On October 9, Ledger users in Southeast Asia began reporting drained wallets on X and Reddit.
By that afternoon, losses tracked by MistTrack were close to **$90 million**.
Tether stepped in and froze the associated USDT addresses.
The attackers’ response: they immediately converted about 14.7 million USDT to USDD (Tron’s native stablecoin) through SUN.io—Tether’s freeze function doesn’t work on USDD.
This was a supply chain attack.
CZ also issued a warning, suspecting that CryptoBilis, a Southeast Asian reseller, had been selling tampered devices. Mark Karpelès (former CEO of Mt. Gox) inspected a device and said he found an implant hidden beneath the screen—and that the implant had even passed Ledger’s authenticity verification.
Ledger said its own infrastructure had not been compromised. It has asked CryptoBilis to suspend all sales and shipments and is investigating.
This incident highlights two known but consistently underestimated risks:
1. The security perimeter of a hardware wallet begins with its supply chain, not just the device itself. If you buy from a third-party reseller, the device may have been tampered with before it reaches you. Your recovery phrase may be exposed the moment it is generated on the device.
2. Stablecoin freezes have blind spots. Tether can freeze USDT, but it has no such power over BTC, ETH, USDD, and others—the attackers are already very familiar with this workaround.
If you’re using a Ledger bought through an unofficial channel, today is a good time to check for anything unusual.
$ETH
$USDT
#tether冻结ledger盗窃案相关usdt
By that afternoon, losses tracked by MistTrack were close to **$90 million**.
Tether stepped in and froze the associated USDT addresses.
The attackers’ response: they immediately converted about 14.7 million USDT to USDD (Tron’s native stablecoin) through SUN.io—Tether’s freeze function doesn’t work on USDD.
This was a supply chain attack.
CZ also issued a warning, suspecting that CryptoBilis, a Southeast Asian reseller, had been selling tampered devices. Mark Karpelès (former CEO of Mt. Gox) inspected a device and said he found an implant hidden beneath the screen—and that the implant had even passed Ledger’s authenticity verification.
Ledger said its own infrastructure had not been compromised. It has asked CryptoBilis to suspend all sales and shipments and is investigating.
This incident highlights two known but consistently underestimated risks:
1. The security perimeter of a hardware wallet begins with its supply chain, not just the device itself. If you buy from a third-party reseller, the device may have been tampered with before it reaches you. Your recovery phrase may be exposed the moment it is generated on the device.
2. Stablecoin freezes have blind spots. Tether can freeze USDT, but it has no such power over BTC, ETH, USDD, and others—the attackers are already very familiar with this workaround.
If you’re using a Ledger bought through an unofficial channel, today is a good time to check for anything unusual.
$ETH
$USDT
#tether冻结ledger盗窃案相关usdt