Hacken: Two Keys Could Control About Half of USDT Supply

ChainCatcher reports that blockchain security firm Hacken has published a risk assessment warning that roughly half of USDT in circulation—about $91.3 billion on Tron—is governed by a 2-of-3 multisignature contract that lacks built-in time delays, cancellation processes, and dependable revocation mechanisms. According to Hacken, an attacker who compromises just two of the signing keys could seize contract ownership and execute privileged actions such as minting tokens, freezing addresses, wiping frozen balances, or setting transfer fees—without needing access to any user wallets. Hacken also said Tether reuses the same set of six signing keys across Ethereum, Avalanche, and Celo, raising the possibility that a compromise on one network could spread risk across chains. On the ratings side, stablecoin rating agency Bluechip upgraded Tether's corporate rating to C from D. Bluechip cited a KPMG audit showing Tether's reserves exceeded its liabilities by $6.8 billion as of December 31, 2025. Bluechip said this is the first application of its expanded SMIDGE methodology, which now incorporates Hacken's technical risk analysis. Despite the corporate upgrade, Hacken assigned USDT a cybersecurity score of 3.3 out of 10. The firm pointed to the absence of automated reserve-proof verification in the USDT smart contract and the lack of any cap on token issuance; once signers authorize a transaction, the contract can mint any amount without requiring bank reserve backing. Hacken added that it has not yet completed a comparable assessment of Circle's USDC. Bluechip's earlier B+ rating for USDC was based on an older methodology and is not directly comparable on a technical basis.