THORChain’s Tron USDT freeze.

THORChainOct 9, 2026, 17:02 UTC

THORChain’s Tron USDT freeze

Tether blacklisted four THORChain vaults on Tron, immobilizing roughly 1.45 million USDT. THORChain halted Tron swaps and liquidity-provider operations; the pause was limited to Tron, not global. The Defiant’s report

Resolution

About three hours later, Tether removed the four addresses from its blacklist. The Defiant reported that their USDT balances remained intact and that THORChain restarted Tron trading, deposits, and signing. Chad Barraford first said trading would resume soon, and The Defiant later reported confirmation on-chain. Barraford’s update · The Defiant’s update

What remains unclear

Tether gave no reason for the freeze in the available reporting, and no specific theft was confirmed as its cause. The reports do not name the four vault addresses. The Defiant said 19 other wallets frozen in the same sweep remained blacklisted at publication. The Defiant

The Defiant report · Chad Barraford’s update · The Defiant’s unfreeze update

Ask your own

Case file

THORChain

Answered Oct 9, 2026, 17:02 UTC

Sources 3

Research trace 8

Latest posts of @THORChain
The page thedefiant.io
The page leviathannews.xyz
The page leviathan.news
The supplied reporting and X posts say the four wallets were unfrozen about three hours later and services resumed. These reads check for later updates on operational status, the reason, and whether USDT remained accessible.
The supplied article says all four vaults were removed from the blacklist about three hours after being added, balances remained intact, and Tron services restarted. These reads seek corroborating follow-up details on the restored services and whether the USDT remains accessible.
The existing reports say the four vaults were unfrozen and Tron services resumed. These reads seek the affected addresses and a current on-chain or source-reported balance/status check.
The available reporting and follow-up already establish what happened, the roughly three-hour duration, the released balance, and service resumption. Named vault addresses are not supplied by two independent routes, so that detail is closed.