T3 Financial Crime Unit: A Model for Public-private Disruption in the Age of Stablecoins

Key takeaways

• T3 FCU has frozen more than USD 450 million in illicit USDT since launching in September 2024, intercepting 43.9 percent more illicit proceeds in 2025 than the prior year across 23 jurisdictions on five continents
• The unit combines TRM Labs blockchain intelligence, TRON network visibility, and Tether issuer-level freeze authority to execute asset freezes within 24 hours of law enforcement requests
• Stablecoin issuers hold freeze, burn, and reissue capabilities with no equivalent in traditional finance — the April 2026 freeze of USD 344 million linked to the Central Bank of Iran illustrates what that authority looks like at scale
• FATF cited T3 alongside TRM's Beacon Network in its November 2025 Asset Recovery Guidance as a leading model for public-private partnership in digital asset enforcement

{{horizontal-line}}

Last week, Tether, TRON, and TRM Labs announced that the T3 Financial Crime Unit has frozen more than USD 450 million in illicit crypto assets since launching in September 2024. The unit intercepted 43.9 percent more illicit proceeds in 2025 than the prior year, working with law enforcement across 23 jurisdictions on five continents and executing asset freezes within 24 hours of requests — including during account takeovers, home invasions, kidnappings, and active extortion cases. The Financial Action Task Force has called T3 an "invaluable resource for law enforcement agencies worldwide" and cited it alongside TRM's Beacon Network as a leading model for public-private partnership in digital asset enforcement.

The T3 Model

T3 FCU was built to identify and freeze illicit USDT on the TRON blockchain. A law enforcement agency flags a wallet connected to illicit activity. TRM Labs traces the funds — mapping movement across wallets, chains, and jurisdictions in real time. TRON provides visibility into how those funds are moving across a network carrying more than USD 88 billion in circulating USDT. Tether executes the freeze at the issuer level, stopping movement of funds on-chain. The full sequence — from law enforcement request to frozen wallet — can happen extremely quickly.

Each of the three partners brings something the others cannot provide alone. TRM Labs brings the investigative intelligence — the forensic tracing and transaction analysis that follows funds through complex laundering networks. TRON brings network-level visibility into one of the world's highest-volume stablecoin ecosystems. Tether brings execution authority — the issuer-level ability to freeze an address and stop funds from moving. Intelligence without execution produces reports that arrive too late.

Enforcement actions

In early 2025, T3 supported Spain's Guardia Civil in dismantling a Madrid-based money laundering network, freezing approximately USD 26.4 million in USDT. Operation Lusocoin, a Brazilian Federal Police investigation, froze more than three billion Brazilian reals in crypto holdings — including 4.3 million USDT tied to a criminal network. When the Bybit hack generated connections to TRON, T3 traced and identified nearly USD 9 million in linked assets.

T3 has worked investigations spanning exchange hacks, DPRK-linked cyber operations, terrorist financing, drug trafficking, and wrench attacks — the category of violent physical crime targeting crypto holders, including home invasions, kidnappings, and extortion. Criminals in each of those categories use USDT on TRON for the same reasons: it is fast, liquid, global, and cheap to move. The network properties that make USDT attractive to illicit actors are the same properties that make it an effective enforcement surface. A freeze on TRON is immediate, on-chain, and visible to all parties.

Recognized as global leader

In November 2025, FATF released its Asset Recovery Guidance and Best Practices. According to the guidance, more than 80 percent of jurisdictions are operating at low or moderate levels of effectiveness in asset recovery. The core problem is speed. Traditional cooperation mechanisms — mutual legal assistance, correspondent freezes, sequential court processes — were built for a world where illicit funds moved slowly. Crypto transactions move globally in minutes. By the time a formal request works through the system, the funds are gone.

The 2025 guidance treats asset recovery as an operational objective running in parallel with the investigation, not something that happens after charges are filed. It calls for real-time collaboration between law enforcement, prosecutors, exchanges, fintechs, stablecoin providers, and blockchain intelligence firms that can lawfully act while funds are still reachable. FATF cited T3 and TRM's Beacon Network as concrete examples of how that collaboration can work at operational speed — pointing to T3's work with law enforcement across five continents, including a freeze of nearly USD 6 million linked to a pig-butchering scam. The architecture exists. Other jurisdictions can build it.

Stablecoin issuer freeze authority

Stablecoin issuers hold a set of technical capabilities that have no equivalent in traditional finance. A bank can freeze an account but cannot destroy the underlying funds. A correspondent bank can block a wire but cannot act on another institution's ledger. A stablecoin issuer can freeze an address, burn the tokens in it, and reissue clean value — all on-chain, all verifiable, all without waiting for a court order to pass through an intermediary.

In the largest crypto seizure tied to investment fraud in US history — a USD 225 million forfeiture action in June 2025 built on TRM blockchain intelligence — investigators traced funds through 42 intermediary wallets before identifying the consolidation addresses law enforcement could seize. Freezing and reissuing were all part of the enforcement toolkit.

The April 2026 freeze of USD 344 million in USDT linked to the Central Bank of Iran illustrates what issuer-level freeze authority looks like at scale. OFAC designated two wallets attributed to the Central Bank of Iran, with linkages to the IRGC-Qods Force and Hizballah. Tether coordinated with OFAC and US law enforcement and froze approximately USD 344.2 million across both addresses — the largest on-chain freeze of Iranian sovereign crypto reserves on public record. According to TRM data, the two wallets had received roughly USD 370 million across approximately 1,000 transactions since March 2021, with outbound activity totaling less than 7 percent of inflows. Accumulation concluded largely by late 2023, after which both balances sat dormant — a profile consistent with reserve storage. When OFAC acted, Tether froze the funds. No correspondent bank, no court order working through an intermediary, no delay. The freeze was on-chain and immediate.

The GENIUS Act, signed into law in July 2025, gave these mechanisms statutory grounding. Section 5(a)(2) authorizes the Secretary of the Treasury and the Attorney General, acting jointly, to direct seizure or burning of stablecoins used in significant violations of sanctions law or federal criminal law. Reissuance — the step that returns value to victims — is not yet in statute. The operational capability exists. The legal standardization of the full pipeline, from freeze through restitution, is still being built out.

T3 FCU demonstrates what it looks like when a stablecoin issuer, a blockchain network, and a blockchain intelligence firm build that pipeline together and run it at the speed the threat demands. The USD 450 million is what it has produced in less than two years — and is just the beginning.

{{horizontal-line}}

Frequently asked questions (FAQs)

1. What is the T3 Financial Crime Unit?

T3 FCU is a joint initiative launched in September 2024 by Tether, TRON, and TRM Labs. It functions as a dedicated financial intelligence unit built to identify, trace, and freeze illicit USDT on the TRON blockchain in coordination with law enforcement agencies worldwide.

2. How does T3 execute asset freezes so quickly?

T3 combines TRM Labs' real-time blockchain tracing with TRON network visibility and Tether's issuer-level authority to freeze addresses on-chain. Because Tether is the issuer of USDT, it can freeze a wallet immediately upon receiving a verified law enforcement request — without waiting for a court order to move through intermediary institutions. The full sequence from request to freeze executes within 24 hours.

3. What is the difference between a freeze, a burn, and reissuance?

A freeze stops movement of funds while leaving the tokens on the blockchain — the balance is visible but inoperable. A burn destroys the tokens entirely by sending them to an unrecoverable address, removing them from circulation permanently. Reissuance follows a burn: the stablecoin issuer mints an equivalent amount of new tokens and directs them to government-controlled wallets for asset recovery or to victims for restitution.

4. What did FATF say about T3?

In its November 2025 Asset Recovery Guidance and Best Practices, FATF cited T3 alongside TRM's Beacon Network as a leading example of public-private collaboration operating at the speed required to recover virtual assets. FATF found that more than 80 percent of jurisdictions are operating at low or moderate levels of effectiveness in asset recovery, and identified real-time issuer coordination as a key mechanism for closing that gap.

5. What is the GENIUS Act and how does it relate to stablecoin enforcement?

The GENIUS Act, signed into law in July 2025, established a federal framework for payment stablecoin issuers and codified seizure and burn authority for illicit stablecoins. Section 5(a)(2) authorizes the Secretary of the Treasury and the Attorney General, acting jointly, to direct seizure or burning of stablecoins used in significant violations of sanctions law or federal criminal law. Reissuance — the mechanism that returns value to victims — is not yet defined in statute.