Tether has blocked $10 million in USDT linked to the CryptoBilis Ledger wallet theft, according to reports circulating on Monday.
Tether has blocked $10 million in USDT linked to the CryptoBilis Ledger wallet theft, according to reports circulating on Monday. The freeze marks another instance of the stablecoin issuer intervening to prevent suspected stolen funds from moving through the financial system, though full details of the incident and the on-chain tracing methodology have not yet been publicly confirmed.
What Tether blocked and why it matters
The $10 million freeze targets USDT connected to the CryptoBilis incident, in which attackers reportedly drained funds from Ledger hardware wallets. Tether’s ability to blacklist specific wallet addresses at the contract level means the blocked USDT cannot be transferred or exchanged, effectively immobilizing the funds on-chain pending further investigation or legal proceedings. For related coverage, see Ledger Launches Morpho Loans Using Wrapped Bitcoin as Collateral.
Blocking is not the same as recovery. The funds remain locked on-chain but are not automatically returned to victims; that step typically requires coordination with law enforcement and, in many jurisdictions, a court order. Until those processes conclude, the $10 million sits in a frozen state, inaccessible to anyone holding the flagged addresses.
Ledger hardware wallets have been at the center of significant theft activity. A broader Ledger-related wallet drain previously totalled $92.9 million across Bitcoin, Ethereum, and TRON, illustrating that attackers have repeatedly targeted the self-custody ecosystem around the device.
How the frozen funds connect to the CryptoBilis theft
The reported linkage suggests on-chain analysts traced a portion of stolen proceeds to wallets holding USDT, at which point Tether was notified or independently identified the addresses. The specific tracing method, including whether blockchain analytics firms were involved, has not been confirmed in available reporting. Any unconfirmed details about wallet addresses, transaction hashes, or theft timelines are pending official disclosure.
Tether has exercised its blacklist function in a range of contexts. The company froze nearly $550 million in Iran-linked USDT in 2026, and in a separate case briefly froze USDT connected to THORChain before reversing the action three hours later. These actions show both the reach and the occasional imprecision of centralized stablecoin controls.
Not every freeze goes unchallenged. Conduit sued Tether over a $2.76 million USDT freeze, arguing the company acted without adequate process. That litigation underscores the legal exposure Tether faces when it acts unilaterally, even against funds suspected of theft.
What Tether’s action means for stolen stablecoin funds
For Bitcoin holders, this episode is a reminder of a core architectural difference between USDT and bitcoin itself. Bitcoin has no issuer, no blacklist function, and no freeze mechanism; its censorship resistance is absolute at the protocol layer. Stolen bitcoin can be tracked on-chain but cannot be frozen by any central party, which shifts the recovery burden entirely to law enforcement seizure at the point of conversion.
USDT, by contrast, is a liability of Tether Limited, and that centralization enables rapid intervention when theft is suspected. That same centralization is why Bitcoin maximalists treat USDT as a fundamentally different instrument: the freeze capability that helps theft victims is the same capability that can be deployed for any other purpose the issuer deems appropriate. The CryptoBilis case adds another data point to that ongoing debate, with further official details expected as the investigation develops.
Additional source references: source document 1, source document 2.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
