Skip to main content

Stablecoin Provider Disclosures Tracker: Audits, Licenses, Status Pages

Stablecoin provider licenses, audits, reserve attestations and status pages, tracked from each provider's own disclosures.

Written by Eco
Stablecoin Provider Disclosures Tracker: Audits, Licenses, Status Pages

A stablecoin provider disclosures tracker lists what issuers and transfer providers publish about themselves: smart contract audits, reserve attestations, regulatory licenses and public status pages. It records whether a document exists and where, so a buyer can read it directly. It does not grade any provider. For example, Circle publishes weekly USDC reserve holdings and monthly third-party assurance from a Big Four accounting firm (Circle transparency), and Tether publishes quarterly reserves reports with ISAE 3000R assurance from BDO Italia (Tether transparency).
​

Last reviewed: Nov 2026. Each row links to the provider's own page. "Not on pages reviewed" means the document was not found on the pages listed in the sources, not that it does not exist.
​

What the Tracker Covers

The tracker covers four disclosure types that procurement and risk teams ask for when evaluating stablecoin infrastructure. Each is recorded as present with a link, or as not found on the provider pages reviewed. No disclosure is scored, and no provider's safety is assessed.

  • Audits: public smart contract security reviews, with firm names where listed.

  • Reserve attestations: for issuers, independent reports on reserves.

  • Licenses: regulatory authorizations stated on the provider's own site.

  • Status pages: public operational status with uptime history.

Which Providers Publish What?

Issuers lead on reserve attestations and licensing because regulation requires it of them. Transfer rails and routing layers lead on audits, since their risk sits in smart contracts. Public status pages with uptime history are the least common disclosure among the providers reviewed.
​

Provider

Type

Audits

Attestations

Licenses

Status page

Sources

Circle (USDC, CCTP)

Issuer and rail

Not on pages reviewed

Monthly, Big Four firm

EMI, ACPR France (MiCA)

Public, 90-day uptime

Tether (USDT)

Issuer

Not on pages reviewed

Quarterly, BDO Italia

Not on pages reviewed

Not on pages reviewed

USDT0

Token rail (LayerZero OFT)

Guardian, ChainSecurity, Paladin

n/a

Not on pages reviewed

Not on pages reviewed

Eco Routes

Routing layer

Cantina, 4 reports

n/a

Not on pages reviewed

Not on pages reviewed

Across

Routing layer

Not on pages reviewed

n/a

Not on pages reviewed

Password-protected

Wormhole

Messaging rail

29 third-party audits

n/a

Not on pages reviewed

Not on pages reviewed

Hyperlane

Messaging rail

Multiple, public list

n/a

Not on pages reviewed

Not on pages reviewed

LayerZero

Messaging rail

Public audit repository

n/a

Not on pages reviewed

Not on pages reviewed

Provider Notes

Each note below follows the same shape: what is published, where, and one detail a reviewer should know when reading it. The order matches the table.
​

Circle

Best for: buyers that need issuer-level reserve and licensing evidence. Pros: Circle reported $68.9 billion of USDC in circulation and $69.1 billion of reserves as of November 9, 2026, names Deloitte & Touche LLP as its independent auditor, and links monthly assurance reports (Circle transparency). Its French entity obtained an Electronic Money Institution license from the ACPR on July 1, 2024 to issue USDC and EURC under MiCA (Circle press release). Cons: the status page reported 98.99% 90-day uptime for the CCTP group on November 11, 2026, below the 100% shown for the Attestation Service component, so read component rows separately (Circle status).
​

Tether

Best for: buyers that need USDT reserve evidence. Pros: the latest reserves report is dated September 30, 2026 and lists total assets of $191.45 billion against total liabilities of $183.50 billion (Tether transparency). Cons: reserves reports are quarterly, and Tether notes they are prepared by management and "are not financial statements."
​

USDT0

Best for: teams moving USDT across chains. Pros: three named audits, a public audit repository, a 3-of-3 DVN requirement and an Immunefi bug bounty of up to $6,000,000 (USDT0 security). Cons: no public status page found.
​

Eco Routes

Best for: teams evaluating an intent-based routing layer. Pros: the contracts repository hosts Cantina reports from December 2024, February 2025, May 2025 and November 2025 (eco-routes audits). Cons: no public status page found.
​

Across, Wormhole, Hyperlane, LayerZero

Best for: reviewing rail and router security models. Pros: Across documents its optimistic verification and bonds (Across security); Wormhole states a 13-of-19 guardian threshold and 29 audits (Wormhole security); Hyperlane lists audits by ChainLight, Trail of Bits, Hacken and others (Hyperlane audits); LayerZero's audit repository was last updated October 22, 2026 (LayerZero audits). Cons: no public status pages found for these four.
​

How Should a Buyer Use These Disclosures?

Disclosures are evidence to read, not a substitute for diligence. An audit covers a code version at a date, an attestation covers reserves at a date, and a status page covers past availability. The useful step is matching each document to the risk it addresses in your own flow.
​

Risk in your flow            Document to request or read
---------------------------  ------------------------------------
Issuer cannot redeem          Reserve attestation, license
Contract bug in transit       Audit of the deployed version
Route stalls                  Status page history, incident log
Regulatory exposure (EU)      MiCA authorization of the issuer

For how audit trails fit settlement records, see stablecoin audit trail standards; for SLA-oriented API comparisons, see stablecoin settlement APIs.
​

Where This Falls Short

The tracker reflects only what was found on the listed pages. Providers often hold licenses, SLAs and audits that are shared privately or posted elsewhere, and many publish updates after this review date. Absence in a cell is a prompt to ask the provider, not a finding.

  • Point in time: audits and attestations describe a date and version.

  • No SLA terms: no provider reviewed posts contractual SLA terms publicly.

  • No verdicts: nothing here rates any provider's safety.

Other Issuers in the Top Ten by Supply

USDT and USDC are not the only dollar stablecoins a routing stack may touch. PayPal USD and Ripple USD both rank among the ten largest by circulating supply, and both issuers publish reserve reporting on their own sites. Their disclosures are recorded here on the same terms.
​

Stablecoin

Issuer named

Supervision stated

Reserve reports

Attestation firm

Sources

PYUSD

Paxos Trust Company N.A.

Not on pages reviewed

Monthly

KPMG LLP, reports from February 28, 2025

RLUSD

Standard Custody

NYDFS, limited purpose trust company

Monthly, within 30 days of month end

US-licensed CPA, AICPA standards

DefiLlama reported about $2.77 billion of PYUSD and $2.70 billion of RLUSD in circulation on November 11, 2026 (DefiLlama).
​

PayPal USD (PYUSD)

Best for: buyers that need issuer evidence for a payments-oriented dollar token. Pros: Paxos names Paxos Trust Company N.A. as issuer, publishes monthly reserve reports, and states that attestation reports posted on or after February 28, 2025 are issued by KPMG LLP (Paxos PYUSD transparency). Cons: reports cover the reserve position at a reporting date, so they describe a point in time.
​

Ripple USD (RLUSD)

Best for: buyers that need a named state supervisor. Pros: Ripple states that Standard Custody, the issuer, is chartered and supervised by NYDFS as a limited purpose trust company, and that monthly reserve reports are available no more than 30 days after month end (Ripple RLUSD transparency). Cons: the transparency page describes the accounting firm as an independent US-licensed CPA without naming it.
​

How to Read Each Disclosure Type

Each disclosure type answers a narrow question and has a typical blind spot. Reading them correctly means checking the date, the scope and who prepared the document before relying on it. The notes below apply to every provider in the tracker, not to any single one.
​

Reserve reports and attestations

These describe reserves at a reporting date. Cadence differs: Circle discloses holdings weekly with monthly third-party assurance (Circle transparency), Paxos and Ripple report monthly (Paxos PYUSD transparency, Ripple RLUSD transparency), and Tether reports quarterly (Tether transparency). Check who prepared the underlying figures and which standard the accountant applied.
​

Smart contract audits

An audit covers one code version on one date. Match the audited version to what is deployed. Hyperlane's list, for example, separates audits by component, including a Trail of Bits review of Protocol v3 dated September 2023 and a ChainSecurity audit listed under USDT (Hyperlane audits).
​

Bug bounties

A bounty shows a standing invitation to report flaws, not a finding. USDT0 states a maximum of $6,000,000 through Immunefi (USDT0 security), and Wormhole also runs an Immunefi program (Wormhole security).
​

Status pages

Read component rows, not only the headline. Circle's page showed 98.99% for the CCTP group and 100% for its Attestation Service component on November 11, 2026 (Circle status).
​

Disclosure Cadence at a Glance

Cadence tells a reviewer how stale a document can be on any given day. The table lists the latest date or stated frequency seen for each recurring disclosure when the pages were reviewed, so a reader can tell whether a newer report should already exist before asking a provider for it.
​

Provider

Document

Stated cadence

Latest seen

Sources

Circle

USDC reserve holdings

Weekly

As of November 9, 2026

Tether

Reserves report

Quarterly

September 30, 2026

Paxos (PYUSD)

Reserve report

Monthly

Not recorded

Ripple (RLUSD)

Reserve report

Monthly, within 30 days

Not recorded

eco-routes repository

Cantina audits

None stated

November 2025

LayerZero

Audit repository

None stated

Commit of October 22, 2026

Frequently Asked Questions

These answers cover the questions buyers ask most about provider disclosures.
​

How often does Circle publish USDC reserve reports?

Holdings weekly and third-party assurance monthly (Circle transparency).
​

Who provides Tether's reserve assurance?

BDO Italia, on quarterly reserves reports (Tether transparency).
​

Where are Eco Routes audits published?

In the audits folder of the eco-routes repository (eco-routes audits).
​

Who issues the attestation reports for PYUSD?

KPMG LLP, for reports posted on or after February 28, 2025, according to Paxos (Paxos PYUSD transparency).
​

Which regulator supervises the issuer of RLUSD?

The New York State Department of Financial Services (NYDFS), which charters Standard Custody as a limited purpose trust company (Ripple RLUSD transparency).
​

Related Reading

Sources and Methodology

All rows come from provider pages fetched on November 11, 2026. Figures are quoted as the provider states them.

Did this answer your question?