Today’s Field Note

The interesting item today is not the theft, it is the freeze. Thai plaintiffs who admit involvement in a $61M pig butchering operation are suing Tether for freezing $42.4M USDT, alleging the freeze happened months before any US warrant existed. Set aside the plaintiffs’ nerve. The operational fact is that Tether can and does freeze balances on its own initiative, without a court order, and the timeline is now being argued in open court. This is the counterparty risk baked into every stablecoin position you hold, and it applies equally to funds you consider clean. Separately, the Sality botnet takedown (DOJ plus CrowdStrike, 15,000+ machines across four countries) is a reminder that long-running malware quietly swaps crypto clipboard addresses for years.

Today’s Move

  • Treat large USDT balances as freezable by issuer discretion. Split idle stablecoin holdings across USDC and USDT rather than concentrating, and keep working capital, not savings, on-chain.
  • If you run a treasury or desk, document your fiat-offramp fallback now so a single frozen address does not halt operations.
  • Verify every paste of a destination address character by character. Sality-class clipboard hijackers survive reboots and quietly rewrite addresses.
  • Scan endpoints that touch hot wallets against the Sality IOCs published in the DOJ/CrowdStrike takedown, and reimage anything flagged rather than cleaning in place.
  • If you moved funds through mixers or gray channels, understand that issuer freezes do not require a warrant to precede them.

Resources

  • https://www.coindesk.com/business/2026/09/02/tether-sued-over-usd42-4-million-usdt-freeze-allegedly-made-months-before-u-s-warrant
  • https://cointelegraph.com/news/thai-sue-tether-freezing-61m-pig-butchering-case?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound
  • https://decrypt.co/377156/sality-botnet-dismantled-after-eight-years-of-stealing-bitcoin-and-ethereum
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.