A recent investigation has highlighted a critical security weakness that could allow malicious actors to seize control of an astonishing $91 billion worth of USDT, the leading stablecoin pegged to the U.S. dollar. The study, conducted by a prominent rating agency, points to a specific two‑key breach scenario that, if exploited, would give hackers the ability to manipulate the token’s underlying smart contracts and, consequently, the massive pool of assets they back.
The analysis begins by explaining the architecture of USDT’s issuance and custody. USDT is issued by a consortium of entities that promise each token is fully backed by reserves held in traditional bank accounts, money‑market funds, or other liquid assets. To maintain confidence, the consortium periodically publishes attestations of these reserves, and independent auditors verify the figures.
Simultaneously, the token exists on multiple blockchain networks—Ethereum, Tron, Solana, and others—where its smart contracts govern minting, burning, and transfer functions. The dual nature of USDT—off‑chain financial backing paired with on‑chain code—creates a unique attack surface. The rating agency’s new evaluation framework blends two traditionally separate disciplines: conventional financial auditing, which scrutinizes the integrity of the off‑chain reserves, and Web3 code review, which probes the on‑chain smart contracts for vulnerabilities.
By applying both lenses, the agency uncovered a specific flaw involving the management of cryptographic keys that control the minting process. In the current design, two distinct private keys are required to authorize the creation of new USDT tokens: one held by the primary custodian and another held by a secondary, often offshore, entity. This two‑key system is intended to provide a check‑and‑balance, ensuring that no single party can unilaterally mint tokens.
However, the investigators discovered that the separation of duties is not as robust as it appears. The two keys are stored in environments that share common security controls, such as the same hardware security module (HSM) provider or the same cloud‑based key management service. If an attacker compromises the shared infrastructure—through a supply‑chain attack, insider threat, or a sophisticated phishing campaign—they could obtain both keys simultaneously. With both keys in hand, the attacker would be able to invoke the mint function on the USDT smart contract, effectively generating unlimited new tokens that are indistinguishable from legitimate ones.
The ramifications of such a breach are staggering. Because USDT is widely used as a stable store of value across decentralized finance (DeFi) platforms, exchanges, and payment processors, a sudden influx of counterfeit tokens could flood the market, causing a loss of confidence in the stablecoin’s peg. Traders might rush to sell, triggering a cascade of liquidations and potentially destabilizing broader crypto markets.
Moreover, entities that rely on USDT for cross‑border payments could suffer financial losses, and regulators might be forced to intervene, imposing stricter oversight on stablecoin issuers. To put the scale into perspective, $91 billion represents roughly 30 % of the total market capitalization of all stablecoins combined. If an attacker were to mint even a fraction of that amount, the impact would be felt across multiple blockchain ecosystems.
Liquidity pools on automated market makers (AMMs) would become imbalanced, oracle price feeds could be corrupted, and decentralized lending platforms might see a surge in default rates as borrowers’ collateral values plummet. The report does not claim that a breach has already occurred; rather, it warns that the existing key management practices are insufficient to mitigate this specific threat.
The agency recommends several remedial actions. First, the custodial entities should adopt a true multi‑party computation (MPC) approach, where the private key is never reconstructed in a single location. Instead, each participant holds a cryptographic share, and the minting operation requires a threshold of shares to be combined in a secure, distributed manner. Second, the storage environments for the two keys should be fully isolated, employing different HSM vendors, geographic regions, and access‑control policies to reduce the likelihood of a single point of failure.
Third, regular penetration testing and red‑team exercises focused on key‑management workflows should become a mandatory part of the issuer’s security program. In addition to technical safeguards, the agency emphasizes the importance of transparent governance. Stakeholders—including token holders, exchanges, and regulators—should be kept informed about the steps taken to address the vulnerability.
Periodic public audits that cover both the reserve attestations and the on‑chain contract code can help rebuild trust if confidence has been shaken. The broader implication of this finding extends beyond USDT. Many other stablecoins and tokenized assets rely on similar dual‑key or multi‑key structures to control supply.
The methodology employed by the rating agency could serve as a template for evaluating the security posture of these assets, encouraging the industry to adopt more rigorous, cross‑disciplinary assessment frameworks. In conclusion, the discovery of a potential two‑key breach highlights a critical intersection between traditional finance risk management and emerging blockchain security practices. By integrating Wall Street‑style audits with thorough Web3 code reviews, the rating agency has uncovered a vulnerability that could, if left unaddressed, hand control of $91 billion in USDT to malicious actors.
Implementing the recommended safeguards—such as MPC‑based key management, strict environment isolation, and enhanced governance—will be essential to protect the stability of the stablecoin ecosystem and maintain confidence among users worldwide.