14.7 million tokens were exchanged for USDD, 20 addresses were frozen: Are your stablecoins safe?

Limitations of the stablecoin freezing mechanism and analysis of hardware wallet security risks

After a customer at a Ledger dealer suffered a wallet theft incident, stablecoin issuer Tether responded by freezing the relevant USDT address. However, the freeze was only partially effective: some of the stolen funds were exchanged for another stablecoin, USDD, and Tether's control could not be extended to the token. This incident briefly revealed the scope and limitations of the "freezing function" in stablecoins. This is not a marginal issue for holders, as who can decide to stop your tokens in an emergency and who has this control when you become a victim.

Tether freezes more than 20 addresses and locks approximately US$10 million USDT

stablecoins are tokens whose price is pegged to legal tender, usually the U.S. dollar. It is issued by a company that manages reserves and sets rules for tokens. This is also the source of the "freezing option" in this controversy.

According to Crypto Briefing, citing the flow of funds in affected wallets, Tether blacklisted more than 20 addresses and locked up approximately $10 million in USDT in the process. The funds remain at the relevant address but cannot be transferred. Technically, behind this is the blacklist feature, which is written into the token's program code and allows issuers to exclude specific addresses from participating in the transfer. As for the scope of Tether's retention of this right and its contractual basis, we provided a detailed analysis of Tether's freezing clauses in another article. The core point is that decision-making power lies in the hands of the issuer, not the courts or token holders.

The amount frozen is small compared to the total loss. But this incident shows that stablecoins issued by centralized institutions operate differently from cryptocurrencies without issuers, such as Bitcoin. Bitcoin has no institution that can close an address, but the USDT does.

October 9: SUN.io exchanged 14.7 million USDTs for 14.6 million USDD

According to Crypto Briefing, on October 9, approximately 14.7 million USDTs were exchanged for approximately 14.6 million USDD through the decentralized trading platform SUN.io. USDD is an independent stablecoin running on the Tron network and is not issued by Tether. The difference between the two is the discount cost incurred by such conversions.

As the token form changed, Tether's control was terminated. The blacklist is only valid within the token. Once the balance is transferred to another token managed by a different issuer, even if the address is the same, the old blacklist loses its meaning. The same report also mentioned another small movement record of USDT 2 million for the same wallet.

USDT's blacklist function is limited to its own token system

This is the core lesson of this case, and this principle holds true regardless of the outcome of the investigation. The freezing function is not a network covering the entire market, but a valve in a single pipe. Leave this pipe and you leave this valve. This does not mean that the freeze feature is worthless because it takes effect quickly and does not require judicial process, but it is indeed a tool with a scope that is sharply limited.

For holders, this feature has two sides. If a token issuer can freeze stolen assets, then in principle, the issuer can also freeze your balance. Tokens with this feature provide protection in some situations, but leave you alone at risk in other situations. Which stablecoins exist and how they differ in terms of collateral and control, please see our stablecoins overview .

Differences in loss estimates: Specter and MistTrack produce different data

Differences in estimates of total losses are part of the situation. On-chain investigation agency Specter initially estimated the suspected theft to exceed $86 million. Security company MistTrack subsequently came up with a loss figure of nearly $90 million. Crypto Slate reported on both accounts, while noting that these estimates have not yet been confirmed and investigators have not proved that each wallet belongs to the same case. Crypto Briefing noted that losses from more than 300 wallets ranged from approximately $86 million to $93 million.

It is intentional to retain the scope here rather than round it. Forcing it to an integer would imply a non-existent precision. According to Crypto Slate, Ledger itself did not confirm any loss figures or state the amount of equipment that might have been affected. We described the core of the Ledger buyer theft in our October 9 article.

About US$70.6 million remains in marked addresses

Most of the stolen money has not disappeared, but is visible. According to Crypto Briefing, the tagged addresses still hold approximately $70.6 million. The largest of these is 11,406 Ethers worth approximately US$28 million, plus 213 Bitcoin coins worth approximately US$17.6 million. The list also includes 13.65 million USDDs and 10.91 million USDTs, some of which have been frozen.

Visible and inaccessible are two different concepts

每一笔移动都公开可追溯，这容易引发误解。开放式账本并不意味着资金可恢复。只要代币没有冻结功能或未启用该功能，即使地址在所有分析工具中被标记、监控并标红，所有者仍可自由处置。Ledger正在调查马来西亚、印度尼西亚和菲律宾的经销商CryptoBilis。

10月9日，Ledger表示正在跟进有关客户在购买CryptoBilis设备后丢失余额的报告。据Crypto Slate称，该公司要求该经销商暂停销售和发货。CryptoBilis被描述为Ledger目录中列出的授权经销商，服务于马来西亚、印度尼西亚和菲律宾市场。

正在调查的可能性是通过供应链发起的攻击。这意味着设备可能在到达买家之前被篡改。就目前报道的情况而言，这一点尚未得到证实。Crypto Slate明确指出，目前尚无确凿证据表明内置组件与盗窃案有关联。赵长鹏（CZ）对此情况的描述如下：“基于目前的信息，这似乎局限于与单一供应商相关的供应链攻击。”

Ledger向买家提出的建议

Users who purchased from this dealer in the past 90 days received special advice: equipment that has not yet been set up should not be put into use. Devices that are already set up should clear their balances by transferring funds to new devices with new mnemonics. A mnemonic is a sequence of words from which all wallet keys can be recovered. People who know the mnemonic can control the balance, no matter where the device is located.

Tornado Cash: 430 Ethers left traces

According to Crypto Briefing, approximately 430 Ethers (worth approximately US$1.07 million) were routed through Tornado Cash. Such money mixers mix the deposits of many users and pay them to new addresses, cutting off the trace between origin and destination. That's a small fraction compared with the $70.6 million still exposed.

Nevertheless, the direction is recognizable. People who try to bypass blacklists by replacing tokens, and people who use currency mixers, are doing the same thing: They are looking for spaces where issuers and observers cannot intervene. Such space does exist, which is why recovery efforts in such cases can only be partially successful.

Own data: USDD has three trading pairs in Kraken, USDT has 55

This begs the question of whether German investors will be exposed to USDD. To this end, we counted the products of a trading platform authorized by the European Union and checked all assets and trading pairs listed: a total of 856 assets and 1,460 trading pairs. USDD is listed there, but there are only three trading pairs. The USDT has 55 trading pairs and the USDC has 54 trading pairs. DAI and Ripple each have five RLUSDs, and three PYUSDs. Cryptoticker.io compiled this analysis on October 12, 2026.

The results are clearer than at first hearing. Although USDD is reachable, it is a marginal asset. Most German investors 'stablecoin balances are concentrated in the USDT and USDC, both of which have issuers with freezing options. Anyone who is concerned about product range and licensing when choosing a platform can find the differences in our Cryptocurrency Exchange Comparison .

When your USDT is at a frozen address

The disturbing situation comes not from criminals, but from innocent third parties. Anyone receiving USDT from an address that was later blacklisted could be involved without knowing it. There is no deadline for how long the freeze must be lifted, and there is no appeal process in the usual sense of the word. Please refer to our article on USDT Freeze Clauses for what Tether's terms of service stipulate in this regard and how much freedom the company gives itself.

在实际操作中：大额稳定币余额停留在你无法单独控制的地点的时间越短，风险就越小。稳定币是一种存放资金和支付的工具。作为长期存储大额资金的载体，它承担着与价格波动无关的风险。

密封包装与转售：完好无损的包装并不能证明安全

本案的第二部分涉及设备而非稳定币。硬件钱包通过自行生成私钥且从不外泄来保护私钥。这一计算仅在密钥真正在你端生成时才有效。如果设备在交付前被篡改或预置了已知的单词序列，第三方从一开始就知晓你的密钥，此后采取的任何预防措施都将无效。

因此，购买渠道是一个安全问题，而非价格问题。在此，完好的包装是一个微弱的信号，因为薄膜和封条可以被复制。可靠的是设备在设置期间自身的行为：它必须生成一个新的单词序列并要求你确认。任何带有完成短语或附带短语的设备，在任何情况下都不可用。选择时的其他考量因素请参阅我们的硬件钱包比较。

在新设备上使用新的助记词是真正终结供应链潜在知识传递的唯一步骤。

稳定币冻结机制总结

The case provides a rule that goes beyond itself: the freezing function is effective within the token and ends at its boundaries. This makes USDT partially recoverable in theft cases, and also means that your balance may in principle be compromised. This leads to three steps:

• Check the stablecoins you hold and their issuers: USDT and USDC have issuers with freeze options; and for other tokens, control lies elsewhere. Overview of stablecoins shows the differences in collateral and control.
• Check the purchase channels for hardware wallets: If you have purchased from a dealer within the past 90 days, do not blindly set up the device. If you are already in use, follow Ledger's recommendations and move to a new device with new mnemonics. For which devices are suitable for this operation, see Hardware Wallet Comparison .
• Check the length of time large amounts of money stay in locations beyond your sole control: The platform's authorizations and product scope are part of this decision, and Exchange Compare displays them side by side.

Ledger's survey output is unclear, nor is it clear whether the route from dealer to equipment is provable. It is also unknown whether the $70.6 million in marked address funds can be recovered. However, these two sentences about the scope of action of the freezing function are already conclusive.

(As of October 12, 2026. This article does not constitute investment advice. Price and fee structures are subject to change; please consult the provider for specific terms before purchasing.)