Tether froze USDT linked to Multichain’s abnormal bridge outflows

On July 8, 2023, Tether blacklisted two Ethereum addresses holding more than 2.5 million USDT that the Fantom Foundation linked to abnormal outflows from the Multichain cross-chain bridge. The intervention followed Multichain’s suspension of bridge services and expanded an issuer-led response that had already immobilized millions of USDC associated with the same incident.

The development mattered beyond the amount of USDT involved. Multichain was infrastructure for moving representations of assets among otherwise separate blockchains. Its failure exposed the concentration of operational risk inside a service marketed as a bridge between decentralized networks. Tether’s response demonstrated a second form of control: although Ethereum settled the transactions publicly, the stablecoin’s issuer could prevent designated addresses from moving USDT through the token contract.

What the Ethereum record shows

Ethereum transaction 0x372546…17d83 was confirmed in block 17,647,514 at 07:18:35 UTC on July 8. Its receipt contains an `AddedBlackList` event for address 0x48be…44537 from the Ethereum USDT contract. Twelve seconds later, transaction 0x9abf66…98c60 was confirmed in block 17,647,515 and emitted the same event for address 0x9d57…12b68.

Those records verify that two addresses were blacklisted on July 8. Fantom Foundation’s contemporaneous statement identified the addresses as holding more than 2.5 million USDT transferred from Multichain and thanked Tether for acting. Contemporary reporting described the combined balance as approximately 2.53 million USDT. That figure was an address-balance observation, not a cash-loss calculation or an independently audited recovery value.

Blacklisting did not itself reverse the earlier transfers, restore bridge users’ assets or determine who controlled the addresses. It restricted the affected USDT at the token-contract level. Ownership, intent and the cause of the Multichain outflows remained unresolved on July 8.

A broader stablecoin intervention

The USDT action followed Circle’s freezing of three Ethereum addresses holding a reported 63.2 million USDC connected by on-chain analysts to the Multichain outflows. Adding that reported USDC balance to the more-than-2.5-million-USDT balance produces at least $65.7 million in nominal stablecoin units immobilized by the two issuers.

That calculation treats each USDC and USDT unit at its intended one-dollar denomination. It is not a market-price series, realized-loss estimate or statement that every unit could have been redeemed for one dollar under the circumstances. The measurement window covers the address balances reported on July 7 and July 8, after the abnormal movements began on July 6.

Contemporaneous reports estimated that more than $125 million of assorted tokens moved from Multichain-controlled bridge wallets on July 6. That estimate combined different instruments—including stablecoins and wrapped assets—using observed balances and market values. It therefore conveyed the incident’s approximate scale but could not establish a final loss, recovery amount or exploit mechanism.

What was known on July 8

Multichain said assets had moved to an unknown address “abnormally,” advised users to suspend use of its services and revoke contract approvals, and then stopped bridge operations. It warned that transactions would remain stuck on their source chains and gave no confirmed resumption time.

Descriptions of the event as a hack or exploit were still provisional on July 8. The transfers were observable, the service interruption was acknowledged, and the two USDT blacklist events were recorded on Ethereum. The identity of the controller, the authorization path and the condition of Multichain’s internal key-management system were not yet established publicly.

Context published on July 14

On July 14, Multichain said chief executive Zhaojun had been detained by Chinese police on May 21 and that the team had lost access to critical servers and operational funds. It announced that operations would cease. That disclosure clarified the project’s governance failure but was not available for the July 8 assessment and does not retroactively prove who initiated the July 6 transfers.