Tether finally moves up a notch at Bluechip
The financial improvement is real. Bluechip now assigns USDT a C rating, after keeping the stablecoin in the D category for several years. The change is dated September 3, 2026.
This development directly addresses one of the historic criticisms leveled at Tether. Bref Crypto had once again highlighted the lack of a full financial audit in April. Since then, the company has cleared that hurdle.
On August 13, Tether announced that KPMG U.S. had audited the 2025 financial statements of Tether International S.A. de C.V. and issued an unqualified opinion. According to the company, the audit covered the balance sheet, cash flows, transactions, systems, valuations, counterparties and supporting documentation.
KPMG reportedly even counted and physically inspected every gold bar held by the audited entity. The financial statements show $6.814 billion in reserves above liabilities as of December 31, 2025, according to Tether.
This is no longer a simple one-off attestation of reserves. A full audit examines a much broader set of accounts and controls.
For Tether, this is an important institutional step forward.
But it is not yet a clean bill of health.
The KPMG audit does not address the key-related risk
This is precisely where Bluechip’s analysis takes on a new dimension.
On August 25, Bluechip announced a partnership with Hacken to integrate technical risk into its SMIDGE framework. Until then, stablecoins had mainly been assessed based on their reserves, management, governance and regulatory environment.
Yet a stablecoin can hold $100 in assets for every $100 in tokens and remain vulnerable if its contract allows an attacker to arbitrarily create new tokens.
Hacken is therefore now examining smart contract reliability, supply integrity, administrative keys, bridges, oracles and certain off-chain infrastructure.
USDT is the first major case in which the two perspectives have come into such clear conflict.
Financially, Tether is improving thanks to KPMG.
Technically, Hacken assigns it only 3.3/10. One of the main reasons concerns administration of the USDT contract on Tron, where approximately half of the stablecoin’s supply is located.
The two assessments should therefore not be conflated.
The KPMG audit essentially asks: do the accounts accurately reflect the company’s financial position?
Hacken’s analysis asks a different question: what would happen if the mechanisms used to administer the tokens were compromised?
Two entirely different problems.
Two keys can administer approximately $91 billion in USDT
On Tron, the contract under review operates with a 2-of-3 multisig.
A multisig requires multiple signatures to authorize a sensitive operation. Here, three keys are part of the setup and two signatures are enough to act. This prevents a single key from making decisions alone. Tether publicly presents the multisig as protection against the risk of one person becoming a single point of failure.
Hacken nevertheless considers the threshold insufficient given the powers involved and the amount at stake.
The analysis covers approximately $91.3 billion in USDT on Tron. Bluechip valued USDT’s total market capitalization at $183.4 billion on September 7. That represents practically half of all USDT in circulation.
One clarification is essential: these $91.3 billion are not stored in a wallet controlled by two keys.
Users hold their USDT in their own addresses.
What the multisig controls is administration of the contract that creates and manages USDT on Tron.
The difference is enormous.
A compromise would not directly give a hacker the private keys of millions of users. It could, however, give the attacker sufficiently broad administrative powers to fundamentally alter how the asset operates.
This is precisely the scenario Hacken considers insufficiently compartmentalized.
Minting, freezing and contract ownership are at stake
What do these rights actually allow?
According to Hacken, two compromised keys could be used to change the contract owner, potentially excluding Tether’s legitimate signatories. The attacker would then have access to functions allowing, among other things, the creation of new USDT, the suspension or resumption of certain transfers, the freezing of addresses and changes to certain administrative parameters.
This is still not a currently exploited vulnerability.
Hacken found no evidence of compromised keys and no ongoing incident. The distinction is essential: the study describes what a sufficiently serious compromise could make possible, not something that has occurred.
The problem also stems from the absence of a timelock.
A timelock imposes a delay between the approval of a sensitive administrative decision and its execution. For example, a change could be announced on-chain and only take effect several hours later. The team would then potentially have time to identify an abnormal operation and intervene.
According to Hacken, the Tron deployment under review has neither this built-in delay nor a reliable cancellation mechanism capable of blocking a change once it has been properly signed.
With $100 million, this architecture would already have warranted discussion.
With approximately $91 billion, the scale changes everything.
And Tron is not a secondary network for Tether: at the end of July, Tron Inc. already indicated that it hosted approximately $90.3 billion in TRC-20 USDT, or 47.7% of the supply at the time.
The contract does not check reserves before creating USDT
Hacken highlights a second, less visible point: the contract itself does not know how much Tether actually holds in reserves.
No automatic proof of reserve mechanism links off-chain financial assets to the token-creation process. Nor is there any on-chain cap preventing issuance above a predetermined amount.
Under normal operations, this is not surprising.
When Tether receives funds from an institutional client, the company can authorize the creation of USDT. Some tokens can also be created in advance and held in treasury as “authorized but not issued” before entering circulation. Tether explains that these units are not included in the market capitalization until they are actually issued.
The system therefore relies on Tether’s internal controls and the integrity of its signatories.
This is precisely the operational trust Hacken is measuring.
A hacker who seized administrative rights would not need to deposit $10 billion with Tether to create $10 billion in USDT: the smart contract would not automatically consult a bank ledger before executing the order.
The $6.8 billion financial cushion verified in the 2025 accounts therefore does not correct this risk.
Strong reserves protect against a financial problem.
They cannot prevent a stolen key from signing a transaction.
The same keys appear across multiple networks
The assessment does not stop at Tron.
Hacken says Tether reuses the same six signing keys on Ethereum, Avalanche and Celo. According to the auditor, a compromise of keys used to administer one deployment could therefore have implications beyond the blockchain initially targeted.
This is a classic cybersecurity principle: compartmentalization limits the impact radius of an incident.
If each network has independent secrets, stealing the keys from one environment does not necessarily provide access to the next. Reusing keys, by contrast, concentrates more responsibility in the same elements.
The observation takes on particular significance after a quarter in which key compromises cost far more than conventional smart contract bugs.
According to Hacken’s Q2 2026 security report, $763.9 million was stolen in 67 Web3 incidents. Compromises involving keys, signers or infrastructure accounted for 88.3% of the value lost, while smart contract vulnerabilities, although more numerous, accounted for only around 11%.
Code is therefore not necessarily the most costly weak link anymore.
How privileged keys are created, separated and used is becoming at least as important.
Centralization and vulnerability do not mean the same thing
It would be easy to conclude that the power to freeze or create USDT automatically constitutes a “vulnerability.”
That would be too hasty.
Tether is a centralized issuer. Freezing functions are part of its architecture and allow it, among other things, to act at the request of authorities against certain addresses. The ability to create or burn tokens is also essential to the operation of a stablecoin backed by off-chain reserves.
The risk raised by Hacken lies elsewhere: how many controls must be passed before these powers can be used?
And above all, what happens when they are used illegitimately?
Bluechip currently summarizes the issue by stating that a multisig has minting, freezing and blacklisting capabilities without a preprogrammed limit, and that no deployment has a timelock for privileged actions. The agency also mentions the absence of an on-chain reserve directly linked to the creation process.
This centralization therefore has two sides.
It enables Tether to respond quickly in cases of fraud, sanctions or stolen funds.
It also creates a particularly powerful point of authority that must be secured accordingly.
The debate is not really “centralized or decentralized.”
For USDT, it is instead: is the security surrounding this centralization proportionate to $183 billion in outstanding supply?
Bluechip’s new C rating is still fairly average
The move from D to C should not be interpreted as a general endorsement of Tether either.
On Bluechip’s current table, USDC is rated B+, PYUSD A-, while RLUSD and GUSD receive A ratings. USDT sits at C, alongside FDUSD.
One important caveat is necessary, however: USDC’s B+ is not directly comparable with USDT’s new technical assessment.
Hacken has not yet completed an equivalent analysis of Circle under the new methodology. USDC’s B+ was assigned under Bluechip’s previous framework, before Hacken’s cybersecurity factor was integrated.
Comparing Tether’s 3.3/10 with the absence of an updated technical rating for Circle would therefore produce a misleading conclusion.
Bluechip is still calling for two main changes from Tether before considering a move from C to B-: publish reserve attestations monthly rather than quarterly and specify a transparent and reasonable redemption schedule in its terms.
The C rating therefore recognizes the progress.
At the same time, it retains several financial, operational and governance reservations.
The full audit itself still has a transparency limit
There is also an important detail surrounding the KPMG audit.
Tether publicly announced the unqualified opinion and described the work performed by KPMG. However, the audited financial statements and KPMG’s full report were not published after the announcement.
This does not mean that the audit does not exist.
It simply means that the public cannot directly examine the complete document, its notes, the precise scope adopted or any potential accounting explanations.
Another figure illustrates this limitation. BDO’s December 31, 2025 report showed approximately $6.338 billion in assets above liabilities, while the announcement concerning the KPMG-audited accounts referred to $6.814 billion, a difference of approximately $476 million for the same date.
Accounting methods and scopes may explain the difference. The publicly available documents simply do not make it possible to fully reconcile it.
The audit is therefore a clear improvement over the situation previously described by Bref Crypto in its critical analysis of Tether.
It does not suddenly make every balance-sheet item externally observable.
USDT has become too large to separate finance from cybersecurity
Tether’s size ultimately explains why Bluechip’s new methodology is interesting.
USDT represents approximately $183 billion in circulation and several tens of billions in daily volume. It is used as a trading pair, collateral, a means of payment and a digital dollar in regions where access to a genuine dollar account remains difficult.
This position is particularly visible in Africa. Standard Bank is now preparing a dollar stablecoin with several major banks, precisely in a market where USDT established itself well before traditional financial institutions.
A major weakness at Tether would therefore no longer be a simple incident involving a token.
It would affect infrastructure used by exchanges, protocols, businesses and individuals across numerous markets.
This is also what makes the current outcome unusual: Tether is financially more credible than it was a few months ago while facing greater technical scrutiny at the same time.
There is no contradiction.
KPMG checks the accounts. Hacken examines the architecture. Bluechip is now trying to bring the two together.
And this combination changes how a stablecoin is assessed.
Tether has settled one old question, but not all the others
For years, criticism of Tether almost always revolved around the same question: “Where are the reserves?”
In 2026, that question is becoming insufficient.
A first full financial audit has finally been completed. KPMG issued an unqualified opinion, and Tether reported a reserve surplus of $6.814 billion at the end of 2025. Bluechip recognized this by raising USDT from D to C.
The discussion is now shifting toward the architecture controlling $183 billion in digital money.
Hacken is not claiming that two hackers possess two keys. It is not claiming that $91 billion has been stolen. It found no compromise.
Its conclusion is more measured and probably more useful: on Tron, two properly authorized signatures are enough to exercise extremely broad powers over the contract governing approximately half of the world’s USDT, without an automatic delay allowing time to respond.
For a stablecoin worth a few million dollars, this would already be an architectural choice worth examining.
For Tether, the scale makes the question far more serious.
The banking sector is also moving toward its own stablecoins under increasingly precise reserve, governance and cybersecurity requirements. The United States and the United Kingdom are already seeking to bring their future regulatory frameworks closer together.
Tether won the adoption battle long ago. The KPMG audit now enables it to address some of the financial criticism accumulated over the years.
The Hacken report simply reminds us that for infrastructure of this size, being properly backed by reserves is only half of security. The other half is ensuring that no one can take control of the machine that issues the tokens.
