Federal prosecutors in Connecticut have recovered more than $600,000 in USDT linked to a phishing scam that targeted a Ledger hardware wallet user through a physical letter. The case underscores how law enforcement agencies are increasingly combining blockchain analytics, civil forfeiture procedures, and cooperation from stablecoin issuers to pursue stolen crypto assets even when the perpetrators have not been identified or charged.
According to the reported case details, the U.S. Attorney’s Office for the District of Connecticut worked with the FBI’s New Haven Division and the Connecticut State Police to trace funds stolen from a victim identified in court documents only as T.M. The recovered assets were later transferred to the U.S. government following a federal court forfeiture order, with the funds expected to be returned to the victim through the Department of Justice’s asset recovery process.
A Physical Letter Masquerading as Ledger
The scam began in September 2025, when T.M. received an unsolicited letter at home. The letter appeared to come from “Ledger Security and Compliance” and instructed the recipient to complete what it described as a mandatory security review for a Ledger hardware wallet. By following the instructions in the letter, the victim was ultimately tricked into revealing the wallet’s recovery seed phrase, giving the scammers effective control over the crypto assets.
This detail is significant because it shows that phishing in crypto is not limited to email, social media, or fake mobile apps. In this case, the attackers used traditional mail to create a sense of legitimacy. The tactic appears designed to exploit trust in official-looking communications, especially when combined with personal information such as a victim’s home address.
Investigators said the stolen assets were then moved through multiple intermediary wallets before being converted into USDT, a dollar-pegged stablecoin. The use of intermediary wallets and asset conversion suggests an effort to obscure the trail and complicate recovery. Even so, the transparent nature of blockchain records allowed investigators to follow the movement of funds and identify holdings worth more than $600,000.
Blockchain Analysis and Forfeiture Action
The legal process moved forward in early 2026. In January 2026, federal authorities filed a civil forfeiture complaint against the seized funds. On March 31, 2026, the U.S. District Court entered a decree of forfeiture transferring the USDT to the United States government. Court filings alleged that the stablecoins represented proceeds of wire fraud and were connected to money laundering violations.
Civil forfeiture played a central role in the case. Unlike a criminal prosecution, civil forfeiture allows authorities to seize assets connected to unlawful conduct without first obtaining a criminal conviction against a specific person. That mechanism can be particularly important in crypto fraud cases where suspects remain unidentified or are believed to be located overseas. In this instance, reported statements indicated that investigators believe the perpetrators are outside the United States.
Officials cited the joint effort among federal and state investigators in tracking and securing the funds. The case illustrates a broader trend in enforcement: blockchain-based assets may move quickly across wallets and platforms, but the public and permanent nature of onchain transaction histories can also provide investigators with a detailed map of how stolen funds were handled after the theft.
Tether’s Role in the Recovery
An additional factor in the recovery was the role of Tether, whose cooperation reportedly helped freeze and transfer the seized USDT into government-controlled wallets. This point is notable because it highlights a practical enforcement reality in the stablecoin sector: while public blockchain data enables tracing, actual asset control often depends on the issuer’s willingness and ability to assist when law enforcement identifies tainted funds.
In cases involving centralized stablecoins, cooperation from the issuer can materially improve the odds of freezing and preserving assets before they are moved further or redeemed. That does not eliminate the challenges of cross-border fraud enforcement, but it can provide a decisive operational advantage once investigators have identified the wallets involved.
For policymakers and compliance teams, the case may also be read as an example of how stablecoin infrastructure intersects with anti-fraud and anti-money-laundering efforts. When blockchain tracing, legal process, and issuer action line up, recovery becomes much more feasible than in cases involving purely self-custodied assets that have already been dispersed across privacy tools or off-ramps.
Part of a Longer Pattern of Ledger-Themed Phishing
The physical-mail tactic used in this case is not entirely new. Reports indicate that Ledger customers have been targeted with mailed phishing letters since at least 2021. Those letters often instruct recipients to visit fake websites, scan malicious QR codes, or enter their 24-word recovery phrase under the false pretense of urgent wallet verification or security maintenance.
The effectiveness of this method has been tied in part to the 2020 Ledger customer database breach, which exposed names and home addresses. That breach gave scammers the raw material needed to produce more convincing and personalized fraudulent mail. A letter sent to a verified home address, dressed up as a compliance notice, can appear far more credible than a generic phishing email.
Ledger has repeatedly warned customers that it does not send unsolicited communications requesting recovery phrases or asking users to complete security validation by revealing seed words. Any message, website, QR code, or paper letter that asks for a wallet recovery phrase should be treated as a scam. In the self-custody model, whoever controls the seed phrase controls the assets, making that information the single most sensitive credential in the wallet environment.
What the Case Means for the Crypto Sector
Beyond the immediate recovery, the Connecticut case demonstrates several important realities for the digital asset industry. First, crypto scams continue to evolve beyond online channels and may combine old-world delivery methods with familiar Web3 attack patterns. Second, blockchain transparency remains a powerful investigative tool, especially when authorities can map wallet activity across multiple hops. Third, legal mechanisms such as civil forfeiture can be used to act quickly even when the perpetrators remain out of reach.
For users, the lesson is straightforward: no legitimate wallet provider will ever require a recovery phrase through unsolicited outreach. For enforcement agencies, the case serves as another example that crypto theft is not beyond recovery when investigators move fast and use specialized tracing tools. For the broader market, it reinforces the growing importance of cooperation between law enforcement and centralized infrastructure providers in limiting the damage from digital asset fraud.
While the original theft reportedly involved approximately $234,000 in cryptocurrency, authorities traced and secured more than $600,000 in USDT, according to the reported records. The case therefore stands out not only as a successful enforcement action, but also as a reminder that stolen crypto can remain visible long after it changes form onchain.