After Tether froze USDT linked to Ledger, the easiest thing to misread is “how much was frozen” versus “how much was recovered.” I care more about the status of the funds: restricting an address from transferring tokens and actually returning assets to victims are two different things, with steps in between that still need to be verified. The freeze reports making headlines are worth watching, but they should not be presented as proof that the recovery of stolen funds is complete.
The previous article discussed Ledger’s precautionary suspension of sales through the CryptoBilis channel. At 21:32 Beijing time on October 9, the official support account said it was investigating reports of financial losses among people in Southeast Asia who had purchased products through that reseller, and asked that sales and shipments be paused. The statement confirmed the investigation and channel measures, but did not disclose a final loss amount or attack mechanism in the main text available for review. Rereading it now, we still cannot extrapolate the sales suspension into a claim that all hardware products were compromised.
The new information is the freeze figures reported in Bitquery’s original on-chain investigation. The report says that between 12:09 and 14:10 UTC on October 9—that is, 20:09 to 22:10 Beijing time—Tether restricted 37 associated addresses. Twenty of those addresses held a combined total of about 10 million USDT. Thirty-seven is the number of addresses acted on; 20 is the number of addresses that still held the relevant USDT balance at the time. The two figures should not be treated as the same number of victims.
The report also records that at 15:30 UTC (23:30 Beijing time), restrictions were lifted on four wallets identified as part of over-the-counter transaction intermediaries. This is a reminder that funds passing through an address does not automatically prove that its owner was the attacker; an address may also handle other people’s assets. On-chain fund flows, address ownership, and attribution of responsibility each require separate evidence. No one should be labeled based on a single arrow showing a transfer.
The report’s fund-status chart is current through 16:45 UTC on October 9, or 00:45 Beijing time on October 10. What was accessed at 12:41 this time is that historical snapshot, not the on-chain balance at this moment. Whether funds have since moved, the freeze has been expanded or lifted, or funds have been reissued or returned must be confirmed using new on-chain records and official notices. A static chart from last night cannot be projected forward into a real-time conclusion.
A freeze can reduce the risk of specific tokens being moved further, but it does not mean that all assets once held by the other party are subject to the same restrictions. The ability to act on different assets varies depending on their mechanisms of issuance. Even if funds can still be traced, that does not mean control has returned to their original holders. “Can be located,” “cannot be moved,” and “has been returned” are three distinct statuses that should be checked separately.
I would not treat the on-chain interpretation in this investigation as Ledger’s final conclusion about the incident. The investigating firm’s figures and analysis have their own scope; an official investigation into the devices addresses a different set of questions: at what point the keys were exposed, which purchasers were affected, and what targeted remedial action is needed. If the two types of evidence are conflated, the numbers may look more complete, but the explanation of the cause can end up overstated.
Compared with the sales suspension discussed in the previous article, what is new this time is the figures for restricted addresses and balances, the subsequent change in restrictions, and the time boundary of the report’s snapshot. The next developments that could genuinely change the assessment are verifiable records of new restrictions or releases, specific progress on returning funds, and an official account of where the issue occurred. Until such evidence emerges, the freeze itself is progress in handling the incident; whether funds have reached victims’ accounts still needs to be proven separately.
The previous article discussed Ledger’s precautionary suspension of sales through the CryptoBilis channel. At 21:32 Beijing time on October 9, the official support account said it was investigating reports of financial losses among people in Southeast Asia who had purchased products through that reseller, and asked that sales and shipments be paused. The statement confirmed the investigation and channel measures, but did not disclose a final loss amount or attack mechanism in the main text available for review. Rereading it now, we still cannot extrapolate the sales suspension into a claim that all hardware products were compromised.
The new information is the freeze figures reported in Bitquery’s original on-chain investigation. The report says that between 12:09 and 14:10 UTC on October 9—that is, 20:09 to 22:10 Beijing time—Tether restricted 37 associated addresses. Twenty of those addresses held a combined total of about 10 million USDT. Thirty-seven is the number of addresses acted on; 20 is the number of addresses that still held the relevant USDT balance at the time. The two figures should not be treated as the same number of victims.
The report also records that at 15:30 UTC (23:30 Beijing time), restrictions were lifted on four wallets identified as part of over-the-counter transaction intermediaries. This is a reminder that funds passing through an address does not automatically prove that its owner was the attacker; an address may also handle other people’s assets. On-chain fund flows, address ownership, and attribution of responsibility each require separate evidence. No one should be labeled based on a single arrow showing a transfer.
The report’s fund-status chart is current through 16:45 UTC on October 9, or 00:45 Beijing time on October 10. What was accessed at 12:41 this time is that historical snapshot, not the on-chain balance at this moment. Whether funds have since moved, the freeze has been expanded or lifted, or funds have been reissued or returned must be confirmed using new on-chain records and official notices. A static chart from last night cannot be projected forward into a real-time conclusion.
A freeze can reduce the risk of specific tokens being moved further, but it does not mean that all assets once held by the other party are subject to the same restrictions. The ability to act on different assets varies depending on their mechanisms of issuance. Even if funds can still be traced, that does not mean control has returned to their original holders. “Can be located,” “cannot be moved,” and “has been returned” are three distinct statuses that should be checked separately.
I would not treat the on-chain interpretation in this investigation as Ledger’s final conclusion about the incident. The investigating firm’s figures and analysis have their own scope; an official investigation into the devices addresses a different set of questions: at what point the keys were exposed, which purchasers were affected, and what targeted remedial action is needed. If the two types of evidence are conflated, the numbers may look more complete, but the explanation of the cause can end up overstated.
Compared with the sales suspension discussed in the previous article, what is new this time is the figures for restricted addresses and balances, the subsequent change in restrictions, and the time boundary of the report’s snapshot. The next developments that could genuinely change the assessment are verifiable records of new restrictions or releases, specific progress on returning funds, and an official account of where the issue occurred. Until such evidence emerges, the freeze itself is progress in handling the incident; whether funds have reached victims’ accounts still needs to be proven separately.