Stablecoin Security and Risk Guide: Depeg, Freeze, Bridge and Issuer Risk

A stablecoin is only as stable as its issuer, its reserves, the keys that control its smart contracts and the bridge it travelled across, and most organisations that hold or accept stablecoins have assessed none of these. Stablecoins are now used for treasury, cross-border payments, merchant settlement and on-chain trading, which turns issuer and infrastructure risk into ordinary operational and counterparty risk. This guide breaks stablecoin exposure into six risk areas (issuer and reserve, redemption and depeg, admin keys and contract control, freeze and blocklisting, bridges and chain choice, and payment operations), with controls, metrics and a treasury policy you can adopt. It is written for treasury, finance, payments, risk and security teams at companies that hold, accept or integrate stablecoins, and it goes deeper on stablecoins than the Web3 and Crypto Security Guide.

Key takeaways

• You hold a claim on an issuer, not a dollar: the Bank for International Settlements describes stablecoins as issuer-specific liabilities whose secondary-market price can deviate from par, so issuer and reserve quality are the first risk to assess.
• Redemption is narrower than it looks: issuers redeem at par only for verified, onboarded customers, subject to minimums, fees and jurisdiction, so most holders exit through markets that can trade below one dollar.
• Freeze is a feature: major fiat-backed issuers reserve the right in their terms to block addresses and freeze tokens, which protects against crime but also creates counterparty and sanctions exposure for innocent recipients.
• Bridged is not native: a token wrapped by a third-party bridge depends on that bridge's contracts and signing keys, while issuer-run burn-and-mint transfers keep the issuer as the only counterparty.
• Treat every wallet and signer as a privileged identity: treasury wallets, payment hot wallets and the service accounts that sign transactions need the same lifecycle, least privilege and monitoring as any privileged non-human identity.

How stablecoins differ, and why the type drives the risk

The BIS Annual Economic Report 2025 (chapter III) tests stablecoins against three properties of sound money: singleness (settlement at par, no questions asked), elasticity (the ability to supply liquidity when needed) and integrity (resistance to financial crime). It concludes they perform poorly on all three. That framing is useful for practitioners because each failure maps to a risk you can manage.

The BIS notes that over 99% of stablecoins by value are US dollar-denominated and that growth is concentrated in two issuers' tokens, USDT and USDC. Concentration is itself a risk: a treasury policy that allows only one token has one issuer as a single point of failure.

Issuer and reserve risk

For a fiat-backed token, the questions are what the reserve holds, where it is held, whether it is segregated from the issuer's own assets, and how often an independent party checks it. Issuer terms differ materially on these points. Issuers below are listed alphabetically, and the order is not a ranking.

Regulators set a benchmark for good reserve practice. The New York Department of Financial Services guidance on US dollar-backed stablecoins (8 June 2022) requires reserves whose market value at least equals outstanding tokens at the end of each business day, segregation for holders, custody at insured depository institutions or approved custodians, and reserve assets limited to US Treasury bills of three months or less, overnight reverse repos collateralised by Treasuries, government money market funds and capped deposits. It requires a monthly examination by an independent licensed CPA, covering the last business day and at least one randomly chosen day, published within 30 days, plus an annual attestation on internal controls.

• Read the attestation, not the headline: check the date, the firm, the standard used, whether it covers a single day or a period, and whether it includes internal controls. A point-in-time attestation does not show what happened between dates. See the Proof of Reserves Guide.
• Know the regime: in the US, the GENIUS Act created a federal framework for payment stablecoin issuers; in the EU, MiCA regulates e-money tokens and asset-referenced tokens. See the GENIUS Act Stablecoin Guide and the MiCA and DORA for Crypto-Asset Service Providers Guide.
• Watch reserve banks: fiat-backed tokens have traded below par when a bank holding part of the reserves failed. Ask how reserves are spread across institutions.

Redemption and depeg risk

A depeg happens when the market price departs from the reference value. The BIS points out that stablecoins face a cash-in-advance constraint, cannot expand their balance sheets elastically like banks, and have seen larger redemptions when monetary policy tightens. The practical control is understanding exactly who can redeem, how fast and at what cost.

• Eligibility: Circle's terms allow only Circle Mint account holders to redeem directly, after KYC and in supported jurisdictions; Tether's terms require holders to be verified Tether customers and apply minimum redemption amounts. Everyone else exits by selling on a market.
• Market price is not guaranteed: Circle's terms state it does not guarantee the price of USDC on third-party platforms, where it can trade above or below one dollar.
• Chain support changes: Tether's terms record that it stopped redeeming USDT issued on several blockchains, including Omni and Algorand, from 1 September 2025. Tokens on a deprecated chain can become hard to redeem at par.
• Timeliness benchmark: NYDFS treats redemption as timely if completed within two full business days (T+2) of a compliant order, for the issuers it supervises.

Decision guidance: if you hold stablecoins as treasury, either open a direct redemption relationship with each issuer you hold or set an exposure cap that reflects the cost of exiting through markets under stress. Merchants that accept stablecoins and convert daily through a payment processor carry less depeg exposure than treasuries that hold for weeks, but they carry processor counterparty risk instead.

Admin keys and contract control

Most fiat-backed stablecoins are smart contracts with privileged roles: minting, burning, pausing, blocklisting, upgrading the contract logic and assigning those roles. Whoever controls those keys controls the token. For holders this is issuer risk; for issuers and protocols that deploy their own token it is the most important security control they own.

These roles are non-human identities in every practical sense: long-lived credentials, often used by automation, with very high privilege. Inventory them, assign a human owner, separate duties between roles, keep keys in hardware or threshold schemes, and alert on every use. See the Multisig Treasury Operations Guide and the MPC Wallet and Threshold Signing Security Guide.

Freeze and blocklisting risk

Centralised issuers can freeze tokens. Circle's terms say it may block addresses it believes, in its sole discretion, may be associated with illegal activity, may freeze USDC held at blocked addresses, and may freeze USDC or surrender reserves under a valid government order; sending to or receiving from a blocked address can lead to account termination and loss of redemption rights. Tether's terms allow freezing as required by law or where it considers it prudent, and blacklisting of addresses used for prohibited purposes. The BIS notes that such freezes mitigate but do not eliminate integrity risk, and that mistaken or fraudulent stablecoin payments are generally irreversible.

• Inbound screening: screen counterparty addresses before accepting payment, so you do not receive funds that are later frozen or that create a sanctions breach. See the Crypto Travel Rule Compliance Guide.
• Exposure to frozen funds: treat a freeze as a credit event in treasury policy, with a playbook for engaging the issuer and law enforcement.
• Freeze as a recovery tool: after theft, a fast report to the issuer with transaction hashes can lead to stolen tokens being frozen before they are swapped. Pre-record issuer contact routes in your incident plan. See the Web3 Incident Response Playbook.
• Decentralised alternatives: crypto-collateralised tokens without a freeze function remove issuer freeze risk but add smart contract, oracle and liquidation risk, and offer no recovery path after theft.

Bridges and chain choice

The same ticker can mean different assets on different chains. A token issued natively by the issuer on a chain is a direct claim on the issuer. A wrapped token minted by a third-party bridge is a claim on the bridge, which holds the original tokens locked elsewhere; if the bridge's contracts or signing keys are compromised, the wrapped token can become unbacked even though the issuer is untouched.

Circle's developer documentation states that CCTP V2 is the current version (V1 is legacy, still required on some chains), with Fast Transfer in roughly 8 to 20 seconds and Standard Transfer in 15 to 19 minutes on Ethereum and layer 2 networks. Keep an allowlist of token contract addresses per chain, prefer native issuance where available, and treat every third-party bridge as a vendor subject to due diligence. See the Cross-chain bridge security guide.

Payment operations, wallets and identity

For companies paying or accepting stablecoins, most losses come from operations rather than from the token: drained hot wallets, address poisoning, approval phishing, wrong-chain transfers and compromised signing infrastructure.

• Wallet tiering: hold most value in cold or threshold-signed wallets, with a small, capped hot wallet for daily payments, refilled under multi-party approval.
• Address allowlisting: pay only to pre-approved addresses with a waiting period for new ones; verify full addresses out of band to defeat address poisoning lookalikes.
• Token allowlisting: accept only specific contract addresses on specific chains; reject lookalike tokens that copy a ticker.
• Machine identities that sign: payment services, custody APIs and AI agents that initiate transfers hold credentials equivalent to signing authority. Use scoped API keys, per-transaction limits, policy engines and human approval above thresholds. See the AI Agents with Crypto Wallets Security Guide and the Crypto Wallet Security Guide.
• Developer and supply chain hygiene: signing interfaces and wallet libraries have been targeted through compromised packages and developer machines. See the Web3 Developer Operational Security Guide.

A phased stablecoin treasury rollout

1. Policy first: approve permitted tokens, chains, contract addresses, exposure caps per issuer and per chain, and depeg and freeze triggers.
2. Issuer due diligence: review terms, redemption eligibility, reserve reporting and regulatory status for each issuer; open direct redemption relationships where volume justifies it.
3. Custody build: deploy cold, warm and hot tiers with threshold signing, address allowlists and transaction policies; test recovery of every key.
4. Pilot: run small-value payments on one chain, reconcile to the ledger daily, and rehearse a depeg, a freeze and a lost-key scenario as tabletop exercises.
5. Scale and monitor: add chains and counterparties one at a time, with monitoring and alerting live before go-live.
6. Rollback: keep a documented path to convert stablecoin holdings to fiat through at least two independent routes, so you can exit if an issuer, bridge or chain fails.

Small vs large organisations: a small business accepting stablecoin payments is usually better served by a regulated payment processor that converts to fiat on settlement, keeping no balance on chain. A treasury holding significant balances needs its own custody, direct issuer relationships, diversified issuers and a board-approved policy.

Detection and measurement

Monitor both the market and your own infrastructure.

• Market signals: price deviation from par across venues, redemption and mint volumes, reserve report publication dates, issuer announcements on chain support.
• Contract events: role changes, pauses, upgrades and blocklist updates on the token contracts you hold, and large mints relative to reported reserves.
• Your wallets: every outbound transaction, new token approvals, transfers to non-allowlisted addresses, and signer key use outside expected hours.

Useful metrics:

• Largest single-issuer and single-chain exposure as a percentage of stablecoin holdings, against policy caps.
• Days since the latest independent reserve report for each held token.
• Percentage of holdings redeemable directly with the issuer by your entity.
• Percentage of outbound value sent to allowlisted addresses (target 100%).
• Time to detect and escalate a depeg beyond a set threshold, measured in exercises.
• Privileged keys and signing service accounts with a named owner and a tested recovery procedure.

Framework mapping

Common failure patterns

• Assuming par: booking stablecoins as cash equivalents without checking whether the entity can redeem directly, then discovering in a stress event that the only exit is a falling market.
• Accepting the wrong token: taking a bridged or lookalike token because the ticker matches, then finding it is a claim on a bridge rather than the issuer, or worthless.
• One issuer, one chain: concentrating treasury in a single token on a single chain, so a freeze, depeg or chain deprecation hits all holdings at once.
• Hot wallets as treasury: leaving large balances in a single-key hot wallet controlled by an automated payment service, where one leaked credential drains everything.
• Unscreened inbound funds: receiving funds from addresses later blocklisted or sanctioned, leading to frozen balances and compliance investigations.
• Unmonitored admin keys: issuers and protocols that deploy their own tokens with an upgrade or minter key held by one person or one server, with no timelock or alerting.

Practitioner checklist

• Publish a stablecoin policy listing permitted issuers, chains and contract addresses, with exposure caps.
• Review each issuer's terms for redemption eligibility, freeze rights, reserve composition and segregation.
• Check the date and scope of the latest independent reserve report before increasing exposure.
• Prefer native issuance or issuer burn-and-mint transfers; treat any third-party bridge as a vendor.
• Hold value in cold or threshold-signed wallets with allowlisted destinations and multi-party approval.
• Give every signing service, API key and agent a named owner, scoped limits and monitored use.
• Screen inbound and outbound counterparty addresses for sanctions and blocklist exposure.
• Monitor par deviation and token contract role changes, with alert thresholds and escalation.
• Rehearse depeg, freeze, bridge failure and key loss scenarios at least annually.
• Maintain two independent routes to convert holdings to fiat.

Standards and references

• Bank for International Settlements: Annual Economic Report 2025, chapter III on stablecoins and the monetary system
• New York State Department of Financial Services: Guidance on the Issuance of U.S. Dollar-Backed Stablecoins
• Circle: USDC Terms
• Circle Developer Docs: Cross-Chain Transfer Protocol
• Tether: Terms of Service
• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Web3 and Crypto Security Guide · GENIUS Act Stablecoin Guide · Proof of Reserves Guide · Multisig Treasury Operations Guide · Non-Human Identity (NHI) Guide