Thieves linked to a coordinated theft targeting Ledger hardware wallet users converted approximately 2 million USDT into USDD to move stolen funds beyond Tether's freeze controls. The swap represents part of a larger operation in which investigators estimate $86 to $93 million was drained from more than 300 wallets.
On-chain investigators including Specter and MistTrack traced the stolen funds across Ethereum, Tron, and Bitcoin on October 9, 2026. Tether responded by blacklisting more than 20 addresses and freezing around $10 million in USDT.
Strategic Asset Movement
The perpetrators quickly adapted. Using SUN.io, they swapped approximately 14.7 million USDT into roughly 14.6 million USDD on the same day. USDD operates outside Tether's blacklist controls, allowing the conversion to circumvent the freeze.
Ethereum-based assets took a different route. About 430 ETH, valued at roughly $1.07 million, was reportedly moved through Tornado Cash, with some funds reportedly reaching Binance hot wallets.
Remaining Holdings
Tagged wallets are estimated to still hold approximately $70.6 million in cryptocurrency, distributed across multiple assets:
- ETH: roughly 11,406 coins, worth about $28 million
- BTC: 213 coins, worth about $17.6 million
- USDD: 13.65 million coins, worth about $13.65 million
- USDT: 10.91 million coins, part of which is frozen
Ledger Investigation and Supply Chain
The thefts have been connected to Ledger hardware wallets purchased through CryptoBilis, a Southeast Asian reseller operating in Indonesia, Malaysia, and the Philippines. Ledger has launched an investigation into a potential supply-chain compromise and suspended all sales through CryptoBilis.
The company advised customers who purchased wallets recently to transfer funds into new wallets with fresh seed phrases.
Sophisticated Operation
The coordination required to drain more than 300 wallets and then route different asset types through distinct channels suggests planning. The operation demonstrates how different asset types face different freeze risks and how attackers can exploit those differences.
The USDT-to-USDD conversion highlights a gap in stablecoin freeze capabilities. Tether's blacklist applies only to USDT, allowing approximately $14.6 million in USDD to remain outside Tether's reach while the freeze captured around $10 million. This is not the first instance where Tether's blacklisting has prompted illicit operators to switch to USDD. In September 2026, a sanctioned marketplace moved to USDD after Tether froze over $45 million in linked USDT.
Funds reportedly reaching centralized exchange hot wallets place platforms in a position to identify and potentially hold the deposits.
