Cyber Threat Actor: Tether Dox

Tether Dox is a threat actor known by that alias and has been linked to activity originating from the United States of America. The only publicly reported incident involving this actor occurred on February 28 2021, when a cryptocurrency firm received a ransom demand of 500 Bitcoin, valued at roughly 24 million dollars, accompanied by a threat to leak sensitive documents purportedly harmful to the broader Bitcoin ecosystem. The firm publicly refused to pay the ransom, stating it would not comply with the extortion attempt despite the potential risks of document exposure. No confirmed data breach or subsequent leak was disclosed in the immediate aftermath of the refusal.

Based on the reported incident, Tether Dox’s observed targeting appears to focus on cryptocurrency‑related organizations, suggesting a sector‑specific interest in blockchain entities. The actor’s demonstrated objective in this case was financial gain through extortion, as evidenced by the direct demand for Bitcoin payment. The threat to release damaging documents served as leverage to increase pressure on the victim, indicating that the actor combines monetary demands with reputational harm as part of its extortion tactic. No additional sectors, regions, or strategic aims such as espionage or disruption have been identified in open sources concerning this actor.

Publicly available information does not specify any malware families, initial access vectors, or particular tooling associated with Tether Dox, and no technical details about its operational methods have been disclosed. Likewise, no clear attribution to a state sponsor, criminal consortium, or other affiliations has been established in the reporting to date. The February 2021 extortion attempt remains the sole notable campaign publicly tied to Tether Dox, highlighting its use of ransom demands coupled with data‑leak threats against cryptocurrency firms. This profile reflects only the facts that have been made public about the actor.