Tron and Tether bring in Chainalysis after T3 crime unit folds

Tron, Tether and Chainalysis announced a task force Thursday to identify and disrupt illicit activity involving USDT (USDT) stablecoin on the Tron blockchain.

The Digital Crime Task Force will use blockchain analytics firm Chainalysis’ data and AI tools to flag suspicious activity and give law enforcement leads to trace and freeze funds, according to an announcement shared with Cointelegraph.

Bloomberg reported on Nov. 4 that the T3 Financial Crime Unit, which Tron and Tether formed with TRM Labs in 2024, disbanded in late August. An unnamed source cited by the outlet said slow responses and poor coordination hampered the unit.

Cointelegraph contacted Tether, Tron and TRM Labs for comment but did not receive responses by publication time.

The task force’s priorities include investment and romance scams, crypto theft, terrorist financing, North Korean cyber operations and cartel money laundering.

“Criminals are using AI to move faster than ever, and waiting for a victim to report a crime is no longer good enough,” Tether CEO Paolo Ardoino said in the announcement. He put Tether’s cumulative USDT freezes at more than $7 billion.

How criminal networks use USDT on Tron

USDT on Tron accounted for 99.9% of the $1.07 billion in crypto received by 34 casinos in Sihanoukville, a Cambodian city known as a hub for scam compounds, from Jan. 1 to Sept. 7, TRM Labs reported.

Casinos tied to US-sanctioned networks received $687 million of those inflows. TRM Labs cited low fees and deep liquidity as reasons for the widespread use of USDT on Tron in the region.

Following the $1.5 billion Bybit hack in February 2025, stolen funds were converted to USDT on Tron and cashed out through suspected Chinese over-the-counter trading services, according to blockchain intelligence company Elliptic.

During the record $6.3 billion Binance hack on Oct. 29, hackers swapped approximately $234 million in USDT for Tron’s native token (TRX) before Tether froze the remaining USDT in two wallets linked to the theft, according to Crystal Intelligence.

The US Federal Bureau of Investigation attributed both hacks to North Korea. In a statement published by North Korean state media on Nov. 3, Kim Yo Jong rejected the Binance attribution and cited Bybit as another case in which she said Washington tried to blame Pyongyang.

*Magazine:* *THORChain founder rejects freeze request, CZ thanks Secret Service: Hodler’s Digest*