Binance says it has been running internal, simulated phishing attacks against its own staff for several years—testing how well employees resist social engineering attempts and tying repeat failures to remediation training and performance consequences. The exchange’s chief security officer, Jimmy Su, described the program as a way to measure whether “security hygiene” is improving inside a growing organization.

Su told Cointelegraph that Binance’s internal red team performs phishing simulations on a monthly basis. Employees who fail receive remediation training, while continued poor performance can affect their performance review ratings and, in extreme cases, lead to dismissal.

Key takeaways

• Binance conducts monthly phishing simulations via an internal red team, according to its chief security officer Jimmy Su.
• Failed phishing tests are followed by remediation training, aiming to improve employees’ security habits over time.
• Results can influence performance reviews; repeated failures may lower ratings to the point that employment risk increases.
• Su says Binance has run these simulated attacks for roughly three to four years, with security hygiene improving compared with earlier stages.
• The described tactics reflect broader industry risk: social engineering continues to be a major driver of crypto security incidents.

How Binance tests resistance to social engineering

Binance’s approach centers on realism: the red team acts as an attacker to probe the company’s human layer, not just technical controls. Su said the simulations are designed to show whether employees have become more vigilant over time, adding that the program has been running for about three to four years.

“We do phishing attacks on our own employees on a monthly basis just so we understand if our security hygiene is improving,” Su told Cointelegraph. The goal, he said, is to spot weaknesses early—before malicious actors can exploit them in real incidents.

“The ones that have failed it, we will do remediation training.”

Su also said that early on, security hygiene “left a lot to be desired.” But after continuing the internal testing for a sustained period, Binance has seen meaningful improvement. That long-running cadence matters because human error is rarely solved through a one-time training session; it often requires repeated exposure, feedback, and accountability.

Escalating accountability: training and performance reviews

Binance’s internal program isn’t only about education—it’s also about incentives. Su stated that employees are encouraged to perform well because simulation results are reflected in performance reviews.

“If someone repeatedly fails the phishing-simulation attack, that will negatively impact their rating. That’s the incentive to be vigilant.”

He added that repeated, severe failures could cause a person’s rating to “bottom out,” which could ultimately lead to dismissal. While exact thresholds or timelines were not specified, the direction is clear: Binance treats recurring susceptibility to phishing as a measurable risk rather than a purely training-based issue.

For employees and managers, this changes the information security conversation. Instead of treating phishing defenses as optional training, the simulations become part of how the organization assesses readiness—suggesting a shift toward continuous security evaluation.

The tactics: recruiter lures and Zoom-style schemes

Su described at least one scenario used in the red team’s simulations: the team poses as job recruiters. That reflects a common pattern in real-world phishing—using credible context and urgency to lower an employee’s guard, especially when the target might be inclined to respond to hiring-related messages.

He also referenced well-known social engineering techniques that have circulated widely in the crypto ecosystem, including “Zoom meeting attacks,” in which attackers try to get victims to install malware disguised as a meeting update. These attacks often begin with a lure such as a fake job opportunity, and they can also use other hooks like proposed funding or partnerships.

The Binance description aligns with incidents seen across the sector. Earlier coverage cited by Cointelegraph notes that AMLBot estimated that 65% of crypto security incidents in 2025 were driven by social engineering. Separately, a major hack suffered by Drift Protocol in April was described as following a long-term social engineering campaign.

One example of the “Zoom client” pattern occurred in September 2025, when a major Venus Protocol user reportedly lost around $13 million after a malicious Zoom client compromised their computer and granted an attacker control over their account. Venus paused the protocol and used an emergency governance vote to recover the assets, later returning positions worth $11.4 million to the victim, according to the related Cointelegraph reporting referenced in the original article.

Why internal phishing testing is becoming standard in crypto

Binance’s public discussion of internal simulated phishing comes at a time when social engineering is widely recognized as a persistent—and often underestimated—attack surface in digital-asset businesses. The reason these programs can matter is that even sophisticated security stacks cannot fully prevent compromise if employees can be tricked into revealing access, installing malware, or granting approvals.

Binance is also operating at a scale where human processes can become especially important. The exchange says it has 323 million registered users, and DefiLlama estimates Binance holds $137.7 billion in assets. In environments this large, attackers have strong incentives to focus on the easiest pathway to access—often the human decision layer.

Su indicated that Binance has treated phishing resilience as an ongoing operational discipline rather than a compliance box. He described scenarios that include collecting personal information through seemingly benign interactions, such as offering free conference invites as a way to see how many targets would share details.

That emphasis on varied lures is an important point for investors and operators watching the sector: attackers adapt, and defensive training must adapt too. Simulations that only teach one “shape” of attack can become outdated quickly, while programs that rotate scenarios help test whether employees can recognize patterns rather than memorize scripts.

What readers should watch next is whether other major exchanges and custody platforms adopt similar accountability-driven simulation programs—and, crucially, whether regulators and internal auditors begin to treat phishing resistance testing as a measurable control rather than a general training activity.

Sberbank plans to launch cryptocurrency trading infrastructure and a digital depository by Dec. 1, 2026.

The system will support regulated crypto trading, custody and settlement for eligible customers in Russia.

The project follows the approval of new rules covering crypto exchanges, brokers, banks and digital depositories. Russia will introduce the wider regulatory framework on Sept. 1, 2026, while companies will receive additional time to meet licensing requirements.

Sberbank plans digital custody and off-chain records

According to Interfax, Sberbank’s digital depository will record customers’ cryptocurrency ownership and account for many transactions outside public blockchain networks. The bank will also manage active wallets for deposits, withdrawals and transfers.

Alexander Vedyakhin, Sberbank’s first deputy chairman, said the bank intends to complete the required systems before the December deadline.

“Sber plans to implement the necessary infrastructure and launch the digital depository by Dec. 1, 2026.”

Sberbank has not yet named the cryptocurrencies that its platform will support. The bank has also not disclosed fees, customer eligibility rules or withdrawal limits. These details may depend on supporting regulations that Russian authorities still need to approve.

Under the planned structure, customers could hold recorded crypto rights inside Sberbank’s system. The bank would then use its controlled wallets when customers deposit, withdraw or transfer assets to external addresses.

Russia introduces rules for investors and intermediaries

The Bank of Russia said the new framework will allow qualified and non-qualified investors to purchase cryptocurrencies through regulated intermediaries. However, different limits will apply to each group.

Non-qualified investors must pass a knowledge test before buying eligible cryptocurrencies. They may purchase up to 300,000 rubles of crypto each year through one intermediary. Public access will focus on assets that meet liquidity and market-size standards set by regulators.

Qualified investors must also complete testing, but they will have access to a wider range of assets without the same annual limit. Banks, brokers and asset managers may offer services under their existing licences and added crypto requirements.

Meanwhile, new cryptocurrency exchanges and digital repositories will require separate approval. The Bank of Russia will supervise the market and set standards for custody, accounting and customer protection.

Russia will continue to prohibit cryptocurrency payments for goods and services inside the country. However, companies may use crypto for approved cross-border settlements. Residents may also need to report some foreign crypto holdings and transactions to tax authorities.

The framework takes effect on Sept. 1, 2026. Companies covered by the new rules will have until July 1, 2027 to secure licences and bring their systems into compliance.

Sberbank expands its existing digital asset services

Sberbank has operated in Russia’s regulated digital asset sector since joining the register of information system operators in 2022. The bank has issued digital financial assets and structured products linked to Bitcoin, Ethereum and cryptocurrency baskets.

Ascrypto.news previously reported, Sberbank was preparing a crypto wallet and digital asset depository before the new framework’s launch. The report said the bank could also consider access to foreign crypto exchanges, depending on final regulatory requirements.

Sberbank has also tested cryptocurrency-backed lending. In December 2025, the bank completed a pilot loan with Russian Bitcoin miner Intelion Data. The company pledged mined cryptocurrency as collateral.

Reuters reported that Sberbank later considered offering similar loans to corporate customers. The bank said miners and companies holding digital assets had shown interest in using crypto as collateral.

The bank has also explored cryptocurrency custody services. In July 2025,Reuters reported that Sberbank had submitted proposals to the central bank on storing Russian customers’ crypto assets through regulated banking infrastructure.

Russian financial companies prepare for crypto trading

Other Russian financial institutions are also preparing services under the new framework. According to crypto.news, VTB and T-Bank were developing digital depository services, while Moscow Exchange was considering regulated cryptocurrency operations.

Alfa-Bank has also tested limited crypto services and custody tools. These projects show that large Russian financial groups are positioning their systems around the new rules before the July 2027 licensing deadline.

The regulated market will divide responsibilities among banks, brokers, exchanges and repositories. Brokers may process customer orders, while exchanges provide trading services. Digital repositories will record customer rights and custody arrangements.

Sberbank’s Dec. 1 launch target places its project within the regulatory transition period. Before opening the service, the bank must complete its wallet, trading, accounting and custody systems. It must also publish supported assets, fees and customer access requirements.

Binance’s chief security officer, Jimmy Su, says the exchange is actively testing its own workforce against simulated phishing attempts—and tying repeated failures to employment outcomes. Su told Cointelegraph that the internal “red team” runs phishing exercises on a monthly basis to gauge whether security awareness among staff is improving.

According to Su, employees who fail the exercises aren’t just retrained once. Instead, Binance uses remediation training for those who miss the mark, and persistent, repeat failures can ultimately affect their standing at the company, reflecting the role that social engineering plays in real-world cyber incidents.

Key takeaways

• Binance conducts monthly simulated phishing attacks against employees as part of an ongoing internal security program.
• The simulations are carried out by Binance’s red team, a unit focused on ethical hacking and vulnerability discovery.
• Failed employees receive remediation training, while repeated failures can negatively affect performance reviews and potentially job outcomes.
• Binance says the program has been running for three to four years, with Su describing significant improvements in security hygiene over time.
• The company uses multiple real-world lures—such as fake recruiter outreach and other “information collection” tactics—to test staff resilience.

Why Binance is testing its own staff

Su said Binance runs phishing simulations “just so we understand if our security hygiene is improving,” framing the effort as a practical measurement exercise rather than a theoretical awareness campaign. The red team’s role, as described by Su, is to attempt intrusions and interactions that mirror real attack paths, then feed results back into training.

Binance is often described as a large-scale target in crypto due to its user base and market footprint. Su did not provide additional internal metrics in the interview, but the context underscores the stakes: Binance reports 323 million registered users, while DefiLlama estimates the exchange holds $137.7 billion in assets.

For investors and traders, the takeaway is that big exchanges treat human behavior as part of their threat model. The more a firm relies on operational processes—such as customer support, account access, identity verification, and internal tooling—the more social engineering becomes a risk factor that technical defenses alone can’t fully eliminate.

Social engineering remains a recurring breach pathway

Su’s comments land in the context of broader industry reporting on social engineering as a driver of crypto security incidents. In February, AMLBot estimated that 65% of crypto security incidents in 2025 were driven by social engineering. Later, in April, a long-term social engineering campaign preceded Drift Protocol’s $285 million hack, according to earlier coverage referenced by Cointelegraph.

Su also said the simulated attacks have been in place for three to four years. He suggested that security hygiene has improved substantially since the program began: “In the beginning, the security hygiene left a lot to be desired. But after this amount of time, the company has improved significantly,” he said.

This matters because it highlights a specific operational change: Binance is not treating awareness training as a one-time checkbox, but as an ongoing feedback loop. The key shift for organizations is moving from “teach and forget” to “test, measure, and enforce.”

What the simulations look like: recruiting lures and data-harvesting scenarios

One scenario Binance uses is impersonation of job recruiters. Su said the red team poses as recruiters—an approach that mirrors a common pattern seen in phishing incidents across industries, where “legitimate-sounding” contact becomes the entry point for further manipulation.

Su also described another lure: fake “free conference invites” aimed at collecting personal information and determining how many employees fall for it. He emphasized that the job interview process is only one of multiple scenarios used by Binance’s red team.

These details are important because social engineering attacks in crypto don’t always arrive as obvious “click this link” attempts. They can be structured like legitimate professional outreach, scheduling requests, or follow-ups—channels that can appear normal to staff who might otherwise be trained to recognize traditional phishing emails.

Another well-known technique referenced in the interview is the “Zoom meeting attack,” where attackers trick victims into installing malware disguised as a video conferencing update. Many such campaigns begin with a fake job opportunity, but they can also use other professional hooks like project funding or partnership proposals.

How failure is handled: remediation, reviews, and potential dismissal

Binance’s approach doesn’t end with simulated testing. Su said employees who fail the phishing simulations undergo remediation training. He also described incentives tied to the results, stating that performance reviews reflect test outcomes.

Su’s framing is direct: “If someone repeatedly fails the phishing-simulation attack, that will negatively impact their rating. That’s the incentive to be vigilant.”

He further said repeated severe failures could “bottom out” performance ratings, potentially leading to dismissal. While Su did not outline exact thresholds or timelines for dismissal in the interview, the principle is clear: Binance is treating repeated susceptibility to social engineering as a personnel risk, not just a training gap.

Outside centralized exchanges, similar social engineering dynamics have produced major losses in DeFi ecosystems as well. For example, Cointelegraph referenced a September 2025 incident in which a Venus Protocol user reportedly lost around $13 million after a malicious Zoom client compromised a computer and led the attacker to gain control over the victim’s account. Venus paused the protocol and used an emergency governance vote to recover assets, later returning positions worth $11.4 million to the victim, according to earlier coverage cited in the article.

Those examples reinforce the broader point behind Binance’s internal testing: even when attackers target individuals rather than systems, the outcome can still be catastrophic at scale.

What readers should watch next is whether Binance’s approach—monthly red-team phishing tests, remediation, and performance-linked consequences—becomes a more standard pattern across large crypto firms as regulators and stakeholders increasingly focus on operational security beyond code and infrastructure.

Cryptocurrency exchange Binance runs simulated phishing attacks against its own employees and can fire staff who repeatedly fail the tests, according to Binance chief security officer Jimmy Su.

The fake attacks are conducted by Binance’s red team, an internal ethical hacking unit whose job is to break into systems to identify vulnerabilities.

“We do phishing attacks on our own employees on a monthly basis just so we understand if our security hygiene is improving,” Su told Cointelegraph. “The ones that have failed it, we will do remediation training.” 

The measure shows the lengths crypto companies will go to prepare for social engineering attacks. Binance, the largest crypto exchange in the world, reports 323 million registered users, while DefiLlama estimates the exchange holds $137.7 billion in assets.

Jimmy Su, chief security officer at Binance. Source: Binance

In February, AMLBot estimated that 65% of crypto security incidents in 2025 were driven by social engineering. In April, Drift Protocol suffered a $285 million hack, which came after a long-term social engineering campaign. 

Su said Binance has been running these simulated attacks for three to four years. 

“In the beginning, the security hygiene left a lot to be desired. But after this amount of time, the company has improved significantly.” 

One of the simulated attacks involves the red team posing as job recruiters, said Su. 

Related: Trader loses $1M after signing phishing token approval 

One of the more well-known attack methods in recent years has been the “Zoom meeting attack,” where hackers trick victims into installing malware disguised as an update to the video conferencing app. Many of these attacks start with a fake job opportunity, though some use project funding or a partnership proposal as the lure. 

In September 2025, a major Venus Protocol user lost roughly $13 million after a malicious Zoom client compromised his computer, leading him to grant an attacker control over his account. Venus paused the protocol and used an emergency governance vote to recover the assets, later returning positions worth $11.4 million to the victim. 

“The interview process is just one scenario. There are other ones. For example, it could be that we are offering some kind of free conference invite just to try to collect personal information and see how many of them will actually fall for it,” said Su.  

Su said employees are incentivized to perform well on the tests because the results are reflected in their performance reviews.

“If someone repeatedly fails the phishing-simulation attack, that will negatively impact their rating. That’s the incentive to be vigilant.” 

Repeated, severe failures could lead to their rating to “bottom out,” which could see them dismissed, he said.

Magazine: Fears of AI-driven DeFi hack epidemic overstated for now — but not for long

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.

The world’s largest stablecoin now travels between blockchains as USDT0, a version its builders insist is not a wrapped token, while its mechanics lock collateral in an Ethereum vault and mint claims elsewhere. Here is how it actually works, who runs it, what the trust stack contains, and why a gas tank on a new chain runs on it.

Every successful monetary instrument eventually faces the geography problem: the money is in one place, and the demand is in another. Gold solved it with certificates, banks with correspondent accounts, and Tether, whose USDT is the most used digital dollar on earth, faced it acutely by 2024, when the stablecoin’s natural habitat, Ethereum and Tron, no longer contained the frontier of activity.

New chains launched monthly, each wanting the deepest dollar in crypto, and Tether’s options were unattractive: deploy a native USDT contract on every chain, multiplying operational and compliance surface with each launch, or let third-party bridges wrap USDT into a zoo of incompatible IOUs, the wrapped-asset sprawl that fragmented liquidity and produced some of crypto’s worst exploits.

USDT0, launched in January 2025, is the third option: one canonical collateral pool, on Ethereum, feeding a single standardized representation that travels anywhere, minted and burned by cross-chain messages instead of shuffled through bridge pools.

Eighteen months later, it has moved more than $50 billion cumulatively, colonized the new-chain frontier, and become something no wrapped asset ever was: the native gas token of an entire blockchain. Its operators insist, emphatically, that it is not a wrapped token. Its mechanics are a lockbox and a mint. Both statements are doing work, and understanding the gap between them is the point of this guide.

The mechanics, step by step

USDT0 is built on LayerZero’s Omnichain Fungible Token standard, OFT, and the cleanest way to understand it is to follow one dollar through the system.

Start with issuance. A market maker or exchange holding native USDT on Ethereum deposits it into the USDT0 lockbox, a smart contract on Ethereum mainnet that serves as the system’s single collateral vault. Upon deposit, an equal amount of USDT0 is minted on the destination chain of choice, Arbitrum, Berachain, HyperEVM, Plasma, Stable, or any other connected network. The mainnet USDT never leaves the vault; what circulates elsewhere is the omnichain representation, backed one-to-one by the locked collateral, with supply across all chains reconciled against the vault’s balance and attested through on-chain proof-of-reserves.

Now move it. When a holder sends USDT0 from chain A to chain B, no asset crosses anywhere. The OFT contract on chain A burns the tokens; LayerZero’s messaging layer carries a verified instruction to chain B; the contract on chain B mints the same amount to the recipient. The verification is the system’s load-bearing component: each message is attested by a configurable set of Decentralized Verifier Networks, DVNs, independent parties that confirm the source-chain burn actually happened, and delivered by an executor on the destination chain.

Because transfers are burn-and-mint against one canonical pool, there are no per-chain liquidity pools to drain, no slippage between chain versions, and no bridge inventory to exploit in the way that destroyed earlier designs; the attack surface concentrates instead in the messaging layer and its verifier configuration, which is where any honest risk analysis must spend its time.

Exit works in reverse: burn USDT0 anywhere, unlock native USDT from the Ethereum vault, redeem through Tether’s ordinary channels. The system also extends beyond the dollar, with the same architecture carrying XAUT0, the omnichain version of Tether Gold, and the roster of connected chains has grown to include most of the venues where new stablecoin activity concentrates.

Who actually runs it

Here is the structural fact most coverage elides, and it matters more than any throughput statistic: USDT0 is not operated by Tether.

The system is built and run by Everdawn Labs, a separate company operating under license from Tether, announced as the deployment partner in January 2025 for chains where Tether chose not to run a native mint. Tether’s relationship to the system is that of licensor, collateral issuer, and, as of February 2026, strategic investor in LayerZero Labs itself, an investment that formalized the alignment between the dollar, its omnichain vehicle, and the messaging layer underneath both. The arrangement mirrors patterns elsewhere in stablecoin infrastructure, where issuers increasingly delegate chain expansion to specialized partners instead of operating every deployment themselves.

For a holder, the delegation defines the trust stack, and the stack should be enumerated, not gestured at.

Layer one: Tether’s reserve risk, the same exposure any USDT holder carries, that the collateral behind the dollar is what the attestations say.

Layer two: the lockbox, an Ethereum smart contract whose integrity secures the entire omnichain supply; a flaw there is a flaw everywhere at once.

Layer three: LayerZero’s messaging, specifically the DVN configuration chosen for USDT0, since the verifiers who attest cross-chain messages are the parties who could, in a failure or compromise scenario, authorize mints that should not exist.

Layer four: Everdawn’s operational competence across all of it. Native USDT on Ethereum or Tron is a direct claim on Tether. USDT0 on a frontier chain is a claim on locked USDT, mediated by a contract, a messaging protocol, a verifier set, and an operator.

In calm conditions, the distinction is invisible, the tokens are fungible in practice, and the peg has held. The distinction exists for the other conditions, which is what trust stacks are for.

Wrapped or not? Adjudicating the claim

Everdawn’s positioning is explicit: USDT0 is not a wrapped token or a synthetic asset; it is USDT, extended across blockchains. The mechanics described above are, equally explicitly, lock-and-mint, the same skeleton as every wrapped asset since WBTC. Both claims can be examined honestly, and the resolution is more informative than either slogan.

What the not-wrapped claim gets right is the difference in kind from the wrapped-asset era’s actual pathologies. Classic wrapping was fragmentary: every bridge minted its own IOU, so one dollar became five incompatible tokens across five chains, each backed by a different custodian or pool, each trading at its own slight discount, each an island of risk.

USDT0 is canonical and unified: one standard, one collateral pool, one supply reconciliation, fungible representations everywhere, with the issuer’s blessing and proof-of-reserves attached. It also avoids the liquidity-pool bridge model whose drained pools produced the industry’s worst losses; burn-and-mint against a vault has no inventory to steal on the transfer path. In the dimensions that made wrapped a warning label, fragmentation, unofficial issuance, pool risk, USDT0 is genuinely something else.

What the claim obscures is that the something else still has the wrapped structure’s irreducible core: the circulating asset on the destination chain is a representation, and between it and the underlying dollar sit contracts, messages, and verifiers that native USDT holders do not depend on.

The honest taxonomy is that USDT0 is an official, canonical, issuer-aligned wrapper, the best-constructed version of the category, marketed as the category’s transcendence. Holders should adopt the engineering description rather than the marketing one, not because failure is likely, the system’s eighteen months have been clean, but because the description determines where to look when evaluating any chain, protocol, or yield product built on top of it: at the DVN configuration, the lockbox, and the operator, the three components a native-USDT analysis would never need to mention.

A note on what the numbers above are measuring, because USDT0 statistics arrive in three units that coverage routinely conflates. Cumulative transfer volume, the $50 billion figure, counts every cross-chain movement since launch and grows monotonically; it measures usage of the messaging rails, and a single market maker cycling inventory daily can generate billions of it.

Daily transfer volume, the hundreds of millions, measures current throughput and is the honest activity gauge. And outstanding supply, the amount of USDT locked in the Ethereum vault backing circulating USDT0, measures adoption as a stock: how many dollars actually live on the frontier at any moment, which is the number that matters for assessing both the system’s importance and its blast radius.

The three can tell different stories simultaneously: high cumulative volume with modest outstanding supply describes a busy corridor more than a settled population, and the disciplined reader checks which unit any headline is using before concluding anything.

The public dashboards report all three, and the ratio between daily volume and outstanding supply, the velocity of the omnichain dollar, is quietly the best single indicator of what USDT0 is being used for: high velocity signals bridging and arbitrage traffic, while a falling ratio with growing supply signals the thing the system was actually built for, dollars moving to new chains and staying there.

The precedent stack: how crypto got here

USDT0’s design is best appreciated against the three generations of cross-chain dollar movement it is trying to retire, because each generation’s failure wrote one of its requirements.

Generation one was the custodial wrap, WBTC’s model applied everywhere: a trusted custodian holds the asset, a merchant mints the representation, and the trust is institutional. It worked, and it concentrated risk in single custodians whose failure would orphan every wrapped unit, a structure acceptable for one flagship asset and unworkable for a dollar meant to exist on thirty chains.

Generation two was the liquidity bridge: pools of the asset parked on both sides of a route, with transfers swapping against the inventory. This is the architecture behind the industry’s grimmest leaderboard, the Ronin, Wormhole, and Nomad exploits that together lost billions, because pooled inventory is a honeypot and bridge code guarding it became the most attacked surface in crypto.

Generation three was canonical-but-fragmented: issuers deployed native contracts chain by chain, which eliminated wrapper risk and created its own sprawl, the same dollar as incompatible deployments, unofficial bridged versions filling every gap the issuer had not reached, and users left to guess which contract address was real, a confusion that persists in every wallet’s token list today.

USDT0 is the fourth-generation answer, and its design choices map one-to-one onto the predecessors’ wounds: a single canonical collateral pool instead of custodial fragmentation, burn-and-mint messaging with no pooled inventory to drain, issuer alignment and proof-of-reserves instead of unofficial IOUs, and one standard identity across every chain instead of the address-guessing game.

What it could not design away is the residual that every cross-chain system shares: a verification layer whose honesty the whole structure rests on, which in USDT0’s case is LayerZero’s DVN configuration. The generational history is therefore the fairest way to grade the system, dramatically safer than bridges, structurally cleaner than fragmented wraps, and still, irreducibly, a machine whose security equals the integrity of the parties attesting its messages.

Crypto has not escaped that equation; it has, in USDT0, produced its most disciplined answer to it so far, with the largest dollar in the industry as the test load.

Why it matters: the gas tank case study

The clearest demonstration of what USDT0 changes arrived when Stable, the Tether-ecosystem payments chain, made it the network’s native gas token, the first time the fuel of an entire Layer 1 has been a representation of somebody’s dollar.

The design solves a real problem this publication’s stablechain coverage has examined: on general-purpose chains, users must hold a volatile native asset to move their stable one, an absurdity for payments. Stable’s v1.2.0 upgrade in February retired its earlier wrapped-gas workaround and made USDT0 the chain’s fee asset directly, so a user’s balance and their fuel are the same dollar, with simple transfers gas-exempt entirely.

None of that is possible with mainnet-native USDT, which cannot leave Ethereum; it is possible with USDT0 precisely because the omnichain layer lets a new chain import the world’s deepest dollar at launch, liquidity, brand, and users included, without waiting for Tether to deploy natively.

The same import logic explains USDT0’s spread across the frontier generally: for a new chain, connecting to the standard is the difference between launching with dollars and launching with promises.

The strategic reading completes the picture. USDT0 converts USDT from a multi-chain asset into a network: one vault, many outlets, centrally standardized, and it does so under the Tether ecosystem’s own governance, not through third-party bridges it cannot control.

Every new chain that adopts the standard deepens the moat of the underlying dollar, which is why the system’s growth, $50 billion moved, hundreds of millions daily, a gas tank on a purpose-built chain, is best understood not as bridge traffic but as the largest stablecoin building its own distribution grid. The dollar stays in the vault. The claim on it goes everywhere. Whether that is called wrapping or extension matters less than knowing which one you hold.

A final calibration on scale, because the numbers reframe what kind of object this is. USDT’s total circulation runs in the $150-billion-plus range across all chains, and USDT0’s share of it, while growing fast, remains the frontier slice: the omnichain system’s cumulative $50 billion in transfers and nine-figure daily volumes measure movement, not stock, and the locked collateral backing all outstanding USDT0 is a single-digit percentage of total USDT. That proportion is the honest size of the experiment: the vast majority of the world’s largest stablecoin still lives natively on Tron and Ethereum, where remittance corridors and exchange settlement run on decade-old rails, and USDT0 is the expansion mechanism for everywhere else, the new chains, the payments experiments, the frontier.

The proportion also explains the system’s risk posture from Tether’s side: delegating the omnichain layer to a licensed operator quarantines the frontier’s novel risks, messaging, verifiers, new-chain exposure, away from the core deployments that carry the float. If the omnichain layer ever failed, the damage would be severe for the connected chains and contained for the dollar itself, a separation that is prudent engineering from the issuer’s chair and worth internalizing from the holder’s: USDT0’s guarantees are engineered to protect USDT first.

As the frontier grows into the core, on Stable above all, that proportion will shift, and the omnichain layer’s security budget, scrutiny, and systemic weight will have to grow with it. The system’s first eighteen months earned it the benefit of the doubt. Its next test is carrying a meaningful fraction of the world’s working dollar, which is a different weight class, and the honest summary for any user is the one this guide began with: know which dollar you hold, and know the stack standing between it and the vault.

Frequently Asked Questions

Disclaimer: This article is for information and educational purposes only and does not constitute financial or investment advice. It describes third-party infrastructure whose parameters, deployments, and risk profile can change. Always verify official contract addresses and documentation before transacting. Always do your own research. Information is accurate as of July 24, 2026.