Hacken Report: Half of USDT Controlled by Two Signature Keys

ChainCatcher report: Blockchain security firm Hacken has released an assessment report indicating that approximately half of the circulating USDT (around $91.3 billion on the Tron network) is controlled by a 2-of-3 multisignature contract lacking built-in delays, cancellation procedures, or reliable revocation mechanisms. An attacker only needs to compromise two signature keys to change contract ownership, mint tokens, freeze addresses, clear frozen balances, or set transfer fees—without accessing any user wallets. Hacken also found that Tether reuses the same set of six signature keys across Ethereum, Avalanche, and Celo, creating potential for cross-chain risk propagation. Meanwhile, the stablecoin rating agency Bluechip upgraded Tether’s corporate rating from D to C, citing KPMG’s audit showing Tether’s reserves exceeded liabilities by $6.8 billion as of December 31, 2025. This marks Bluechip’s first use of its expanded SMIDGE methodology, which incorporates Hacken’s technical risk analysis. However, Hacken assigned USDT a cybersecurity score of only 3.3 out of 10, noting that the USDT smart contract lacks automated reserve proof verification and has no upper limit on token minting—once signers authorize a transaction, the contract can mint any amount of tokens without requiring bank reserve backing. Hacken stated it has not yet completed a comparable assessment of Circle’s USDC; Bluechip’s previous B+ rating for USDC was based on an older methodology and cannot be directly used for technical comparison.