Tether Could Lose Control of 91.3 Billion USDT on Tron, Hacken Says

Hacken says compromising just two signing keys could let an attacker take over the contract that controls about 91.3 billion USDT on Tron. For PSPs and exchanges handling stablecoin flows, the point is not the wallets themselves but the control plane behind minting, freezing, and contract settings.

1. According to the Estonian security firm Hacken, the issue is in the management system for the USDT contract on Tron, not in user wallets. Through that system, Tether can issue new tokens, freeze addresses, and change contract settings.
2. Hacken auditor Seher Saylik said that if the contract were attacked, an attacker could reassign the contract owner to an address they control. After that, Tether would likely lose the ability to manage the system.
3. The same six keys are currently used for USDT contracts on Ethereum, Avalanche, and Celo. Hacken says a problem in part of the infrastructure in one network could potentially affect other stablecoin deployments as well.
4. Hacken also pointed to the lack of an automatic cap on USDT issuance. If the required number of signers approves a transaction, the contract technically allows new tokens to be created without an onchain check of the bank deposit backing them.
5. Hacken said it has not found signs that the keys were compromised or that a hack has already happened. The firm is describing a potential weakness in the governance setup, not a confirmed breach.

This comes after Union Investment said Tether and Circle still face reserve-level risks, arguing that USDT and USDC issuers are not protected from a liquidity crisis despite their holdings of U.S. Treasury securities.