According to CoinMeta, independent researchers have published a technical analysis of the smart contract of the USD1 stablecoin, pointing out that its highest-level permissions allow the issuer to transfer USD1 from users' accounts to their own or other wallets without user consent. The research also found that the source code published on the official GitHub for USD1 does not match the code actually deployed on the chain; the latter added features for “drain” and “reallocate” during an upgrade in April 2026. This practice of presenting clean code to auditors and users is considered a typical tactic used by scammers to flee with funds. The company is currently seeking a franchise from the National Trust Bank of the United States, and the methods it uses are highly consistent with those described in fraud exit manuals.