$91 Billion Risk in Tether Contract Control

A security investigation by Hacken has revealed that two signature keys control the administrative powers of the USDT contract on the Tron network, and if compromised, attackers could gain extensive control over approximately $91.3 billion in USDT.

The contract lacks a timelock to delay changes, a revocation window, or a reliable recovery mechanism, which makes it vulnerable to unauthorized actions such as changing the contract owner, minting new USDT, freezing addresses, or halting transfers.

USDT keys are used across multiple networks, including Ethereum, Avalanche, and Celo, which means compromising keys on any of these networks could be used to approve administrative transactions on other networks without user consent.