Ledger Theft Funds Shift Into USDD, Beyond Tether’s Freeze Controls

Funds from an address linked to the Ledger user thefts were converted from 2 million $USDT into $USDD on Oct. 9, Tron transaction records show, moving that portion of the money outside Tether’s $USDT freeze controls.

The conversion records show four exchanges of 500,000 $USDT each through $USDD’s peg stability module between 7:26 a.m. and 7:32 a.m. ET. Those swaps preceded the wider incident’s first blacklist actions at about 8:09 a.m. ET, according to blockchain analytics firm Bitquery’s investigation.

For victims, the distinction is consequential: freezing $USDT can prevent its movement, but that power does not extend to $USDD. Bitquery estimated that Tether froze $10 million in 20 wallets, against its broader estimate of $92.9 million stolen. Neither converting funds nor freezing them establishes how much victims will ultimately recover.

A Route Out of $USDT

The trace begins with `TK6DWN…XT6C`, one of the addresses that tracking platform MistTrack linked to the thefts. MistTrack said reported losses were “approaching $90 million” and that affected users had contacted it for assistance.

Tron transfer records show that address sent about 10 million $USDT to `TPZwqN…uSSk`. The recipient then sent 2 million $USDT to `TMkfPX…vFiY`, which exchanged it for an equal quantity of $USDD in four successful transactions.

That is one traced conversion route, not a total for the incident. Bitquery’s wider analysis estimated that 14.9 million $USDT had been swapped into $USDD. Security firm Hacken explained the limitation: “Tether’s $USDT freeze controls do not apply to $USDD.”

The movements show why the freeze previously reported by The Defiant cannot be read as recovery of the full stolen amount. Bitquery’s $10 million frozen figure is an analyst estimate, not an announced repayment to customers. Its investigation says blocked $USDT can later be destroyed and reissued; a blacklist action itself does not return money to victims.

Ledger said it was investigating losses among Southeast Asian customers who bought devices from reseller CryptoBilis and had asked the reseller to pause sales and shipments. Its notice did not establish how the funds were taken.

Ledger advised buyers from the past 90 days who had not initialized their devices to delay setup. Customers who had already done so should “consider moving assets to a new Ledger signer (with new seed),” it said.