Tron, Tether and Chainalysis launch task force to target illicit USDT

What happened

Tron, Tether and Chainalysis announced on Thursday, Nov. 12, 2026, that they have formed the Digital Crime Task Force, a private-sector initiative aimed at criminal activity involving Tether's USDT stablecoin on the Tron blockchain. The three organizations said the effort combines blockchain surveillance, investigative support and cooperation with law enforcement. The announcement was shared with Cointelegraph and Bitcoin.com News.

Chainalysis will contribute blockchain intelligence and AI-assisted tools to help flag suspicious transfers and develop leads for authorities, according to the announcements. The task force will accept tips and asset-freeze requests directly from law enforcement and says it wants to identify criminal networks and cut off funds before they can be moved elsewhere. Its stated priorities include investment and romance scams, crypto theft, terrorist financing, North Korean cyber operations, drug trafficking and cartel money laundering.

Tron founder Justin Sun framed the initiative as a user-protection measure, saying millions of people depend on USDT on Tron for their families and businesses. Tether CEO Paolo Ardoino said criminals are using AI to move faster and that waiting for a victim to report a crime is no longer sufficient. Ardoino also said Tether has frozen more than $7 billion tied to illicit activity while working with more than 360 law enforcement agencies in 73 countries.

Why it matters

USDT on Tron is not a niche corner of the stablecoin market. Bitcoin.com News reported that Tron had more than $94 billion in circulating USDT as of November, giving the network a large role in dollar-denominated transfers. A task force that can shorten the period between spotting suspicious flows and freezing them could matter in cases where stolen or scam-related funds are rapidly converted and moved. The reports also stress that the initiative's value will depend on whether intelligence leads to timely intervention rather than after-the-fact documentation.

What the data shows

Chainalysis reported that AI-enabled scam operations were 4.5 times more profitable than conventional operations in 2025, and that impersonation scams rose more than 1,400% year over year, according to Bitcoin.com News.

TRM Labs found that USDT on Tron represented 99.9% of the $1.07 billion in crypto received by 34 casinos in Sihanoukville, Cambodia, between Jan. 1 and Sept. 7. Casinos tied to US-sanctioned networks received $687 million of that total. TRM Labs attributed the heavy use of Tron-based USDT in the region to low fees and deep liquidity.

Background

Tron and Tether previously set up the T3 Financial Crime Unit with TRM Labs in 2024. Bloomberg reported on Nov. 4 that the unit disbanded in late August; an unnamed source cited by the outlet pointed to slow responses and poor coordination. Cointelegraph said it contacted Tether, Tron and TRM Labs for comment and received no response by publication time. The new task force involves Chainalysis rather than TRM Labs, but the reports do not state whether it is intended as a direct replacement.

The announcement comes as Tron-based USDT has repeatedly appeared in major crypto crime cases. Elliptic said funds from the $1.5 billion Bybit hack in February 2025 were converted to USDT on Tron and cashed out through suspected Chinese over-the-counter services. In the record $6.3 billion Binance hack on Oct. 29, Crystal Intelligence said hackers swapped about $234 million in USDT for TRX before Tether froze the remaining USDT in two wallets tied to the theft. The FBI attributed both hacks to North Korea, while Kim Yo Jong rejected the Binance attribution in remarks published by North Korean state media on Nov. 3, according to Cointelegraph.

What to watch

Key tests will be whether the task force produces timely freezes rather than post-hoc records, and whether it publishes evidence that its Chainalysis-backed tools shorten investigations. Bitcoin.com News noted that the announcement provided no specific operational deadlines or independently demonstrated results. The reports also leave open whether the DCTF is a direct successor to the disbanded T3 unit, and how it will handle attribution disputes such as the North Korea-linked hack claims.

Questions readers ask