T3 Crime Unit Collapsed Two Months Before the $6.34B Binance Hack
Tether, Tron, and TRM Labs dissolved the T3 Financial Crime Unit in late August 2026, citing slow response times and poor coordination. Roughly two months later, North Korean hackers hit Binance for $6.34 billion and routed the early laundering through Tron, the network T3 was built to police.
The compliance coalition built to police USDT on Tron was already dead before the hackers arrived.
Key takeaways
- Tether, Tron, and TRM Labs quietly dissolved the T3 Financial Crime Unit in late August 2026, citing slow response times and poor internal coordination, with no public announcement at the time.
- Roughly two months after T3's collapse, North Korean hackers hit Binance for $6.36 billion and used Tron as the primary early laundering route, moving approximately $220 million in stolen TRX through the network T3 was specifically built to police.
- Tether's unilateral freeze power froze $1.567 billion in USDT after the hack without T3 in existence, confirming that the multi-party coalition added coordination overhead but no durable security guarantee the underlying issuer doesn't already hold alone.
Tether, Tron, and TRM Labs dissolved the T3 Financial Crime Unit in late August 2026, first reported by Bloomberg on November 4, with the shutdown attributed to slow response times and a lack of coordination among its members. The dissolution was never publicly announced. The same network T3 was built to police became the primary laundering corridor for the largest crypto theft on record six days before Bloomberg's report ran.
The Binance hack occurred on October 29. According to TRM Labs' attribution report, TRM puts the total at $6.36 billion, while Binance placed its own estimate at approximately $6.3 billion. North Korea's TraderTraitor unit drained wallets across ten blockchains in roughly 20 minutes starting at 20:05 UTC. The haul is approximately four times the $1.5 billion Bybit hack from February 2025.
The Coalition's Record, Then Its Failure
T3 launched in September 2024 with a coherent pitch: TRM supplied blockchain intelligence, Tron supplied network visibility, and Tether supplied the ability to freeze tokens at the issuer level. A single channel for 23 law enforcement jurisdictions across five continents to reach all three at once.
The results were real. T3 announced it had frozen more than $450 million in illicit assets by May 2026, including funds linked to pig-butchering scams, account takeovers, and violent crime cases. Binance joined as a T3+ partner in September 2025. By its own account, T3 could move within 24 hours of a law enforcement request.
Then it fell apart internally. Bloomberg's sources describe the same failure mode that hits every multi-party compliance stack eventually: slow response times, coordination drag, and members pulling in different directions.
The unit dissolved with no press release and no handoff protocol made public.
A Tron DAO spokesperson told Bloomberg: "While the very successful T3 program has concluded, Tron remains committed to working to help stop illicit activities on the blockchain, in partnership with law enforcement." TRM's global head of policy and government affairs, Ari Redbord, said "T3 achieved extraordinary things" and that TRM's Beacon Network, a real-time intelligence-sharing platform launched in August 2025, "builds on that work." Tether said it will keep working with TRM and is involved with Beacon Network, as well as a new initiative called the FASE Foundation, which Tether CEO Paolo Ardoino announced in an October 31 post on X.
What the Timing Reveals
North Korea's hackers did not need T3 to be gone to execute the attack. The $6.36B single point of failure was always Binance's centralized custody model. But T3's absence removed the one structured intake that let police in 23 jurisdictions simultaneously reach Tether, Tron, and an analytics firm in a coordinated window.
What happened instead: the hackers swapped 234 million USDT for TRX on SunSwap before Tether could freeze it, then moved approximately $220 million in stolen TRX through the Tron blockchain in the first 48 hours, according to Elliptic's laundering analysis. Tron, the network T3 was specifically chartered to police, was the first hop.
Tether then froze $1.567 billion in USDT. Elliptic puts the total frozen or seized across the industry at approximately $2.85 billion as of early November. Binance separately confirmed it had replenished 90% of stolen assets using company funds, per NBC News.
The freeze power was always Tether's alone. T3 never held it. What T3 built was the coordination layer connecting that freeze power to law enforcement requests at scale. That layer failed from the inside before the attack landed, and the $234 million in USDT that became TRX before Tether could act is the number that shows the cost.
This is counterparty risk with no asterisk. Users holding assets on centralized exchanges and in custodial stablecoins absorbed an institutional failure they had no visibility into and no way to hedge. Bitcoin held in self-custody carried none of that exposure.
What Comes Next
Tron has promised details on a replacement anti-crime initiative. TRM's Beacon Network is already live. Whether either reconstitutes the multi-jurisdictional coordination channel T3 provided, and whether Binance or other exchanges participate, will determine whether the structural gap T3's collapse left gets closed before the next state-level adversary tests it. The $3 billion-plus in unrecovered funds is the ongoing stress test.
Sources
- TRM Labs: North Korea Steals $6.36 Billion from Binance
- Elliptic: How North Korea Is Laundering the $6.4 Billion Stolen from Binance
- T3 dissolution first reported by Bloomberg, November 4, 2026
Frequently Asked Questions
What was the T3 Financial Crime Unit and why did it shut down?
T3 was a public-private anti-crime coalition founded in September 2024 by Tron, Tether, and TRM Labs, later joined by Binance through the T3+ program. It was designed to freeze illicit USDT on the Tron blockchain and give law enforcement in 23 jurisdictions a single contact point to trigger that freeze quickly. It shut down in late August 2026 due to slow response times and poor coordination among its members, per Bloomberg's reporting, confirmed by Tron, Tether, and TRM.
Did T3's dissolution cause the Binance hack?
No. The hack exploited Binance's centralized custody infrastructure, not anything T3 controlled. But T3's absence meant the structured coordination channel between global law enforcement and the freeze mechanism was already gone when the attack hit. The practical result: hackers converted 234 million USDT to TRX on SunSwap before Tether's unilateral freeze caught up, a window that a functioning T3 intake might have narrowed.
Why did North Korean hackers route stolen funds through Tron?
Tron's low transaction fees, high throughput, and deep USDT liquidity made it the fastest exit before Tether could act. The hackers swapped USDT for TRX on SunSwap, moving the funds out of Tether's freeze reach before the stablecoin issuer could respond. Approximately $220 million in stolen TRX moved through Tron in the first 48 hours, according to Elliptic. The same network T3 was built to police in real time was the most convenient first hop for a state-level actor moving fast.
