$91 Billion Risk in USDT: Contract Ownership Could Change if Two Keys Are Compromised

According to Hacken’s assessment, the compromise of two signature keys could grant extensive control over the approximately $91.3 billion USDT supply on the Tron network; however, there is currently no evidence of any attack.

An investigation by blockchain security firm Hacken revealed that the administrative powers of the USDT contract are tied to two keys. If these keys are compromised, attackers could change the contract owner, mint new USDT, freeze addresses, or halt transfers without needing access to user wallets.

The magnitude of the risk stems from the amount of USDT on the Tron network. There is approximately $91.3 billion in USDT on this network. The stablecoin’s total circulating supply is around $184.6 billion. Hacken stated that the contract lacks a timelock to delay changes, a revocation window, or a reliable recovery mechanism.

USDT keys are used across multiple networks

The same six signature keys are also used for USDT management on the Ethereum, Avalanche, and Celo networks. Therefore, compromising keys used on Celo or Avalanche could be used to unauthorizedly approve a separate administrative transaction on Ethereum.

The investigation found no evidence of an existing key breach or loss of funds. The findings point to contingent risk within the contract architecture rather than a past attack.

In Hacken’s technical assessment, USDT received a score of 3.3 out of 10. Conversely, following a financial audit by KPMG US, Bluechip upgraded Tether’s corporate rating from D to C. This upgrade is based on a financial review showing that reserves exceed liabilities by $6.8 billion and does not imply that the contract controls are technically secure.

Hacken also noted that there is no system in place to automatically verify reserves in USDT contracts, nor is there a cap on the amount of tokens that can be minted.