Tron and Tether, two heavyweights in the blockchain and stablecoin space, have partnered to freeze $9 million in illicit funds linked to a massive hack of the ByBit cryptocurrency exchange. The joint effort, showcases a rapid response to one of the largest crypto heists in history, with the duo collaborating under the T3 Financial Crime Unit (T3 FCU) alongside blockchain intelligence firm TRM Labs. This action marks a significant step in curbing crypto crime on Tron’s network, where Tether’s USDT stablecoin plays a dominant role.
The ByBit breach, uncovered in February 2025, saw hackers—suspected to be North Korea’s Lazarus Group—siphon off roughly $1.5 billion in digital assets, primarily Ethereum (ETH), from the exchange’s cold wallet. According to Chainalysis, the attackers exploited a vulnerability in ByBit’s third-party multisig provider, Safe Wallet, injecting malicious JavaScript to trick signers into approving a fraudulent transaction. Funds were then dispersed across a web of intermediary wallets, with some swapped to USDT on Tron for laundering. Tron and Tether’s intervention has so far immobilized $9 million of those assets, thwarting the hackers’ efforts to cash out.
Launched in August 2024, the T3 FCU unites Tron’s blockchain expertise, Tether’s investigative reach, and TRM Labs’ forensic tools to tackle illicit activity involving USDT on Tron’s $13 billion network. “This sends a clear message: criminals misusing our platforms will face consequences,” Tether CEO Paolo Ardoino told in January. The unit’s track record is growing—by January 2025, it had frozen $126 million tied to scams, laundering, and drug trafficking. The ByBit case adds to this tally, with TRM Labs pinpointing suspicious USDT transactions within five days of detection.
Tron’s appeal—handling over 8 billion transactions and hosting 247 million accounts by August 2024, per Forbes—makes it a hotspot for both legitimate users and bad actors. USDT, with over 50% of its $143 billion supply on Tron, is a prime target due to its low fees and stability. TRM Labs’ April 2023 report flagged Tron as hosting 45% of illicit crypto volume, with USDT leading at $19.3 billion—1.63% of its total flow. ByBit’s stolen funds, swapped into USDT, highlight this vulnerability, but also the power of centralized stablecoins to freeze assets when flagged.
The freeze didn’t come alone. Industry players like Binance, OKX, and KuCoin pledged support, monitoring and locking related wallets, per Nansen Research. Mantle froze $43 million in mETH tokens, while Tether previously halted $604,000 across Tron and Ethereum. Chainalysis noted the hackers’ laundering tactics—using THORChain and Paraswap—aimed to obscure trails, yet blockchain’s transparency enabled real-time tracking. “Collaboration is key,” Chainalysis wrote on February 26, emphasizing how exchanges and forensic teams united to recover over $40 million so far.
This isn’t Tether’s first crackdown. In November 2023, it froze $225 million in USDT linked to Southeast Asian pig butchering scams after a U.S. Department of Justice probe. Tron founder Justin Sun, facing an SEC lawsuit since March 2023 over TRX token sales, has pushed T3 FCU as a redemption arc, telling Forbes, “We’re setting a new standard for safety.” Critics, however, note Tron’s 58% share of illicit transactions in 2024, per TRM Labs, suggesting deeper challenges.
The ByBit hack’s fallout continues. With $1.5 billion stolen—double the next-largest crypto theft—ByBit secured a bridge loan to stabilize operations, per CNBC. The $9 million freeze, while a fraction, signals progress. Could this public-private synergy deter future attacks, or will hackers adapt faster than defenses?
Disclaimer: TrueToCrypto.com (the “Website”) is for general informational purposes only and is obtained from independent sources that are believed to be reliable. However, TrueToCrypto.com, its owners, affiliates, officers, employees, and agents (collectively, “We,” “Us,” or “Our”) make no representations or warranties, express or implied, as to the accuracy, completeness, timeliness, reliability, or suitability of the information contained on or accessed through this Website. Further read Disclaimer.
