The T3 Financial Crime Unit, the anti-crime alliance Tron, Tether and TRM Labs launched in September 2024, was disbanded in late August 2026. Bloomberg reported the shutdown on 4 November, citing people familiar with the matter who blamed slow response times and poor coordination among members. Nobody announced it at the time. The news came out more than two months later, a week after Tether froze more than $1.5 billion in USDT tied to the Binance hack.
For anyone holding USDT on TRON, the practical question is narrow: does the end of T3 change who can freeze your tokens, or how fast? Short answer: no. The freeze power was never T3’s. It sits in Tether’s TRC-20 contract, and that contract hasn’t changed.
What the T3 Financial Crime Unit actually did
T3 FCU was a coordination layer, not a new technology. TRM Labs brought blockchain analytics, Tron brought network expertise, and Tether’s investigations team brought the one thing that mattered on-chain: the authority to blacklist USDT addresses. Law enforcement agencies sent cases in. The unit traced the funds and pushed them to Tether for a freeze.
Its reported results grew quickly:
| Date | Reported cumulative freezes | Source |
|---|---|---|
| 2025 (Binance joins the expanded T3+ programme) | More than $250 million | Binance, as cited in Bloomberg coverage |
| 14 May 2026 | More than $450 million, across 23 jurisdictions | Tether press release |
Coverage of the shutdown doesn’t agree on the final number. Several outlets that rewrote the Bloomberg story led with “$250 million”, which is the figure from when Binance joined. Tether’s own May 2026 release says over $450 million, with the US, Spain, Germany, the Netherlands and Bulgaria leading by blacklisted volume. The later, first-party figure is the more reliable one. Neither tells you how much was frozen between May and the August shutdown, and no member has published a final tally.
Tether’s May release also credited the unit with a 43.9% year-on-year rise in illicit proceeds intercepted in 2025. It cited Brazil’s Operation Lusocoin as one case, where 4.3 million USDT was frozen as part of more than R$3 billion in seized crypto assets.
The freeze button lives in the USDT contract, not in an alliance
We checked this directly. On 5 November 2026 we pulled the ABI of the USDT contract on TRON (TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t, contract name TetherToken) from TronGrid’s getcontract endpoint. It still exposes the same blacklist functions it always has:
addBlackList/removeBlackList: the owner adds or removes an address. A blacklisted address can’t send USDT.isBlackListed/getBlackListStatus: a public read anyone can call to check an address.destroyBlackFunds: the owner can burn the USDT balance of a blacklisted address. Tether uses this before reissuing funds to victims.- Events
AddedBlackList,RemovedBlackListandDestroyedBlackFunds, which make every action visible on-chain.
Only the contract owner, Tether, can call the write functions. TRM Labs couldn’t call them. The TRON DAO couldn’t call them either. Disbanding T3 removed a shared case-handling process. It didn’t remove anyone’s on-chain power, because no other member ever had any.
The other half of the mechanism matters just as much. A USDT blacklist is enforced at the token level. TRON itself doesn’t censor. A blacklisted address can still send TRX, stake it, vote and pay for energy. It just can’t move its USDT. That’s why attackers convert stablecoins into native TRX as fast as they can.
The Binance hack: a freeze test after T3 was gone
The timing is the most useful part of this story. By the time of the October 29 Binance hack, the alliance had already been gone for two months. Tether CEO Paolo Ardoino said the company froze more than $1.567 billion in USDT tied to the attack. Early reports that day put the first freeze at about $971 million before it grew.
So one of Tether’s largest freeze responses happened with no T3 in place. That fits the “coordination problems” explanation: the work that mattered could already happen without the alliance. Where the freeze failed, the gap was speed, not structure. On TRON, the attacker swapped 234 million USDT into TRX on SunSwap before a freeze landed. We cover that in our breakdown of why the Binance hacker swapped USDT for TRX.
After the shutdown news, Tether said it would keep working with TRM Labs to disrupt illicit fund flows. Some coverage reported that Tron confirmed the initiative had ended. No public replacement alliance has been announced as of 5 November 2026.
Check an address before you accept USDT from it
Freezes don’t target you just for holding USDT. They do hit funds that pass through a hack-linked or sanctioned address. If you take a large payment from an address that gets blacklisted later, your own address isn’t automatically blacklisted. If you take one from an address that already is, the transfer simply fails. The real risk is being the next hop in a chain an investigator later flags. That can bring account reviews at the exchange you deposit to.
A practical routine for merchants, OTC desks and anyone who takes large TRC-20 payments:
1. Check the sender before you agree a deal. Call isBlackListed on the USDT contract through Tronscan’s “Read Contract” tab, or use the steps in our guide to checking whether a USDT address is blacklisted on TRON. 2. Look one hop back. A fresh address funded minutes ago by a large swap is a stronger warning sign than a blacklist flag, which may not exist yet. 3. Don’t route funds through an address you know is flagged. On the TRON chain, an earlier freeze shows how quickly a cluster can be blacklisted: the $130 million Iran-linked USDT action. 4. Keep the transfer cost predictable. At the current 100 sun per energy, a standard USDT transfer needs about 64,285 energy, or about 6.4 TRX if burned. Sending to an address that has never held USDT needs about 130,285. Our post on what it costs to send USDT TRC-20 shows the breakdown. If you send often, renting energy on the TronSave energy market cuts that cost by up to 80%.
What we couldn’t confirm
Bloomberg’s report relies on unnamed sources. We couldn’t read the original behind its paywall, so the details above come from outlets that summarised it. No member has given an official reason for ending the alliance. None has given a final cumulative freeze figure or said whether the participating law enforcement agencies were told in August. We also can’t say whether Tether’s response times on TRON have changed since then. Tether publishes no per-chain freeze latency, and the Binance numbers mix Ethereum and TRON. If a member publishes a post-mortem, the figures above could change.
FAQ
What was the T3 Financial Crime Unit?
It was an alliance formed in September 2024 by Tron, Tether and TRM Labs to track illicit USDT, mainly on TRON, and help law enforcement freeze it. Binance later joined an expanded T3+ programme. It reported freezing more than $450 million by May 2026.
Why was T3 FCU disbanded?
Bloomberg’s sources said slow response times and poor coordination among members led to the shutdown in late August 2026. None of the members has published an official reason.
Can Tether still freeze USDT on TRON?
Yes. The blacklist functions sit in the USDT TRC-20 contract and only Tether can call them. We confirmed they’re still present on 5 November 2026. Tether froze more than $1.567 billion tied to the Binance hack after T3 had ended.
Does a USDT freeze stop me from using TRX?
No. A blacklist blocks USDT transfers from that address only. TRX transfers, staking, voting and energy use keep working as normal, because TRON’s base layer doesn’t take part in the freeze.
