Security firm Hacken identified a critical risk in the management of USDT on the TRON network, where approximately $91.3 billion is controlled by a smart contract. The system relies on a multisig setup where compromising only two signing keys could allow an attacker to take control of the contract, enabling them to mint new tokens, freeze addresses, or change administrative parameters.
Experts noted that the contract lacks built-in delays or rollback mechanisms. Furthermore, Tether utilizes the same six keys across Ethereum, Avalanche, and Celo, meaning a breach in one network could potentially impact others. Hacken emphasized that there is no evidence of any compromise or ongoing incident at this time.
The audit also highlighted that USDT smart contracts lack automated reserve verification or minting limits, allowing for token issuance without on-chain proof of bank deposits. Following these findings, the rating agency Bluechip upgraded Tether's corporate rating from D to C, citing an audit by KPMG US that showed reserves exceeding liabilities by $6.8 billion as of December 31, 2025.
The new rating incorporates the SMIDGE methodology, which evaluates reserves, corporate governance, and technical risks. Under this framework, USDT received a cybersecurity score of 3.3 out of 10. Analysts noted that this assessment is not directly comparable to the B+ rating currently held by USDC, as a similar technical evaluation for the latter has not yet been completed.
