Tether, the wholly owned division of iFinex Inc. that offers the USDT stablecoin, claims it’s being extorted by threat actors demanding a payment of 500 bitcoin ($24.625 million) not to publish allegedly stolen emails.

In a series of tweets Sunday on its Twitter account, Tether said that documents circulating online purporting to be between Tether personnel, a representative of Deltec Bank & Trust Ltd. and others were “bogus.” The tweets described receiving a ransom demand with a threat that unless payment was made, those behind the demand will leak documents to the public in an effort to “harm the bitcoin ecosystem.”

“We are not paying,” Tether said, noting that it was unclear whether this is “a basic extortion scheme like those directed at other crypto companies or people looking to undermine Tether and the crypto community as a whole.”

Tether added that “while we believe this is a pretty sad attempt at a shakedown, we take it seriously. We have reported the forged communications and the associated ransom demand to law enforcement. As always, we will fully support law enforcement in an investigation of this extortion scheme.”

Although Tether said current documents circulating online are fake, whether other legitimate documents have been stolen are at best open to speculation. One such email, counted among those claimed to be bogus by Tether shows an attempt to fool regulators over the company’s holding of U.S. dollars to back USDT. The issue that arguably arises is that even if the email itself may be fake, Tether has admitted to dipping into its U.S. dollar reserves previously.

That resulted in parent company iFinex being sued by the New York Attorney General’s office in April 2019 in a case settled Feb. 23. As part of the settlement, iFinex agreed to pay a fine of $18.5 million in return for admitting no wrongdoing, along with a number of other compliance requirements for the next two years.

“This case is interesting in view of the previous legal proceedings of the victims: cybercriminals may deliberately target vulnerable organizations susceptible to racketeering tactics,” Ilia Kolochenko, founder and chief executive of web security company ImmuniWeb, told SiliconANGLE.

“Under the circumstances, it would be reasonable to negotiate with the hackers, while urgently performing an internal investigation,” Kolochenko explained. “It may be a good idea to run the forensic investigation under the direction of an external law firm: this may later preclude discovery of the investigation report in court proceedings if such are initiated by victims of the alleged breach.”

Without understanding the scope and the impact of the alleged breach, it is impossible to make sound decisions whether to pay or not to pay, Kolochenko added. “Sometimes, paying may be the only solution to protect the company and its clients, but no guarantee exists that attackers will honor their promises or stop the extortion,” he said.

Image: Tether