T3 Crime Unit Ended in August, Before Binance’s $6.34 Billion Theft

T3’s shutdown preceded Binance’s record theft

The T3 Financial Crime Unit, an initiative involving Tron, Tether and blockchain analytics firm TRM Labs, ended in late August 2025, according to people cited in a Bloomberg report. Its closure was not publicly announced at the time. The shutdown came about two months before Binance disclosed a $6.34 billion loss from a theft on Oct. 29, making the timing notable without establishing that T3’s closure affected the attack or the later response.

T3 began in September 2024 as a public-private effort focused on illicit use of Tether’s USDT stablecoin on the Tron blockchain. Its design linked three capabilities: TRM supplied blockchain intelligence, Tron offered visibility into its network, and Tether could freeze tokens at the issuer level. The model therefore brought together investigation, network information and the ability to restrict USDT, rather than giving one partner all of those functions.

The alliance framed speed as a central purpose. By creating a common channel between a blockchain analytics firm, a network and a stablecoin issuer, it aimed to help respond to law-enforcement requests involving suspected illicit funds. In August 2025, T3 introduced T3+, a program for outside partners, and named Binance as its first member. The companies’ subsequent public descriptions of the unit emphasized enforcement work, while the reported coordination difficulties were not disclosed in those announcements.

A joint model for tracing and freezing USDT

T3 reported in August 2025 that it had frozen more than $250 million in illicit assets in less than a year. Its initial joint effort with Binance involved freezing almost $6 million connected to a pig-butchering scam, according to the source. Those figures show that the partnership had moved beyond its founding announcement to specific asset-freezing actions, though they do not indicate how much activity was attributable to each participant or how the unit measured its overall effectiveness.

The publicly reported total rose after the August update. TRM put T3’s frozen-asset tally above $300 million in February, when it announced a $70 million Series C funding round. In May, T3 said it had frozen more than $450 million and was working with authorities in 23 jurisdictions across five continents. The release named the United States, Spain, Germany, Brazil and the United Kingdom among those jurisdictions, and reported rapid action in some cases.

The May statement said T3 had frozen funds within 24 hours of law-enforcement requests involving account takeovers and violent-crime emergencies. In November 2025 guidance, the Financial Action Task Force cited T3 as a leading public-private enforcement model, according to TRM. These public milestones sit alongside the later account of a late-August closure. The source does not explain the timing of the November reference or how the cited guidance treated a unit that had already wound down.

Reported coordination problems and the wind-down

Bloomberg’s report attributed T3’s breakdown over the preceding year to slow responses and insufficient coordination among its members, citing people familiar with the matter. One source said the unit was terminated in late August. Tron, Tether and TRM confirmed that the initiative had wound down but did not address the reported reasons, while Binance declined to comment. The available statements therefore confirm the closure but leave its internal process and precise causes unclear.

Tron said the program had been successful and that it remained committed to helping law enforcement stop illicit blockchain activity. A Tron DAO spokesperson told Bloomberg that the company would provide details of a new anti-crime initiative later. Tether said it would continue working with TRM to disrupt illicit funds and was participating in TRM’s Beacon Network, described as a real-time intelligence-sharing network launched in August 2025. The source gives no launch date for Tron’s proposed replacement.

TRM’s global head of policy and government affairs, Ari Redbord, said T3 had achieved extraordinary things and described Beacon Network as building on that work. Tether also said it was working on the Financial Access and Systemic Empowerment Foundation, or FASE Foundation, which CEO Paolo Ardoino unveiled on X on Oct. 31. These initiatives indicate continued activity by the companies, but the source does not establish that either recreates T3’s three-party structure or offers the same direct route to freezes.

The Binance theft tests the value of coordination

The closure drew added attention after Binance’s Oct. 29 disclosure that its loss totaled $6.34 billion. Blockchain analysis firms have linked the attack to North Korea, according to the source. The chronology places the theft roughly two months after T3’s reported termination, but timing alone does not show whether the alliance would have changed the theft, the tracing of assets or the actions taken afterward. The source does not describe any T3 involvement in the incident.

The later response nevertheless illustrates the separate roles involved in asset recovery. Elliptic said about $220 million in stolen TRX had so far moved through Tron, which it identified as a major laundering route. Tether said it froze more than $1.567 billion in USDT after the attack. Separately, CNBC reported, citing Elliptic, that roughly $2.85 billion of the stolen assets had been frozen or seized. These are distinct reported figures and should not be treated as interchangeable totals.

Tether, rather than the T3 alliance, holds the ability to freeze USDT at the issuer level, the source explains. T3’s added value was a shared channel through which police in 23 jurisdictions could reach the issuer, the blockchain and an analytics firm together. Whether Tron’s next initiative will restore that kind of arrangement, which organizations will participate and how it will address the reported coordination problems remain open questions. The source provides no details on the replacement’s design.

Source: BitcoinMagazine