happens next for victims?

For the victims, the freeze is a beginning, not an end. Three questions remain open: how the devices were compromised, whether other distributors are affected, and whether the frozen USDT can be routed back to those who lost funds. Until investigators answer them, Ledger's guidance to recent buyers stands — do not set up new devices and be cautious about moving funds.