A Hacken assessment found that about $91.3 billion in USDT on the Tron network, roughly half of circulating supply, is controlled by a contract whose administrative authority can be taken over by anyone holding two signing keys. The contract has no built-in delay, cancellation window or revocation mechanism. Hacken auditors said an attacker could change the contract owner, mint USDT, freeze addresses, destroy frozen balances or collect transfer fees without accessing user wallets. The multisig wallet does not hold user funds but controls the USDT contract’s core powers, including minting, freezing and ownership reassignment. Bluechip recently raised Tether’s corporate rating from D to C after a KPMG audit confirmed reserves exceeded liabilities by $6.8 billion, while Hacken assigned USDT a cybersecurity score of 3.3 out of 10. Hacken found no evidence of leaked keys or security incidents, but warned that reused signing keys could extend administrative risk to Ethereum, Avalanche and Celo.