Ledger theft-linked funds shift from USDT to USDD to dodge Tether freezes

A wallet tied to a wave of thefts from Ledger hardware wallet users converted 2 million USDT into USDD. The apparent goal was to move the money beyond Tether’s ability to freeze it.

That one swap is part of a much larger pattern. On-chain investigators say approximately $86 to $93 million was drained from more than 300 wallets.

How the money moved

Investigators traced the stolen funds on October 9, 2026, across several blockchains, including Ethereum, Tron, and Bitcoin. Specter and MistTrack were among the on-chain sleuths following the trail.

Tether moved first. The stablecoin issuer blacklisted more than 20 addresses linked to the stolen assets and froze around $10 million in USDT.

The suspected perpetrator adjusted quickly. Using SUN.io, they swapped roughly 14.7 million USDT into roughly 14.6 million USDD on October 9. The swap gave up a little value, but USDD sits outside Tether’s freeze controls.

The Ethereum side of the operation took a different route. About 430 ETH, valued at roughly $1.07 million, was reportedly run through Tornado Cash. Some of those funds reportedly ended up in Binance hot wallets.

What the thief still holds

The tagged wallets are estimated to still hold about $70.6 million in crypto.

The reported breakdown:

ETH: roughly 11,406 ETH, worth about $28 million.

BTC: 213 BTC, worth about $17.6 million.

USDD: 13.65 million USDD, worth about $13.65 million.

USDT: 10.91 million USDT, part of which is frozen.

The Ledger connection

The thefts have been linked to Ledger hardware wallets bought through CryptoBilis, a reseller based in Southeast Asia. CryptoBilis operates in Indonesia, Malaysia, and the Philippines.

Ledger has opened an investigation into a potential supply-chain compromise. The company has also suspended all sales through CryptoBilis.

Ledger told customers who bought wallets recently to move their funds into new wallets with fresh seed phrases.

Why this looks targeted

Draining more than 300 wallets, then sorting assets by freeze risk and moving each type through a different channel, points to planning. Tether froze USDT, and the attacker turned the remaining USDT into an asset Tether can’t touch. ETH went through a mixer. The research describes the operation as sophisticated and targeted rather than random.

What this means for stablecoins and wallet buyers

The USDT-to-USDD swap highlights a real gap in stablecoin freeze powers. Tether’s blacklist only covers USDT. In this case, Tether’s freezes caught around $10 million, while about $14.6 million in USDD slipped out of reach.

This is not the first instance where Tether’s blacklisting has driven illicit operators toward USDD. In September 2026, a sanctioned marketplace moved to USDD after Tether froze over $45 million in linked USDT.

Funds reportedly reaching Binance hot wallets puts centralized platforms in a position to act if they can identify and hold the deposits.