Tether America USD (USAT) on Aave Ethereum Assessments

[LlamaRisk]

Summary

LlamaRisk supports onboarding USAT to Aave V3 Core on Ethereum and to the Aave V4 Core Hub as a borrowable, non-collateral reserve priced at a hardcoded $1 as an initial configuration. USAT is a fiat-backed US-dollar stablecoin issued by Anchorage Digital Bank, N.A., a national trust bank chartered by the Office of the Comptroller of the Currency, with Tether supplying the Hadron tokenization platform as technology partner. Reserves are US-dollar cash and reverse repurchase agreements collateralized by US Treasury securities, held in a segregated fiduciary trust at Anchorage and attested monthly by Deloitte & Touche LLP since January 31, 2026, with every report to date showing reserves above tokens outstanding.

On-chain depth is one Curve USAT/USDT pool of about $10M, therefore Anchorage’s A1 desk is the primary flow venue which swaps USAT and USDT 1:1 in both directions with no size limit for onboarded clients, settling same day to T+1. Custody sits with one broker-dealer counterparty and one cash institution, neither named in the public attestation. The HadronToken source carries two third-party audits, OtterSec in October 2024 and ChainSecurity in November 2024. A bug bounty is live over the contract surface, but upgrade authority and every privileged function sit with one 3-of-5 multisig with no timelock and no pause lever.

With collateralization disabled and the price hardcoded, transient depegs cannot cause liquidations and the caps keep Aave’s exposure within a small multiple of what a liquidator can source at par. A timelock and role separation over the owning multisig, and publication of the audit reports reconciled to the deployed commit, are the gaps to be closed before widening the listing, in line with Aave’s Risk Framework. A collateral path is gated on a robust Chainlink USAT/USD feed but is not a precondition for this borrow-only listing.

1. Asset Fundamental Characteristics

1.1 Asset

USAT (on-chain name “Tether America USD”, symbol USAT, ERC-20 with 6 decimals, non-rebasing) is a fiat-backed US-dollar stablecoin issued by Anchorage Digital Bank, N.A., an Office of the Comptroller of the Currency (OCC)-chartered national trust bank, with Tether Operations supplying the Hadron tokenization platform and acting strictly as a technology partner rather than the issuer. The token is pegged 1:1 to the US dollar and is redeemable on demand for fiat against reserves that the first reserve report discloses as US-dollar cash and reverse repurchase agreements collateralized by US Treasury securities. The token proxy was deployed on Ethereum mainnet on December 12, 2025 and circulates 183,317,585.50 USAT across 33,139 holders. The attested outstanding figure is lower, 175,731,350 at August 31, 2026, because issuer-held inventory that has been minted but not issued is excluded.

1.2 Architecture

USAT runs as an OpenZeppelin TransparentUpgradeableProxy that holds all token storage and delegates execution to the verified HadronToken implementation recorded in its EIP-1967 implementation slot. The EIP-1967 admin slot points to a separate OpenZeppelin ProxyAdmin, which holds the sole upgrade path, and both it and the implementation resolve to the same 3-of-5 multisig owner. The contracts above are the Ethereum mainnet deployment. USAT is also deployed on Celo, and the union of both deployments is the unit of assessment.

Source: Etherscan, October 12*, 2026*

The implementation inherits ERC20Upgradeable, ERC20PermitUpgradeable, OwnableUpgradeable, and Initializable. Authority sits in a single OZ Ownable owner, with no AccessControl role hierarchy and so no MINTER_ROLE, PAUSER_ROLE, or dedicated blocklist role. The owner-only surface is:

• mint(address _destination, uint256 _amount) issues to any recipient, under no cap or rate limit.
• addToBlockedList(address) and addMultipleToBlockedList(address[]) freeze a holder, blocking every transfer it sends.
• removeFromBlockedList(address) and removeMultipleFromBlockedList(address[]) reverse a freeze.
• destroyBlockedFunds(address _blockedUser) seizes and burns a frozen balance.
• redeem(uint256 _amount) burns from the owner’s own balance.
• transferOwnership(address) and renounceOwnership() hand over or abandon the owner slot.

Holders can neither mint nor burn. transfer, transferFrom, and multiTransfer revert when the sender or the caller is on the block list, and a blocked address can still receive. ERC-2612 permit and a multiTransfer batch helper complete the user-facing surface.

That bundling matches USDT, which also concentrates issuance, blocklisting, and fund destruction in one owner with no role separation, so USAT is not a departure from Tether’s established practice. Two levers differ.

• USDT carries pause() and unpause(), and USAT carries neither.
• USDT’s owner has no way to renounce, while USAT leaves the OZ renounceOwnership() default in place, so its owner can abandon the slot and orphan every privileged function.

Notably, HadronToken does not inherit PausableUpgradeable and exposes no pause() / unpause() / whenNotPaused surface. Emergency containment of an exploit on a deployed proxy depends on either an upgrade through ProxyAdmin or surgical use of the blocklist. The contract is also not a yield-bearing wrapper, with no rebase, no yield-distribution function, and no fee-on-transfer logic, so token holders do not receive reserve yield.

Off-chain, mint and redeem are coordinated by Anchorage Digital Bank, N.A. as the federally chartered issuer of record, with Tether’s Hadron platform supplying the tokenization rails and Cantor Fitzgerald named in Tether’s launch announcement as reserve custodian and preferred primary dealer.

1.2.1 Cross-chain Deployments and Bridge Scope

USAT is natively issued by Anchorage on Ethereum mainnet and mirrored on Celo through a LayerZero V2 Omnichain Fungible Token (OFT) route deployed on Tether’s USDT0 stack. Anchorage lists both contracts as official in its stablecoin documentation and on the USAT supported-protocols page. The Celo expansion was announced in March 2026.

Chain	Token address	Bridge stack
Ethereum	0x07041776f5007ACa2A54844F50503a18A72A8b68	native (Anchorage issuance)
Celo	0xD2ab3C9A02DBBAB236BfEC45D1d755DF4267F771	LayerZero V2 OFT on the USDT0 stack, Ethereum adapter 0x18171f318a49051301c3422b6042fca2d8be43df, first mint May 5, 2026

Source: Etherscan and Celoscan, October 12, 2026

Celo carries 243,795.604319 USAT against 183,317,585.50 on Ethereum, so 0.13% of supply sits off the issuing chain. Every unit of the Celo token was minted by the bridge and the Ethereum adapter escrows a balance equal to the Celo supply to the last decimal. Anchorage lists Avalanche as next on the roadmap and Solana as planned, with no committed dates. Only the Ethereum deployment is proposed for listing.

1.3 Issuance and Redemption

USAT has no fixed maximum supply. The implementation exposes no cap, and circulation expands or contracts with fiat flows handled off-chain by Anchorage Digital Bank, N.A. (ADB) as issuer. New tokens are minted only by the contract’s single Ownable owner via mint(address, uint256). Tokens leave circulation through redeem(uint256), which only the owner can call and which burns from the owner’s own balance, or through destroyBlockedFunds(address), which the owner uses to seize and burn the balance of a block-listed address.

Every step of the primary market routes through ADB. It is the issuer of record, the fiduciary trustee holding the reserve, the party that approves each mint and burn, and the only redemption facilitator. No secondary venue operates a wholesale redemption desk. Tether’s Hadron platform supplies the tokenization rails, blocklist tooling, and transaction monitoring without holding issuer status.

Direct issuance and redemption are confined to ADB Clients. A prospective Client must pass ADB’s know-your-customer process, which in practice limits the population to institutional users and must be separately onboarded for USAT services under the Master Account Agreement. Mint and burn transactions carry a $1,000,000 per-transaction minimum, with a limited carve-out for test transactions. Issuance is priced at par with no spread, and redemption carries a 10 basis-point fee. Settlement to the Client’s Anchorage account is same-day for a burn the cash buffer covers and the next U.S. business day beyond it, and ADB commits to “commercially reasonable efforts” on valid requests while reserving wide discretion to delay or refuse. Holders who are not ADB Clients have no direct redemption claim and exit through secondary markets.

Three limits govern how fast a redemption pays out.

• The cash buffer. At the August 31, 2026 report the reserve held $17,477,828 in cash against $158,914,000 in Treasury-collateralized reverse repurchase agreements. Cash can go out at once, so a redemption that fits inside it settles the same day, and the buffer is roughly a tenth of the 175,731,350 tokens outstanding.
• The securities settlement window. Anything above the cash buffer is funded by unwinding the overnight reverse repo. That can be done intraday, but only on a U.S. business day, and settlement takes several hours, so a request entered late in the morning pays out the following business day and nothing above the buffer can be funded over a weekend or a U.S. holiday.
• The Fedwire cut-off. The dollar leg is a wire, so a redemption approved after the daily wire window pays out on the next Fedwire day whatever the reserve position.

Pressure beyond the cash buffer outside U.S. business hours therefore reaches the Curve pool. Anchorage states that it is working to move part of the reserve into tokenized money market fund exposure to reduce dependence on the settlement window.

Attested outstanding supply has grown from 17.5M USAT at the January 31, 2026 report to 175.7M at August 31, a tenfold expansion in seven months. ADB publishes no service-level agreement on either leg and no per-Client or aggregate daily cap, so the timing above rests on operating practice, and bilateral service levels have been agreed in individual client documentation. At the wallet and contract level the token enforces no jurisdictional gating, and only the blocklist restricts transfer.

A second exit runs alongside redemption. A1, Anchorage’s principal trading business, swaps USAT and USDT in both directions at a fixed 1:1, live today, with no minimum or maximum size and no access fee. Eligibility is ADB onboarding, USAT onboarding, and a Purchase and Sale Agreement with A1, and every user to date has been an ADB client. Anchorage describes it as a service offered in support of the USAT ecosystem.

The swap is not atomic. It runs as four sequential legs: the client delivers USAT to A1, A1 redeems that USAT with ADB for dollars, A1 buys USDT against those dollars, and A1 delivers USDT to the client. Between the first leg and the last the client’s exposure is to A1 as principal, and A1 is a non-bank affiliate, so that exposure sits outside the OCC-supervised bank. Turnaround is same-day to T+1 in U.S. business hours, because the sell leg is an ADB redemption and carries the settlement window and the 10 basis-point burn fee with it, so A1 absorbs at least that much on every sell-side swap while quoting the client par.

Reserves backing those tokens are described as held in segregated fiduciary trust accounts at Anchorage Digital Bank, comprising US-dollar cash and reverse repurchase agreements collateralized solely by US Treasury securities, with reserve custody not diversified across multiple Treasuries counterparties or cash institutions. The first reserve report, published at usat.io/news on a monthly cadence, reported 17,501,391 USAT outstanding against $17,604,716 in reserves, a $103,325 surplus, in an attestation signed by Deloitte & Touche LLP. USAT is non-yield-bearing for token holders: any return generated on the reserves is retained by Anchorage as fiduciary compensation for administering the trust.

1.3.1 Token Holder Concentration

Source: Etherscan, October 12, 2026

Source: Etherscan, October 12, 2026

The top holder controls 54.50% of supply, the top five 76.32%, and the top ten 93.40%, which is highly concentrated. USAT has 33,139 holders and the largest hundred of them hold 99.92% of supply, so the count is not evidence of distribution.

Concentration has not dispersed as supply grew, it has redistributed. Between the May 8, 2026 read and today, supply rose from 153.75M to 183.3M USAT, and the top-1 share fell from 65.04% to 54.50% while the top-ten share barely moved, 93.89% to 93.40%. The new supply went to a small number of large wallets rather than to a broad holder base.

Exchange-tagged wallets hold 6,879,051 USAT between them, Bybit and Bitfinex the largest. The Curve USAT/USDT pool that backs essentially all on-chain liquidity holds 7,192,451 USAT, and its market maker holds 4,601,225 USAT, down from 7,000,857 in May.

2. Market Risk

2.1 Liquidity

On-chain depth consists of one main pool. The Curve USAT/USDT Stable NG pool holds $10.02M of the $10.16M total indexed liquidity sources across 20 Ethereum venues, and the Uniswap V3 USAT/USDT 0.05% pool, the only other venue above $10k, quotes about $2k of depth within 2% on either side.

A liquidator repays USAT debt, so they buy USAT and draw down the pool’s USAT side. A seller, a holder leaving USAT or a borrower converting it into USDT, draws down the USDT side, and the two sides behave very differently.

Size (M USAT)	Sale, min loss	Sale, median loss	Sale, max loss	Purchase, max cost
1.0	0.00%	0.01%	17.29%	0.06 bps
3.0	0.00%	0.06%	72.32%	0.38 bps
5.0	0.58%	33.41%	83.39%	5.72 bps

Source: Curve USAT/USDT pool, October 12, 2026

2.1.1 Buying USAT

A liquidator has to buy USAT from the pool. The pool quotes close to par until its USAT runs out, so the price of a purchase depends on how much USAT the pool holds. Between May 11 and October 12, 2026 a 5M purchase never cost more than 0.06%, and 1M and 3M cleared at par throughout, including at the tightest compositions the window recorded. The USAT side of the pool ranged from 5.2M to 8.4M over that window and holds 7,192,451 today, where a 7M purchase clears at 0.04% and a 7.5M purchase returns 7,190,489 USAT at a 4.13% cost because there is nothing more to buy. A liquidator can buy at most the USAT the pool holds at the time.

Off the pool, centralized books quote $7.9M of depth within 2% on the buy side across 16 pairs, but 39% of it sits on books printing under $5k a day, and off-chain depth is credited below on-chain depth. Anchorage’s A1 desk swaps USDT for USAT at par, but only for onboarded clients on a bilateral agreement and at same-day to T+1 settlement.

2.1.2 Selling USAT

The pool was seeded on April 21, 2026 with $10.012M and its TVL has stayed there since. At 50% USAT share, a $5M sale comes back close to whole, at 70% it is $3M and the seller loses 40%, and at 90% it is $1M and the seller loses 80%. Across the window the share has swung from 50.1% to 91.7% with a median of 66.7%, and the pool sat above 65% for 63% of samples, so the median 5M sale lost 33.41% and the worst, at 91.7% share with $831K of USDT left, lost 83.39%. A 1M sale holds within 4 bps across 98% of samples and still reaches 17.29% at peak imbalance.

Source: Curve USAT/USDT pool, October 12, 2026

Source: Curve USAT/USDT pool, October 12, 2026

2.1.3 Market Maker Resets

Composition is reset by a single counterparty. Retail USAT sales accumulate, the share drifts up, and the rank-1 liquidity provider wallet sells USDT into the pool to bring it back, six times so far, four in the three weeks after the seed and twice in late August 2026, $0.5M on August 23 and $1.0M on August 26, after three addresses together sold about 1.3M USAT across August 21 to 24 and took the share to 83.9%. No third-party arbitrageur has closed an imbalance in between. Tether confirmed under NDA that the wallet is its committed market maker and that it holds USAT inventory outside the pool to fund the resets.

Reset	USDT injected
April 28, 2026	$2.9M
April 30, 2026	$2.0M
May 1, 2026	$2.0M
May 11, 2026	$3.1M
August 23, 2026	$0.5M
August 26, 2026	$1.0M
Total	$11.5M

Source: Curve USAT/USDT pool, October 12, 2026

Since the August 26 reset the pool has held between 70.0% and 72.1% USAT. At the current composition a 1M sale clears at 0.01%, a 3M sale at 6.12% and a 5M sale at 43.61%, and the 5M sale has not printed below 39.89% since.

2.1.4 Liquidity Venue Concentration

GeckoTerminal indexes 20 USAT pools on Ethereum mainnet against a combined $10.16M of on-chain TVL. The Curve USAT/USDT pool carries $10.02M, 98.6% of indexed TVL, and $1,061 of the $1,145 of 24h on-chain volume. The Uniswap V3 USAT/USDT 0.05% pool is the only other venue above $10k at $101k TVL, a 1.0% share, and printed $84 of volume in the 24h window. The remaining 18 pools are Uniswap V4 and Balancer V3 venues holding $8k or less each, and between them they traded under $1.

Concentration has tightened over time. Curve held 98.3% of indexed TVL around May, 2026 and holds 98.6% now, while on-chain 24h volume has fallen from $3.31M in May to $120k in August and $1.1k now as the pool’s composition drifted. Several of the dormant Uniswap V4 pools quote far from par, between $0.78 and $1.24.

2.1.5 DEX LP Concentration

The Curve USAT/USDT pool’s LP token has six holders against ~10.012M units of total LP supply, and three externally-owned accounts hold 99.99% of that supply.

#	Address	Type	LP balance	Share
1	0xcB9Eb94Ff4A0E7c4eC33578C1Db42237e5b10495	EOA	4,003,999.99	39.99%
2	0x08e00f8e18D181012c168504F8A7b0D9cB5e1420	EOA	3,004,000.80	30.00%
3	0xE3F3d3b2c86e83200BE86A03966638707263f565	EOA	3,003,999.99	30.00%
4	0x2E5b0aA712a05A9B61Fe6B976148f0B9AFb2C550	EOA	0.099	0.00%
5	0xE851bd650Ad10e119b78C8c8cd590004C315BEC1	EOA	0.041	0.00%
6	0x000000000004444c5dc75cB358380D2e3dE08A90 (Uniswap V4: Pool Manager)	contract	0.010	0.00%

Source: Etherscan, October 12, 2026

The pool has no diversified LP base. Its entire capital sits in three externally-owned accounts, and Tether disclosed under NDA that all three are its market maker. The only liquidity added since the April 2026 seed is 0.041 units of dust from a new address in July, so no outside provider has taken a position. The rank-1 wallet executed every operator rebalance while the other two held static positions, so the dependency is functionally on one wallet. The operating entity is not publicly named.

2.2 Volatility

Source: CoinGecko, October 12, 2026

The peg-vs-spot series runs hourly from January 27 to October 12, 2026, 6,189 samples, with a median deviation of −8 bps. Daily closes hide the extremes: on March 12, 2026 the spot held 89 bps above par for three hours before decaying back inside 3 bps, and that day’s close reads −0.9 bps. That episode is the largest sustained deviation in the series in either direction. Isolated single-hour prints down to −251 bps, with the hours on either side inside ±8 bps, are cross-venue averaging artifacts and are left out.

Since May 9, 2026 USAT has printed at or above $1 in 11 of 3,756 hourly samples, against 52% of hours above par before that date, and the median has moved from +0.4 bps to −10.7 bps. Below par, USAT has sat under −10 bps for 56% of hours since May 9 and under −15 bps for 17%. Fifteen episodes hold under −15 bps for twelve hours or longer, the deepest reaching −39 bps across 50 hours in late May.

2.3 Exchanges

USAT trades on 16 venues indexed by CoinGecko across 19 pairs, for an aggregate $1,198,023 of 24h volume. GroveX runs the dominant book at 90.5% of that flow ($1.08M on USAT/USDT), followed by MEXC at $55k and KCEX at $23k, and the three together clear 97.0%. HTX, the dominant venue in September, now prints $20k. Volume concentrates on a single centralized venue and is about a quarter of the ~$5.2M the same measure read in May 2026, against a smaller supply.

Quoted spreads are 6 bps or tighter on every book carrying more than $10k a day, GroveX’s the widest at 6 bps. Bitkub’s USAT/THB book is the widest overall at 1.39% on $12 of daily volume and last printed $0.99. On-chain flow is $1,064 on the Curve pool and $84 on Uniswap V3, so the Curve pool carries 0.09% of total venue volume.

#	Venue	Type	Pair	Last	24h Vol	Spread	+2% Depth	−2% Depth
1	GroveX	CEX	USAT/USDT	$1.00	$1.08M	0.06%	$1.44M	$1.29M
2	MEXC	CEX	USAT/USDT	$1.00	$55k	0.02%	$750k	$514k
3	KCEX	CEX	USAT/USDT	$1.00	$23k	0.02%	$1.16M	$1.15M
4	HTX	CEX	USAT/USDT	$1.00	$20k	0.01%	$167k	$719k
5	Bybit	CEX	USAT/USDT	$1.00	$7k	0.01%	$1.24M	$772k
6	Bitget	CEX	USAT/USDT	$1.00	$3k	0.01%	$205k	$20k
7	Gate	CEX	USAT/USDT	$1.00	$2k	0.02%	$423k	$236k
8	Uniswap V3 (Celo)	DEX	USD₮/USAT	$1.00	$2k	0.61%	$2k	$2k
9	GroveX	CEX	USAT/USDC	$1.00	$1k	0.03%	$229k	$195k
10	Curve (Ethereum)	DEX	USAT/USDT	$1.00	$1k	0.60%	$199k	$199k

Source: CoinGecko, October 12, 2026

2.4 Growth

Total supply grew from $20M in late January 2026 to a peak of $187.5M on June 12, arriving in a series of round mints of which one dominates, $100M on April 16. No mint has followed the June 12 one, three burns since have taken $4.2M out, and supply stands at $183.3M.

Source: DefiLlama, October 12, 2026

3. Technological Risk

3.1 Smart Contract Risk

The HadronToken source underlying USAT carries two independent third-party code-security audits, both provided to LlamaRisk. OtterSec assessed the source at commit 632d25b in a report dated October 3, 2024, raising two best-practice items and recording no issues remaining at that commit. ChainSecurity audited the Hadron contracts across commits 632d25b and 1471a4a in a summary letter dated November 26, 2024, reporting no critical, high, or medium-severity findings and three low-severity findings, one resolved and two acknowledged. A separate deployment-verification report checks the deployed proxy, implementation, ProxyAdmin and owning multisig against the source at commit 0393f56, and confirms the storage slots, the multisig owners and the 3-of-5 threshold.

Both audits are from Q4 2024, about two years before this assessment, and the last commit they cover is 1471a4a. The deployed code was checked against a later commit, 0393f56, so the changes between the two commits have not been audited. ChainSecurity reviewed the code on compiler 0.8.8 and notes that the compiler moved to 0.8.28 after its review. The deployed implementation uses 0.8.28. Neither report is published on the issuer’s channels. The ChainSecurity document is the public summary letter, with the full findings available on request. The owning MultiSigWallet fell outside ChainSecurity’s scope.

3.2 Bug Bounty Program

A dedicated USAT bug bounty is live, run by Tether under its bug bounty terms. Scope is the USA₮ smart contracts, and the supported-protocols page names both the Ethereum token and the Celo token as the official contracts it covers. Rewards run in five priority classes: RP1 pays a $50,000 minimum against a maximum of 10% of the funds an exploit would put at risk, capped at $10,000,000, then $10,000–$50,000 for RP2, $500–$10,000 for RP3, and smaller amounts below that.

Reports whose only claim is centralized or privileged control are out of scope, as are findings that assume an attacker already holds an owner, admin, or minter key, and mint, burn, freeze, blocklist and upgrade performed by their authorized holders are named as intended behaviour.

3.3 Price Feed Risk

USAT has no on-chain price source today. No Chainlink AggregatorV3 USAT/USD is deployed on Ethereum mainnet, and no Proof-of-Reserve feed is wired against the issuer’s reserve trust account. Because no Chainlink USAT/USD aggregator is deployed and the proposed listing is borrow-only, the oracle choice resolves to a hardcoded $1 adapter at launch.

3.4 Dependency Risk

USAT’s dependencies sit off-chain, in the custody chain behind the reserve. Most of the parties in that chain have no substitute.

Counterparty	Role	Redundancy
Anchorage Digital Bank, N.A.	Issuer of record, fiduciary trustee holding the reserve, and sole approver of every mint and redemption	None. The entire primary market routes through it
Cantor Fitzgerald	Reserve custodian and preferred primary dealer for the Treasury repo leg	Sole broker-dealer counterparty
Customers Bank	Cash leg of the reserve	Single depository
Tether Operations	Hadron platform: token contract surface, blocklist tooling, and Know Your Transaction monitoring	Single vendor across every Hadron-issued token
Deloitte & Touche LLP	Monthly reserve attestation	Single attestor
Bybit, Crypto.com, Kraken, OKX, Moonpay	Phase-one distribution and on-ramp	Several, though none operates a redemption desk
GroveX	90.5% of measured 24h secondary volume, and not a named partner	Effective single venue
Curve pool market maker	Sole active liquidity provider and rebalancer of the on-chain exit venue	One wallet

Tether Operations is explicitly not the issuer, a split Anchorage states in its launch announcement. The Hadron stack sits in the operational path and outside the fiduciary one. Hadron carries mint and redemption instructions and never the funds. The dependency covers the instruction and contract surface while custody and settlement stay with ADB. Its single-vendor character means platform-level incidents on Hadron-issued tokens reach USAT.

The reserve concentrates on both legs. Tether shared the counterparty and cash-custody detail with LlamaRisk under NDA, and the composition meets the GENIUS Act eligibility test. The reserve sits with one Treasuries counterparty, Cantor Fitzgerald, named by Anchorage in due diligence correspondence and in Tether’s launch press release, and one cash institution. The attestation identifies the counterparty only as a “Broker-Dealer in the United States”.

The first attestation, issued under the AICPA’s 2025 Criteria for Stablecoin Reporting as of January 31, 2026, breaks the reserve into 20.76% cash ($3,654,716) and 79.24% Treasury-collateralized reverse repurchase agreements ($13,950,000), against $17,501,391 of tokens and $17,604,716 of reserves. Seven reports have followed, monthly and without a gap, the latest as of August 31, 2026.

As of	Tokens outstanding	Reserves	Surplus	Cash	Treasury repo
January 31, 2026	17,501,391	$17,604,716	$103,325	20.76%	79.24%
February 28, 2026	19,001,496	$19,146,639	$145,143	10.44%	89.56%
March 31, 2026	22,050,123	$22,200,850	$150,727	10.82%	89.18%
April 30, 2026	140,850,950	$141,178,400	$327,450	9.51%	90.49%
May 31, 2026	156,516,514	$157,033,006	$516,492	9.93%	90.07%
June 30, 2026	176,794,845	$177,423,363	$628,518	9.98%	90.02%
July 31, 2026	175,245,527	$175,906,606	$661,079	9.95%	90.05%
August 31, 2026	175,731,350	$176,391,828	$660,478	9.91%	90.09%

Source: Anchorage Digital, October 12, 2026

Reserves exceed tokens outstanding in every report. The surplus grew every month from $103,325 in January to $661,079 in July and held at $660,478 in August. Cash was 20.76% of the reserve at the first report and has sat near 10% since February, so about 90% of the reserve is Treasury repo, bought at or near each month end and maturing the following business day.

The uninsured share of the cash leg has risen. At the first attestation cash split between FDIC-insured demand deposits ($1,851,392) and a SIPC-insured broker-dealer account under SEC Rule 15c3-3 ($1,803,324), with $3,154,716 above the $250,000 caps, 86% of the leg. The SIPC account is absent from February onward, so cash is now held entirely as demand deposits and $17,227,828 of the August balance sits above the cap. That is 98.6% of the cash leg uninsured against 86% in January, because the cap is fixed while the balance grows.

The July attestation is the first to report Ethereum and Celo supply separately in Schedule I. USAT had already begun bridging to Celo on May 5, and 40,513 USAT was on Celo by June 30, although the June report did not present a separate Celo column. The August report deducts 296,390 USAT as bridge-locked on Ethereum against exactly 296,390 natively minted on Celo, so a bridged unit is removed on one side and counted on the other and cannot be claimed twice. The same schedule excludes 8,486,260 USAT on Ethereum and 99,999 on Celo as natively minted but not issued, which is issuer-held inventory sitting outside the redeemable total. Anchorage measures outstanding supply across every supported chain and tests the single reserve against that aggregate.

Redemption concentrates the same way. Off-chain redemption routes back to Anchorage as the single facilitator. Holders who are not onboarded have no off-chain claim, and their exit is the Curve pool.

3.5 Bridge Risk

USAT carries one cross-chain route, Ethereum to Celo, served by a LayerZero V2 OFT deployment on Tether’s USDT0 stack. The Ethereum leg is an OFT adapter holding escrowed USAT. The Celo leg mints and burns against it. The adapter is a stock OFTAdapterUpgradeable with no custom logic, and both legs are peered only to each other.

Topology bounds the damage. Because Ethereum escrows the bridged units instead of burning them, a compromise of the Celo side or of the verifier set releases at most the escrowed balance, currently 243,795.604319 USAT. It cannot mint USAT on Ethereum, so the supply Aave would lend against is not inflatable through this route. That is the opposite of a burn-and-mint design, where a far-side compromise mints unbacked supply on the listing chain.

Three Decentralized Verifier Networks (DVNs) are required with no optional set, so every message needs unanimous attestation and one compromised DVN cannot forge. Send and receive libraries are pinned on both chains, not left at the vendor default, so a vendor-side library change cannot silently alter message handling. The three DVNs are Anchorage, USDT0 and LayerZero Labs: the issuer, its technology partner’s bridge project, and the bridge vendor. None is independent of both issuer and vendor, and Anchorage’s DVN attests on a single signer, so the quorum reflects less separation than its 3-of-3 form suggests.

The route carries no rate limit in either direction and no pause function on either chain. The largest single bridge mint to date moved 100,801.714048 USAT in one message on August 12, 2026, 41% of the route’s current supply, which is what an unlimited route permits by construction. Halting the route means clearing the peer or revoking the bridge’s mint authority, both owner transactions, with no dedicated control.

Authority is the binding constraint. The Ethereum adapter answers to the 3-of-5 multisig that owns the token, and the Celo contracts answer to a separate multisig carrying the identical five signers at the same threshold. That signer set can repoint either peer, replace either implementation, and rewrite the DVN configuration on both chains, each in one transaction with no timelock. The verifier quorum is therefore not an independent check on the issuer, which both sits inside it and can replace it without delay. The Celo multisig used that authority on October 7, 2026, upgrading the Celo token to a new implementation in one transaction. The new version adds the standard EIP-5267 signing-domain function and leaves the bridge controls as they were, with no pause and no rate limit.

Route	Bridge stack	Custody / mint	DVN set / threshold	Library pinning	Rate limits
Ethereum ↔ Celo	LayerZero V2 OFT, USDT0 stack	lock-and-mint: 243,795.604319 USAT escrowed on Ethereum, equal to Celo supply	3-of-3 required: Anchorage, USDT0, LayerZero Labs; no optionals	pinned, send and receive, both chains	none, either direction

Source: Etherscan and Celoscan, October 12, 2026

The exposure this adds to an Ethereum-only listing is small and bounded, and the authority that governs the route is the same authority that already holds unbounded mint on Ethereum.

The route is missing four controls: a limit on how much can cross in either direction over a given period, a way to pause either leg, a delay before changes to the bridge’s configuration take effect, and at least one verifier that none of Anchorage, Tether or LayerZero Labs runs. Without them, a mistake or a compromise at the signer set can move the whole escrowed balance and repoint the route, with no delay and no independent check.

The Ethereum-only listing recommended here carries no bridge exposure, so the four gaps constrain any future listing on Celo or another chain without blocking this one.

3.6 Technical Risk Summary

Strengths

1. Reserve custody sits with a federally chartered national trust bank regulated by the Office of the Comptroller of the Currency, and every monthly reserve report since January 2026 has been attested by Deloitte & Touche LLP.
2. The control surface is a standard OpenZeppelin TransparentUpgradeableProxy whose owner is a readable 3-of-5 multisig with on-chain signer disclosure.
3. Reserve composition is restricted to U.S.-dollar cash and Treasury-collateralized reverse repurchase agreements, with a reported surplus over outstanding tokens at every attestation to date.
4. A dedicated bug bounty is live over the USAT contract surface on both deployed chains, paying up to 10% of funds at risk against a $10,000,000 cap.

Weaknesses

1. The two audits of the HadronToken source are from Q4 2024 and stop at commit 1471a4a, the deployed code was checked against the later commit 0393f56, and neither report is published.
2. No timelock guards the upgrade or privileged-function paths, and the owner can renounce ownership on both the proxy and the ProxyAdmin.
3. Authority is bundled under a single OwnableUpgradeable owner with no role separation and no PausableUpgradeable containment lever.
4. Reserve custody is not diversified across multiple Treasuries counterparties or across multiple cash institutions on the detail provided under NDA, and the uninsured share of the cash leg has risen from 86% to 98.6% since the first attestation as the balance grew against a fixed insurance cap.
5. The Celo bridge route carries no rate limit in either direction and no pause, its three verifiers are the issuer, its technology partner and the bridge vendor with none independent of both, and one signer set can repoint the peers and rewrite the verifier configuration on either chain without a timelock.

4. Counterparty Risk

4.1 Governance and Regulatory Risk

Anchorage Digital Bank, N.A. (ADB) holds a national trust bank charter granted by the OCC on January 13, 2021. The charter makes ADB the only crypto-native institution currently holding a national trust-bank charter. ADB operates “under the supervision of the Office of the Comptroller of the Currency.”

§ 5 of the GENIUS Act limits payment-stablecoin issuance in the United States to “permitted payment stablecoin issuers,” defined to include subsidiaries of national banks, federally chartered trust banks, and federally chartered uninsured banks (among others). ADB satisfies this requirement under its OCC national trust charter.

USAT reserves are composed exclusively of U.S. dollar cash held at depository institutions and reverse repurchase agreements (“reverse repos”) collateralized solely by U.S. Treasury securities. The first published attestation confirms the composition. It is consistent with the closed list of “permitted reserve assets” enumerated in GENIUS Act § 4(a)(1)(A), which restricts reserve composition to U.S. currency, Federal Reserve notes, deposits at insured or regulated depository institutions, short-term U.S. Treasury obligations, Treasury-backed reverse repurchase agreements, and government money market funds.

Under the current architecture, reserve counterparties are concentrated in two named institutions. Cantor Fitzgerald is the sole broker-dealer counterparty for the U.S. Treasuries and Treasury-backed reverse repurchase agreements backing USAT (confirmed by Tether representatives in DD correspondence). The 2026-01-31 Deloitte attestation refers to the counterparty generically as “a Broker-Dealer in the US”; the identity is not published in the attestation itself. The cash component of the reserves is held in a single depository account at Customers Bank. Because that single account materially exceeds the $250,000 FDIC deposit-insurance cap, the incremental cash above that cap is uninsured demand-deposit exposure to Customers Bank. Neither the broker-dealer nor the depository is currently diversified.

Reserves are held in an express trust under South Dakota law, with ADB serving as fiduciary trustee. Further explanation of the segregation can be found in the Statement of USAT Policies and Disclosures:

“The assets in the USAT Reserve are segregated from ADB’s general assets and are managed solely for the purposes of the USAT Reserve Trust. ADB does not lend, pledge, or rehypothecate the assets in the USAT Reserve, except in limited circumstances permitted by applicable law, such as to facilitate lawful redemption transactions. These structural protections are intended to ensure that the assets in the USAT Reserve remain legally separate from ADB’s property and are not subject to claims of ADB’s creditors or any person other than lawful holders of USAT.”

The first Reserve Report was prepared under “the American Institute of Certified Public Accountants (AICPA)‘s ’2025 Criteria for Stablecoin Reporting. Monthly cadence is consistent with GENIUS Act § 4(a)(2). The transparency page lists January-May 2026 reports. Tether confirmed a committed monthly cadence going forward, with reports published on both the Anchorage transparency page and at Press - USA₮.io. The April 2026 report indicates that outstanding USAT grew more than sixfold during April.

Direct issuance and redemption are confined to ADB Clients. A prospective Client must both pass Anchorage Digital Bank’s KYC (which in practice limits the population to institutional users; there are no stated AUM minimums) and be separately onboarded for USAT services under the Master Account Agreement (confirmed by Tether representatives in DD correspondence). Mint and burn transactions are ordinarily subject to a $1,000,000 per-transaction minimum, with a limited carve-out for test transactions. Issuance is priced at par with no spread; redemption (“burn”) carries a 10 basis-point fee. Settlement is same-day (T+0) to the Client’s Anchorage account once a burn is approved. No secondary venue operates its own wholesale redemption desk; every burn routes back to ADB as the sole issuer and sole redemption facilitator. ADB uses “commercially reasonable efforts” to process valid redemption requests promptly, but reserves wide discretion to delay or refuse. Holders who are not ADB Clients have no direct redemption right and must transact in secondary markets.

The Covered Stablecoin Terms grant ADB broad freeze, block, and burn authority both for sanctions and for other legal-compliance reasons:

“ADB may freeze, block, seize, or otherwise restrict Covered Stablecoins where required by court orders, subpoenas, regulatory directives, or law enforcement requests, or where ADB determines that a transfer violates, or is likely to violate, applicable law or regulation. Such actions may apply to Covered Stablecoins held by Clients and Non-Clients alike and may result in permanent loss of access.” — Covered Stablecoin Terms § 5.

Notwithstanding the “Made in America” branding on usat.io, Tether has confirmed that USAT “is globally available for users who would prefer a US-regulated stablecoin” and that “there are no distinctions required at this time” between U.S. and non-U.S. holders. Tether further confirmed that “USAT will be swapped at Anchorage 1-1 for USDT for non-U.S. users who would prefer to receive USDT,” and that “as USAT and USDT are not currently MiCA compliant, there will be no exposure to those markets.”

4.2 Access Control Risk

4.2.1 Contract Modification Options

USAT is deployed as a TransparentUpgradeableProxy. The EIP-1967 implementation slot resolves to the verified HadronToken and the admin slot to a separate OpenZeppelin ProxyAdmin. Both the token and the ProxyAdmin answer to the same owner, so one signer set holds the upgrade authority and every privileged function on the deployed token.

Contract	Address	Controlled by	What that authority can do
Proxy, TransparentUpgradeableProxy	0x07041776f5007aca2a54844f50503a18a72a8b68	EIP-1967 admin slot, pointing to the ProxyAdmin below	Route every call to the implementation
Implementation, HadronToken	0x8B98Bcd9b1F8ae112FB2b58b45c3Bc9a75CC4d0e	owner(), read through the proxy	Mint, burn from its own balance, blocklist an address, seize and burn a blocked balance, transfer or renounce ownership
ProxyAdmin	0x3e4C6460aa00c11C81e3C5b95b15d612F5F2d9C7	owner()	Replace the implementation, reassign the proxy admin, transfer or renounce ownership
Owner, legacy MultiSigWallet	0x62b3a0f6ffc5efd7692053A9040fE44F9AC8c5Cb	3 of 5 signers	Both owner() slots above, so one signer set controls upgrades and every privileged function

Source: Etherscan, October 12, 2026

The implementation inherits neither AccessControlUpgradeable nor PausableUpgradeable. No MINTER_ROLE, PAUSER_ROLE, BLACKLIST_MANAGER_ROLE, or equivalent constant separates the mint, blocklist, and upgrade authorities, and no pause() or whenNotPaused lever exists, so containing an exploit on the deployed proxy depends on a ProxyAdmin upgrade or on the blocklist. Nothing bounds the size of an owner call either: no amount cap, per-transaction limit, or rate limit constrains mint or destroyBlockedFunds, so the multisig can mint or seize-and-burn an unbounded amount in one transaction. renounceOwnership() is not overridden to revert on either contract, so the owner can unilaterally orphan the upgrade path or the privileged-function surface. No forward commitment to migrate to a role hierarchy, add a pause, override renounceOwnership(), or split upgrade authority from privileged-operations authority has been made.

4.2.2 Timelock Duration and Function

No timelock is wired into either the upgrade path or the implementation. Neither the ProxyAdmin nor the implementation interposes a delay between an owner-authorised proposal and execution. Once the owning multisig collects threshold signatures, the upgrade or privileged-function call executes atomically. No forward commitment to introduce a timelock on the upgrade path or the privileged-function surface has been made.

4.2.3 Multisig Threshold / Signer identity

The owner address is a legacy Consensys-style MultiSigWallet, the same multisig version Tether uses for its USDt privileged-function surface. As a legacy MultiSigWallet, it exposes required() for the threshold and getOwners() for the signer list. It is a 3 of 5 signing threshold over the following five signatories:

• 0x6744A526C21015f46559083CBc1984CC23138aF2
• 0x106743fDe530388d0e4963d28189e8868F151511
• 0xD3Fc71bDE8a7E6c6F8b5665C2398e5DCA025c680
• 0x682986313e971e197d1aFe75F07c54C0e0f8dbc9
• 0x1e1Ed3720091Fbe7F3Ee178fe63E9633641fD58D

Permissioned functions on the implementation:

Function	Caller	Modifier
mint(address,uint256)	owning multisig	onlyOwner
redeem(uint256)	owning multisig	onlyOwner, burns from the owner’s own balance
addToBlockedList(address)	owning multisig	onlyOwner
addMultipleToBlockedList(address[])	owning multisig	onlyOwner
removeFromBlockedList(address)	owning multisig	onlyOwner
removeMultipleFromBlockedList(address[])	owning multisig	onlyOwner
destroyBlockedFunds(address)	owning multisig	onlyOwner; reverts if the target is not currently blocklisted
transferOwnership(address)	owning multisig	onlyOwner
renounceOwnership()	owning multisig	onlyOwner (NOT overridden — owner can renounce)
transfer / transferFrom / multiTransfer	any holder	reverts if the sender or the caller is on the block list, and a blocked address can still receive
permit(...) (ERC-2612)	any holder	none

Source: Etherscan, October 12, 2026

Upgrade-path functions on ProxyAdmin:

Function	Caller	Modifier
upgrade(address,address)	ProxyAdmin.owner()	onlyOwner
upgradeAndCall(address,address,bytes)	ProxyAdmin.owner()	onlyOwner
changeProxyAdmin(address,address)	ProxyAdmin.owner()	onlyOwner
transferOwnership(address)	ProxyAdmin.owner()	onlyOwner
renounceOwnership()	ProxyAdmin.owner()	onlyOwner (NOT overridden — owner can renounce)

Source: Etherscan, October 12, 2026

Disclaimer

This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.

The information provided should not be construed as legal, financial, tax, or professional advice.