On September 4, 2026, Orionx, one of Chile's leading crypto exchanges, shut its doors. Not with a cautious statement, but with a direct accusation: its former founding executives allegedly siphoned millions of dollars from clients. Behind that closure lies a detail no one had sufficiently highlighted until now: fifteen months before the collapse, in June 2025, Tether had exclusively led Orionx's Series A funding round. The company behind USDT, the world's most-used stablecoin, had chosen to bet on an exchange that was, by then, operating entirely outside regulatory oversight in Chile — and that today sits at the center of a criminal complaint for disloyal management (administración desleal).
This is a reconstruction of what happened, with names, dates and figures, based on the criminal complaint, forensic audits and public statements from all parties involved.
The $6 Million Hole Discovered by Accident
The story begins on August 27, 2026. Thomas Mac Millan, Orionx's Chief Operating Officer — hired in March 2025 under new CEO Joel Vainstein, a co-founder who took charge in January 2025 — notices a mismatch between the balances recorded in the internal system and the real holdings in custody. Not a rounding error: a hole later quantified with surgical precision in the complaint at $6,066,152.65.
Orionx activates an internal ad hoc committee and commissions an external forensic audit. The results come quickly: on September 2, 2026, the company files a criminal complaint against two former executives — Roberto Zibert, former general manager, and JoaquÃn DÃaz, former head of technology — for disloyal management. Two days later, on September 4, Orionx publicly announces the platform's closure and the complaint filed with Chile's Public Prosecutor's Office, accusing the former partners of irregularities exceeding $7 million (source: La Tercera, journalist Maximiliano Villena, two articles dated 9/4/2026).
One detail that is far from secondary: according to a statement from Chile's Comisión para el Mercado Financiero (CMF), the financial regulator, represented by Catherine Tornel, Orionx had already had its authorization request rejected under the new FinTech Law back in June 2026 — barely two months before the collapse. In other words, by the time the hole was discovered, Orionx was already operating outside the formal financial supervision perimeter.
The Blockchain Trail: BTC, ETH, USDT to Personal Wallets
The most solid part of this investigation — because it is verifiable, not opinion — is the on-chain reconstruction contained in the criminal complaint and reported by La Tercera. Here's what emerges:
- Roberto Zibert had his own Binance account, which allowed investigators to trace movements to wallets registered as "Incremental" and "Luis Zibert."
- The account comisiones@orionx.com, which under the company's internal structure was supposed to handle only ordinary small commission flows, was instead used to move anomalous quantities of bitcoin.
- The account coldstorage@orionx.com — the exchange's digital vault — shows a suspicious movement of 70 BTC and, on a specific date, February 4, 2021, a transfer of 30 BTC to a hot wallet on Celsius, the crypto lending platform that later collapsed in 2022.
- Through Zibert's Celsius account combined with comisiones@orionx.com, a total of 79 BTC was transferred to an unidentified account. What makes this movement suspicious, according to the complaint, is that Orionx never had an official corporate account on Celsius — that channel should not have existed at all.
- From the account robert@orionx.com on Binance, the wallets "Luis Zibert"/"Incremental" received multiple transfers originating from the "Trezor Orionx Cold Wallet" — the company's hardware vault — totaling 187 ETH, 4,146,643 USDT and 200,000 USDC.
- A wallet linked to JoaquÃn DÃaz, labeled "Binance Joaco," received over $1.5 million across 14 separate transactions. DÃaz reportedly admitted the account was his, adding that it was also used by a former employee, Juan José Merino.
- Another wallet, active between March 28 and December 24, 2021, received over $1.3 million.
The period in which these suspicious operations concentrate runs from 2018 to 2021 — years before the discovery, a detail that raises the question of how such movements could remain invisible to internal controls for so long.
The Forensic Audit: The System Was Lying About Real Balances
The audit commissioned by Orionx compared the company's internal accounting — what the system showed clients as their available balance — against actual on-chain holdings, publicly verifiable on the blockchains of four cryptocurrencies: bitcoin, ether, XRP (Ripple) and Polygon.
The result is unambiguous: in all four cases, the balance declared by the internal system was higher than the real amount in custody. The discrepancies, according to the audit:
- Bitcoin (BTC): $3,933,950.65
- Ethereum (ETH): $2,286,474.58
- XRP: $762,016.60
- Polygon: $201.39
The complaint hypothesizes that the overall hole — $6,066,152.65 — resulted from a combination of direct fund misappropriation and trading losses accumulated by employees, never reported or corrected in internal balance sheets.
The Tether Connection: An Exclusive Deal 15 Months Before the Crash
Here comes the element that sets this story apart from a routine internal fraud case at a regional exchange: in June 2025 — roughly fifteen months before the closure — Tether exclusively led Orionx's Series A funding round (source: Cointelegraph, relayed by Lookonchain). Tether is the issuer of USDT, the most capitalized and most-traded stablecoin in the world, and one of the most influential players in the entire crypto ecosystem.
At the time the investment news broke, according to Cointelegraph, neither Tether nor Orionx had responded to requests for comment on the deal's details. To date, no public statement from Tether or its CEO Paolo Ardoino specifically addressing the closure and the criminal complaint has been found. A silence that, on its own, proves nothing — but is worth flagging, because Tether had chosen to exclusively invest in a platform that would see its regulatory authorization rejected barely a year later, and that would collapse over a multimillion-dollar hole traceable — according to the complaint, not yet a verdict — to two of its top executives.
It is important to be precise on this point: there is, to date, no evidence that Tether was aware of Orionx's internal irregularities at the time of the investment, nor that it was in any way complicit. The verified fact is solely that it exclusively funded the company fifteen months before its collapse, and that it has not yet commented publicly on the matter.
The Accused's Defense: "We Categorically Reject the Charges"
Zibert and DÃaz have not stayed silent. On September 4, 2026, the same day the closure was publicly announced, the two responded directly to Orionx clients via email — not an official public statement, but a text reported by local media, including La Cuarta (journalist Paulo Quinteros).
In the email, the two former executives write verbatim: "Rechazamos categóricamente los cargos que se nos imputan. Nunca hemos actuado en contra de los intereses de nuestros clientes" — "We categorically reject the charges brought against us. We have never acted against the interests of our clients."
According to their version, the two claim to have cooperated since the first signs of accounting inconsistencies emerged, and dispute that there is, in their words, "certeza ni claridad" — certainty nor clarity — about the actual origin of the missing funds. They also request an independent investigation with full access to all case records.
This is a point that deserves the same weight as the accusations: at this stage, Zibert and DÃaz are accused in a criminal complaint, not convicted. The on-chain reconstruction described above comes from the complaint itself — that is, from the accusing party — and not from a final ruling. Their version of events, however solid the documentary reconstruction may appear, still has to be tested in court.
A Date That Doesn't Add Up
One technical detail deserves attention for completeness, even though it doesn't change the substance of the case: in the chronological reconstruction contained in the complaint, the internal ad hoc committee's report is dated November 14, 2025 — a date that would precede the discovery of the hole (August 27, 2026) by months, and which therefore appears to be a likely typo, perhaps a mistranscribed August 14, 2026. It has not yet been possible to verify the correct date through an independent secondary source: the detail does not affect the substance of the allegations, but we flag the discrepancy for transparency, pending confirmation.
What Remains Unclear
The Orionx case combines three elements rarely found together in a single story: a regulator that had already rejected the platform's authorization, a detailed on-chain reconstruction of suspicious movements spanning years before discovery, and a top-tier investor — Tether — that chose to exclusively fund the company just months before everything came to light.
There is, to date, no evidence linking Tether to the alleged internal irregularities. But there is an open question that deserves a public answer: what due diligence was conducted before exclusively leading a funding round in an exchange that, a year later, would turn out to lack regulatory authorization and to have a multimillion-dollar hole in client funds?
The case is now in the hands of Chilean prosecutors. Orionx has closed. Zibert and DÃaz reject the accusations. Tether, so far, has said nothing.
Sources
- La Tercera, Maximiliano Villena, 9/4/2026 (two articles: complaint/wallet/audit details; closure announcement and CMF statement)
- La Cuarta, Paulo Quinteros, 9/4/2026 (Zibert/DÃaz defense)
- Cointelegraph via Lookonchain (Tether connection — Series A, June 2025)