The number was eighty-four million. The other number was "limited."
In the same news cycle, United States prosecutors seized $84 million from an offshore banking structure, and Tether issued a statement: its exposure to EQIBank was "limited." One figure was disclosed to the dollar. The other was disclosed as an adjective.
This asymmetry is the story. Not the seizure. Not the bank. The gap between what can be counted and what is offered as reassurance. In my first year auditing lending protocols, I learned that the most dangerous line in any specification is the one that declines to name a unit. A number can be modeled. A posture cannot. "Limited" is not a measurement. It is a defensive maneuver dressed as disclosure.
I opened the wire services expecting a technical event. I found something else: a trust-infrastructure event wearing the clothes of a routine FUD cycle. The system did not fail. The system was never built to be verified in the first place.
Context: what USDT actually is underneath
To understand why this matters, you have to separate the token from the trust.
USDT is a fiat-backed stablecoin. Its on-chain architecture โ multi-chain issuance, centralized mint and redeem, a 1:1 peg to the dollar โ has not changed in years. On Ethereum, on Tron, on Solana, the contract logic is boring. It executes. It transfers. It does exactly what the code says. If you are looking for the vulnerability in the smart contract, you will not find it there, because the vulnerability was never in the contract.
The security assumption of USDT rests entirely on the reserve. Every USDT in circulation is a claim against a pool of assets held off-chain: US Treasuries, cash, reverse repos, and โ critically for this analysis โ deposits at commercial banks. The peg holds not because the code enforces it, but because a custodian chain of counterparties stands behind it.
That chain is the part nobody audits in real time.
Tether's transparency instrument is a quarterly attestation, currently produced by BDO Italia. I want to be precise about what that word means, because the industry routinely blurs it. An attestation is a point-in-time snapshot. It confirms that on a given date, at a given hour, the reserves were at or above the liabilities. It does not test the reserves continuously. It does not penetrate to the level of a single bank exposure. It is a photograph, not a live feed.
For most of USDT's history, that photograph has been sufficient. The token has never durably broken its peg. That track record is the real product Tether sells โ not the token, but the memory of stability. And memory, as any auditor knows, is not evidence. Verification > Reputation.
EQIBank sits at the bottom of that chain. It is an offshore institution, registered in a jurisdiction chosen for regulatory latitude rather than regulatory rigor. Tether's history of banking relationships has followed a recognizable pattern: when a domestic US banking channel becomes politically expensive, the channel moves offshore. Deltec in the Bahamas was one node. EQIBank appears to be another. This is not a scandal. It is a design choice, and it is the specific design choice that created this exposure.
Core: the custody chain as an attack surface
The corporate governance layer of this event โ the payment company, the prosecutors, the bank โ is downstream. The technical core is the structure. Let me lay it out the way I would in an audit report.
The flow of funds creates a triangle:
