Tether and Tron Quietly Shut Down T3 Crime Unit Two Months Before $6.3 Billion Binance Hack
Key Takeaways
- •The T3 Financial Crime Unit, formed by Tron, Tether and TRM Labs in September 2024 and expanded to include Binance via the T3+ program, was terminated in late August without any public announcement from its members.
- •People familiar with the matter attributed the alliance's collapse over the past year to slow response times and a lack of coordination among its members.
- •During its operation, T3 froze more than $450 million in illicit assets and cooperated with law enforcement in 23 jurisdictions across five continents.
- •The shutdown came roughly two months before Binance's $6.34 billion hack on Oct. 29, which has been linked to North Korea, with about $220 million in stolen TRX laundered through the Tron blockchain according to Elliptic.
- •Tron plans to reveal a replacement anti-crime initiative, while Tether continues working with TRM through the Beacon Network and is developing the FASE Foundation unveiled by CEO Paolo Ardoino.

The T3 Financial Crime Unit — the anti-crime alliance formed by Tron, Tether and TRM Labs in 2024 and later expanded to include Binance — quietly shut down in late August, Bloomberg reported on Wednesday, roughly two months before the record Binance hack.
The alliance unraveled over the past year amid slow response times and a lack of coordination among its members, according to people familiar with the matter. One of them said T3 was terminated in late August. None of the companies announced the shutdown at the time. Tron, Tether and TRM confirmed that the initiative had wound down, without commenting on the details of the report. Binance declined to comment.
"While the very successful T3 program has concluded, Tron remains committed to working to help stop illicit activities on the blockchain, in partnership with law enforcement," a Tron DAO spokesperson told Bloomberg. The spokesperson said Tron will share details of a new anti-crime initiative later.
A Tether spokesperson said the company will keep working with TRM to disrupt illicit funds and has been taking part in Beacon Network, a real-time intelligence-sharing network TRM launched in August 2025. Tether is also working on the Financial Access and Systemic Empowerment Foundation, or FASE Foundation, which CEO Paolo Ardoino unveiled on X on Oct. 31.
Ari Redbord, TRM's global head of policy and government affairs, said "T3 achieved extraordinary things" and that "Beacon Network builds on that work."
What T3 was built to do
Tron, Tether and TRM set up T3 in September 2024 as a public-private unit aimed at illicit use of Tether's USDT stablecoin on the Tron blockchain. The pitch was speed: TRM supplied blockchain intelligence, Tron supplied network visibility, and Tether supplied the power to freeze tokens at the issuer level.
The unit said in August 2025 that it had frozen more than $250 million in illicit assets in less than a year. At the same time, it launched T3+, a program for outside partners, with Binance as its first member. Its first joint effort with the exchange froze almost $6 million tied to a pig-butchering scam.
The totals kept climbing. TRM put the T3 tally above $300 million in February, when it announced a $70 million Series C funding round. In May, the unit announced that it had frozen more than $450 million and was working with authorities in 23 jurisdictions on five continents, including the U.S., Spain, Germany, Brazil and the U.K.
That May release also said the unit had frozen funds within 24 hours of law enforcement requests in account takeover and violent crime emergencies. It made no mention of the coordination problems Bloomberg has now described. TRM also wrote that the Financial Action Task Force, the intergovernmental watchdog that sets global anti-money-laundering standards, cited T3 in November 2025 guidance as a leading model for public-private enforcement work.
A crime unit gone before the Binance hack
The timing matters because the shutdown predates the largest theft in crypto history. Binance put its Oct. 29 loss at $6.34 billion, and blockchain analysis firms have linked the attack to North Korea.
Tron has been a main laundering route. Most of the laundering so far — about $220 million in stolen TRX, the network's native token — has run through the Tron blockchain, blockchain analytics firm Elliptic said in an update Thursday.
The industry still froze a large share of the haul without T3 in place. Tether alone said it froze more than $1.567 billion in USDT after the attack, and roughly $2.85 billion of the stolen assets has been frozen or seized, CNBC reported, citing Elliptic.
The power to freeze USDT sits with Tether, not with the alliance. What T3 offered was a single channel for police in 23 jurisdictions to reach the issuer, the chain and an analytics firm at once. Whether Tron's promised replacement brings that structure back, and who else joins it, remains open.
This article first appeared on Bitcoin Magazine and was written by Micah Zimmerman.