Ledger theft-linked wallet swaps 14.7M USDT to USDD, beyond Tether's freeze reach
In brief
- $86 million to $93 million was drained from more than 300 wallets, investigators say.
- Roughly 14.7 million USDT was swapped into about 14.6 million USDD via SUN.io.
- Tether reportedly froze around $10 million in USDT across 20-plus blacklisted addresses.
- Ledger is investigating a possible supply-chain compromise tied to reseller CryptoBilis.
How the swap worked
On-chain investigators, including Specter and MistTrack, traced the stolen funds on October 9 across several blockchains (Ethereum, Tron and Bitcoin among them). The suspected perpetrator used SUN.io for the swap, according to the report.
It wasn't free. The swap gave up a small amount of value, but USDD sits outside Tether's freeze controls, and Tether's blacklist only covers USDT.
Tether blacklisted more than 20 addresses linked to the stolen assets and froze around $10 million in USDT, Crypto Briefing reported. About $14.6 million in USDD moved out of reach.
That's the gap.
Where the remaining funds sit
About 430 ETH, valued at roughly $1.07 million, was reportedly run through Tornado Cash, and some of those funds reportedly ended up in Binance hot wallets. The tagged wallets are estimated to still hold about $70.6 million in crypto, per the investigators' figures: roughly 11,406 ETH (worth about $28 million), 213 BTC (about $17.6 million), 13.65 million USDD and 10.91 million USDT, part of which is frozen.
Ledger probes reseller link
The thefts have been linked to Ledger hardware wallets bought through CryptoBilis, a Southeast Asia reseller that operates in Indonesia, Malaysia and the Philippines. Ledger has opened an investigation into a potential supply-chain compromise, so the link isn't established yet, and it's suspended all sales through CryptoBilis.
The company told customers who bought wallets recently to move their funds into new wallets with fresh seed phrases. Research cited in the report described the operation as sophisticated and targeted rather than random.
Frequently asked questions
Why did the Ledger theft-linked funds move from USDT to USDD?
Tether's blacklist only covers USDT. According to a Crypto Briefing report, the suspected perpetrator swapped roughly 14.7 million USDT into about 14.6 million USDD on SUN.io, giving up a little value but moving the funds outside Tether's freeze controls.
What should people who recently bought a Ledger wallet do?
Ledger told customers who bought wallets recently to move their funds into new wallets with fresh seed phrases. The company has also suspended all sales through CryptoBilis while it investigates a potential supply-chain compromise.
