What happened
On November 19, 2017, an external attacker removed $30,950,010 in USDT from Tether's treasury wallet. Tether said no customer funds were stolen and that it would not redeem the identified tokens. The issuer later added a mechanism to freeze or blacklist them.
Technical root cause
Unauthorized control of the Tether treasury hot wallet allowed issuance-held USDT to be transferred; the exact credential or infrastructure failure was not publicly detailed. Tokens being frozen or invalidated is a ledger-control response, not a cash recovery event.
How it happened
- An external attacker removed USDT from Tether's treasury wallet.
- The tokens were sent to an unauthorized Bitcoin address.
- Tether told integrators not to redeem the identified tokens.
- Tether later enabled freezing and blacklisting to prevent circulation; that was containment and token invalidation, not proof of equivalent cash recovery.
Protocol details
Classification
Stablecoin / Key Compromise
Protocol Type
Stablecoin Issuer
Protocol links
Website
@Tether_to
Evidence
- report Report coindesk.com
- analysis DeFiLlama defillama.com
- analysis Tether: Update on security incident tether.io
- analysis Tether: Critical announcement tether.to
- analysis Tether: Wallet service and platform update tether.io
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
