Ledger-theft funds swap into USDD on SUN.io, past Tether's freeze reach

Wallets linked to the ongoing Ledger / CryptoBilis theft swapped a tranche of USDT into USDD on SUN.io on October 9, moving the stolen float onto a stablecoin whose issuer has no blacklist primitive, as The Defiant reports citing on-chain investigators Specter and MistTrack. Crypto Briefing puts the Oct 9 swap at roughly 14.7 million USDT into roughly 14.6 million USDD. Tether has blacklisted more than 20 linked addresses and frozen about $10 million across the wider cluster so far, Bitquery's audit shows per the same reports.

What happened

The underlying incident is the CryptoBilis compromise this site covered yesterday: Ledger suspended sales through the Southeast Asian reseller after reports that pre-configured devices sold to end users in Indonesia, Malaysia and the Philippines leaked seed phrases. Reported losses span 300+ wallets and roughly $86–93 million.

The new piece today is where the stolen stablecoins are going. According to Crypto Briefing's reconstruction of the tagged cluster:

• USDD holdings: 13.65 million USDD (~$13.65M)
• USDT holdings: 10.91 million USDT, part of which is already frozen
• ETH holdings: 11,406 ETH ($28M at the time of reporting)
• BTC holdings: 213 BTC (~$17.6M at the time of reporting)
• Still held in tagged wallets: ~$70.6M
• Routed through Tornado Cash: 430 ETH ($1.07M)

The core maneuver: convert tagged USDT into USDD before Tether can add the holding wallets to its blacklist. USDD, issued through the Tron DAO Reserve's stability module, has no equivalent central freeze control. Once the balance is on USDD, Tether's addBlackList(address) on the USDT contract cannot touch it.

Why USDD, why SUN.io

The pathway runs through SUN.io's exchange route, with 2 million USDT separately converted through USDD's Peg Stability Module per The Defiant's subhead. The two numbers (2M via PSM, 14.7M through SUN.io broadly) do not reconcile cleanly in the reporting; both figures come from the same primary cluster but mapping each to a specific contract call will require pulling the Tron tx trail directly. The structural point is that SUN.io provides a liquid USDT/USDD pair on Tron and the PSM provides an alternate 1:1 conversion path that bypasses order books.

Launched July 2022 as an over-collateralised stablecoin on Tron, USDD now serves as the Tron-side destination of choice for actors who have been or expect to be blacklisted on USDT.

Pattern

This is a repeat of a mechanic documented a month ago. On September 9, CryptoSlate reported that Tether froze more than $45M in USDT across at least 22 Xinbi-linked addresses, after which Xinbi — a Chinese-language scam-compound marketplace — announced it would transact only in USDD. The CryptoBilis cluster is now walking the same path:

1. Tether freezes a round of tagged USDT addresses.
2. The remaining USDT at tagged wallets converts to USDD on Tron.
3. The USDD stock becomes unreachable through the issuer-level freeze primitive that previously worked.

Separately, the cluster's ~430 ETH through Tornado Cash (~$1.07M at reporting) covers the Ethereum-side laundering leg, where Tether's freezes apply to the Ethereum USDT contract and Tornado's routing severs the on-chain link between source and destination.

What to watch

1. Does USDD's issuer freeze anything. The Tron DAO Reserve has no documented history of freezing USDD at the issuer level. If any precedent is set here it would be a material change to how analysts price USDD's censorship-resistance claim.
2. Secondary off-ramps. Binance hot wallets have reportedly received portions of the Ledger cluster per The Defiant; whether centralized exchanges honor Tether's blacklist signals (and freeze USDD inflows that originated from flagged USDT swaps) is the next bottleneck.
3. Ledger's post-incident disclosures. The firm has suspended CryptoBilis sales but has not published a device-level technical explainer. Whether the pre-configuration path is a seed-generation flaw, a supply-chain substitution, or operational key leakage at the reseller changes the mitigation set for every Ledger owner, not only CryptoBilis buyers.
4. Bitquery and MistTrack address lists. The $70.6M remaining in tagged wallets is spread across ETH, BTC, USDT and USDD; dashboards from Bitquery and MistTrack carry the specific addresses — the only reliable surface for a counterparty to screen against.

Context

Issuer-level freeze primitives — addBlackList on USDT, freeze on USDC — are the de facto post-exploit recovery lane for stolen stablecoins. USDD's design, which omits that primitive, is now being exercised at scale as the escape hatch. The practical ask for integrators and treasuries is unchanged: screen counterparty flows against both the frozen-address lists and the USDT→USDD swap signatures on Tron. Catching the stolen float after it has crossed into USDD becomes an off-chain problem, not an on-chain one.