USDD on TRON: $8.4 billion went USDT → USDD → USDT within two days in 2026, and $621 million of it came from wallets Tether froze, darknet guarantors or hacks

USDD has a peg-stability module on TRON, TSUYvQ5tdd3DijCD1uGunGLpftHuSZ12sQ, built like MakerDAO’s. A user sends USDT through the USDD router TBXW4hS5KYjjbJXDpnrPf4zhkLwrpUjbyz; the USDT goes to the module and the same amount of USDD is minted from the TRON zero address to the user. To go back, the user sends USDD to the router, it is burned, and the module pays the same amount of USDT back in the same transaction. We checked every swap of 2026: 67,788 swaps in and 73,265 swaps out, all exactly one to one, no fee.

This is ordinary infrastructure. Decentralised exchanges route through it all the time: half of the volume comes from routers such as SUN.io and a Uniswap-style universal router. The point is narrower. While money sits in USDD, Tether’s freeze does not reach it, and after the round trip the USDT comes out of the module’s own balance, not from the wallet that sent it in. For anyone following stolen USDT, the trail jumps.

On 9 October 2026 the thief behind the Ledger/CryptoBilis wallet drains swapped stolen USDT into USDD after Tether froze about $10 million, according to Bitquery’s analysis reported by The Defiant, Crypto Briefing and others; Hacken was quoted saying that Tether’s freeze controls do not apply to USDD. Reported sizes differ: four swaps of 500,000 USDT through the module in six minutes, and up to 14.7 million USDT in total across routes. We traced that case ourselves on our Ledger/CryptoBilis page.

What has not been published is how often this happens. That is what we counted.

From 1 January to 22 October 2026, 12,985 million USDT went into the module in 67,788 swaps from 11,971 senders, and 13,094 million came out in 73,265 redemptions. Every month between 974 million and 1.7 billion dollars passed through; July was the busiest month.

We call a round trip a swap in that is redeemed back to USDT by the same holder within 48 hours, or after one hop to another wallet. 8,425 million dollars did that: 64% of everything redeemed this year. The median time inside USDD was 21.7 hours. In 95% of the direct cases the USDT went straight back to the wallet that sent it in. Half of the round-trip volume comes from DEX routers and other services, which we do not treat as risky.

For each round trip we looked at where the USDT came from in the seven days before the swap (sources of 100,000 USDT or more, which covers 99% of the volume) and where the USDT went after it, and checked those wallets against Tether’s blacklist and our database.

621 million dollars, 7.4% of round-trip volume, has at least one risk link (counted once):

- 462 million (5.5%) came from wallets that Tether blacklisted, but only after the money had moved on. This is the case the module is useful for: the USDT left before the freeze.

- 221 million (2.6%) came from counterparties of Xinbi Guarantee, the Telegram market sanctioned for laundering scam proceeds (see our Xinbi page).

- About 270 million (3.2%) was sent by, came from, or was paid out to wallets labelled as hacks.

This is a floor. Smaller sources were not screened, and we follow only one intermediate hop.

On 13 September 2026 a wallet labelled in our database as the recipient of a TRON private-key drain, TVy6f1JreuuKB6vRz1mHG9aPZauqTWvMx1, sent 198,976.31 USDT (tx 1158c625…7df6) to a busy unlabelled wallet. On 19 September that wallet swapped into USDD and redeemed 3.53 million USDD about 36 seconds after the mint, paying the output to TGNVVdmgSZVin5dKonh1gkysU4DSXhxL2c, which redeemed 3.13 million USDD about 30 seconds later and paid TVudQHxApaszzGu1JsL7yeV5VFqZBMkpnD, also labelled as part of the drain. TGNVVdmgSZVin5dKonh1gkysU4DSXhxL2c alone ran 64 million dollars of round trips through the module this year.

On 22 October one unlabelled wallet with 188.6 million dollars of round trips this year held 1.33 million USDD. Two hops upstream it received 600,000 USDT from a wallet that Tether froze on 1 October and about 1.6 million from Xinbi counterparties. Its volume looks like an OTC desk or a payment service, not a single thief, so we do not name it here; it is on our watchlist.

The same route appears in our own cases. After the Aztec Connect exploiter’s deposits into Tornado Cash on 19 October, wallets that took 100 ETH lots out of the pool swapped them to USDT, bridged to TRON and made exactly this round trip within hours (see Tornado Cash in 2026).

For compliance teams: a USDT deposit that went through USDD within the last few days is not a warning sign by itself — most of the volume is routers and arbitrage. It becomes one when the USDT that went in came from a wallet that was frozen or flagged soon after. That check takes one look at the swap’s sources, and it is the one that catches money that left before a freeze.

For us: we are adding the round trip as a signal to our risk scoring. Wallets that receive USDT from a flagged source and send it through USDD within hours are what we mark for review.

To check an address yourself, use the address check.

It does not say that USDD, its stability module, SUN.io, the routers or the users of the module did anything wrong: most of the volume is ordinary trading. It names only wallets that already carry a risk label in our database, and it does not claim that any unlabelled wallet is a thief. The Ledger/CryptoBilis USDD swaps were reported first by Bitquery and the outlets cited; the 2026-wide counts, the round-trip share and the risk breakdown are ours, read on 22 October 2026.