Tron, Tether and Chainalysis launch Digital Crime Task Force after T3 unit folds

Tron, Tether and blockchain analytics firm Chainalysis announced a new task force on Thursday to identify and disrupt illicit activity involving USDT on the Tron blockchain, filling the gap left by the quietly disbanded T3 Financial Crime Unit.

The Digital Crime Task Force will deploy Chainalysis data and artificial intelligence tools to flag suspicious transfers and hand law enforcement actionable leads to trace and freeze funds faster, according to an announcement shared with Cointelegraph. The arrangement replaces the enforcement architecture Tron and Tether built in 2024, which collapsed without public notice.

Bloomberg reported on Nov. 4 that the T3 Financial Crime Unit, which Tron and Tether formed with TRM Labs in 2024, disbanded in late August. An unnamed source cited by the outlet attributed the unit's failure to slow responses and poor coordination. Cointelegraph contacted Tether, Tron and TRM Labs for comment and had received no responses by publication time.

What does the new task force change for practitioners?

The operational difference lies in speed and tooling. Rather than waiting for victim complaints, the task force aims to surface suspicious USDT flows on Tron proactively and convert them into enforcement leads — shortening the window between detection and freezing. Tether CEO Paolo Ardoino framed the urgency in direct terms.

"Criminals are using AI to move faster than ever, and waiting for a victim to report a crime is no longer good enough," Ardoino said in the announcement. He put Tether's cumulative USDT freezes at more than $7 billion — a figure that anchors the issuer's enforcement record and signals the freeze mechanism the new unit will lean on.

The task force's stated priorities include:

• Investment and romance scams
• Crypto theft
• Terrorist financing
• North Korean cyber operations
• Cartel money laundering

Why USDT on Tron draws enforcement attention

The scale of illicit flows through the network explains the focus. TRM Labs reported that USDT on Tron accounted for 99.9% of the $1.07 billion in crypto received by 34 casinos in Sihanoukville — a Cambodian city known as a hub for scam compounds — between Jan. 1 and Sept. 7. Put differently, virtually every dollar of crypto reaching those venues arrived as dollar-pegged tokens on Tron. Casinos tied to US-sanctioned networks received $687 million of those inflows. TRM Labs cited low fees and deep liquidity as the reasons USDT on Tron dominates in the region.

The chain has also served as a cash-out rail in the year's largest thefts. After the $1.5 billion Bybit hack in February 2025, stolen funds were converted to USDT on Tron and cashed out through suspected Chinese over-the-counter trading services, according to blockchain intelligence firm Elliptic.

The pattern repeated during the record $6.3 billion Binance hack on Oct. 29. Hackers swapped approximately $234 million in USDT for Tron's native token TRX before Tether froze the remaining USDT in two wallets linked to the theft, according to Crystal Intelligence. Roughly one in every 27 stolen dollars moved through that single swap route before the freeze took effect.

The US Federal Bureau of Investigation attributed both hacks to North Korea. In a statement published by North Korean state media on Nov. 3, Kim Yo Jong rejected the Binance attribution and cited Bybit as another case in which she said Washington tried to blame Pyongyang.

For compliance teams and investigators, the task force's arrival resets the contact point for Tron-related USDT cases after months of institutional drift. Its credibility will be measurable in one concrete metric: how quickly suspicious funds move from detection to frozen wallets under the new Chainalysis-powered workflow.