Hacken has identified vulnerabilities in the USDT contract on TRON, managing $91 billion, raising concerns over security and governance.
Hacken has revealed a critical vulnerability in the management of approximately $91.3 billion in USDT on the TRON network, highlighting potential risks associated with the contract control mechanisms.
Experts found that nearly half of USDT's market supply is linked to a multisig contract that does not feature essential security measures such as delays, cancellation options, or effective rollback systems.
This concern centers on the administrative multisig governing the USDT contract rather than individual wallets. The contract allows for token issuance, address freezing, and ownership transfer.
Seher Saylik, a smart contract auditor at Hacken, explained that if an attacker gains access to the two key signatures, they could take control of the contract, potentially preventing Tether from executing management functions. This breach could enable the attacker to mint additional USDT, manipulate transaction processes, implement fees, and modify other critical settings.
Hacken reassured that there are no current indications of any key compromises or breaches. They also noted that Tether utilizes the same six keys across multiple platforms, including Ethereum, Avalanche, and Celo, suggesting that a security failure in one could jeopardize others.
The audit further indicated that the USDT smart contracts lack automated reserve checks and issuance limits. If the signatories approve a transaction, the contract can generate any quantity of tokens without verifying corresponding bank deposits on-chain.
In response to these findings, Bluechip has upgraded Tether's corporate rating from D to C, following a KPMG US audit that confirmed Tether International's reserves surpassed liabilities by $6.8 billion as of December 31, 2025. This assessment employed the new SMIDGE methodology, which evaluates reserves alongside corporate governance and technical risks, incorporating insights from Hacken. The cybersecurity score for USDT stands at 3.3 out of 10.
As for USDC, Hacken has not yet finalized a similar evaluation, so the B+ rating assigned by Bluechip does not serve as a direct technical comparison to USDT.
Additionally, the Bank for International Settlements has expressed skepticism regarding stablecoins, arguing they lack essential monetary properties and are not suitable as a reliable payment method on a large scale.
