T3 crime unit died before the hack

Tether, Tron and TRM Labs quietly wound down their joint anti-crime unit, T3, in late August. Nobody announced it. Bloomberg surfaced the shutdown this week, two months after a $6.34 billion hack hit Binance and sent laundered funds pouring through the Tron network.

What T3 was supposed to do

T3 launched in September 2024 as a public-private alliance: TRM gave blockchain intelligence, Tron gave network visibility, Tether gave the power to freeze USDT at the issuer level. Binance joined later as the first member of an expansion program called T3+.

The pitch was speed, a single channel so law enforcement in dozens of countries could reach the issuer, the chain and an analytics firm at once instead of filing separate requests to each.

The freeze numbers

The unit's own releases show steady growth right up until it disappeared.

• T3 froze over $250 million in illicit assets in its first year, per its August 2025 announcement.
• TRM put the cumulative total above $300 million by February, alongside a $70 million Series C raise.
• By May, T3 said it had frozen more than $450 million working with authorities in 23 jurisdictions across five continents.
• After the Binance hack, Tether alone froze over $1.567 billion in USDT, and roughly $2.85 billion of stolen assets total has been frozen or seized, per Elliptic data cited by CNBC.
• Elliptic tracked about $220 million in stolen TRX laundered through Tron, the alliance's home chain, in the days after the hack.

The read

The default framing writes itself: crypto's flagship crime-fighting coalition vanished right before its home chain became the main laundering route for a record theft, so the shutdown looks like the hole that let the money through.

The freeze numbers argue otherwise. Tether froze $1.567 billion in USDT after the hack without T3 running at all, more than three times the entire $450 million T3 had frozen in its best month on record.

The freeze power never lived in the alliance. It lived in Tether's issuer-level blacklist function, which works whether or not a three-party coordination unit exists on top of it.

What T3 supplied was a single intake channel for the 23 jurisdictions that had grown used to routing requests through it. Losing that channel is an operational headache, not the reason billions moved.

The more interesting number is the reason Bloomberg gives for the collapse: slow response times and poor coordination among the three parties themselves. A unit built to speed up freezes reportedly got slow enough internally that the companies let it die quietly rather than fix it in public.

Tron, Tether and TRM are each now building separate replacements. Tether points to TRM's Beacon Network, live since August 2025. Tron says a new initiative is coming, details unannounced. That split is the actual story: three parties that used to share one channel are now running three.

What to watch

• Whether Tron's promised replacement unit launches with named jurisdictions and a published freeze tally, or stays vague past year-end.
• Whether Tether's freeze response time on the next major hack beats or lags the sub-24-hour benchmark T3 claimed in its May release.
• Whether FATF's next public-private enforcement guidance still cites T3 as a model, or drops the reference now that it's defunct.