USDT Blacklist 2026: Who's On It, How Tether Decides

The USDT blacklist is a list of Ethereum and Tron addresses that Tether has flagged as blocked from sending or receiving USDT. Tether maintains the list on-chain via the addBlackList function on the USDT smart contract, which only Tether's owner address can call.

As of July 26, 2026, the list contains 9,597 addresses across the two chains and immobilizes $5.69 billion in stablecoin value. Ten new addresses were added in the last twenty-four hours. That scale, plus the regulatory shifts of the last eighteen months (the U.S. GENIUS Act, Hong Kong's Stablecoins Ordinance), is why the blacklist matters to every OTC desk, payment processor, exchange, and serious USDT holder. This is the plain-English guide: what the list is, who runs it, who ends up on it, and what changes in 2026.

What the USDT blacklist actually is

The USDT blacklist is a set of addresses stored inside the USDT smart contract for which the contract refuses to move tokens. It lives as a mapping in on-chain contract storage that changes the behavior of USDT for the addresses it contains, not as an off-chain spreadsheet or a legal document.

There are three functions that operate on this mapping, all restricted to Tether's owner multisig:

addBlackList(address) adds an address to the list, blocking send, receive, and transfer of USDT.
removeBlackList(address) removes it, restoring transferability.
destroyBlackFunds(address) permanently burns the USDT balance at a blacklisted address.

When Tether calls the freeze function, three things happen at the same time: the on-chain flag flips to true, transfers involving that address revert on the contract, and a public event is emitted for indexers to pick up. Any wallet, block explorer, or compliance dashboard can verify the freeze state within seconds. For a full code-level walkthrough, see USDT Freeze: The Complete 2026 Guide.

Who controls it

Only Tether's owner multisig can modify the blacklist. On Ethereum, that authority sits on the USDT contract at 0xdAC17F958D2ee523a2206206994597C13D831ec7; on Tron it sits on the TRC-20 USDT contract at TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t. The multisig has a public delay between proposal and execution, so anyone watching the owner's activity can see a proposed freeze before it lands. No court, regulator, exchange, or DAO can force a freeze at the contract layer.

Two separate lists, one policy

Ethereum USDT and TRC-20 USDT are technically different tokens on different chains and maintain independent blacklists. Freezing an address on Tron does not freeze an equivalent address on Ethereum, though the same policy governs both lists. In practice, most 2026 freeze activity happens on Tron, where the majority of USDT payment volume flows.

A short history of the blacklist

Timeline 2017-2026: USDT contract deployed with blacklist functions (2017) → OFAC adds crypto to SDN list, first crypto SDNs (2018) → Poly Network 33M freeze then unfrozen (2021) → Tornado Cash OFAC designation, 38 ETH plus 6 USDC addresses (2022) → Standing OFAC coordination across 340+ agencies in 65+ countries (2023-2025 rolling) → 2025 record year 1.26B frozen, 55.6% burn ratio → 2026 Iran freezes: 475M in two events (April 344M + July 131M), ~1B cumulative since Operation Economic Fury. Footer: as of July 2026, 9,597 addresses blacklisted, 5.69B frozen.

2017-2019: origins

The blacklist functions have been in the USDT contract since the current Ethereum deployment in 2017. The variable naming in the deployed code (_evilUser in addBlackList, _clearedUser in removeBlackList) reveals the original framing: designed from day one as a punitive mechanism. Through 2018 and 2019, use was rare and mostly reactive: exchange hacks or clear thefts would prompt an isolated freeze, often after weeks of coordination.

2019-2022: growth and the first major freezes

As USDT supply scaled from single-digit billions to over $70B, the blacklist grew from a niche tool into a routine compliance instrument. The most visible use in this era was around exchange breaches. The Poly Network case in August 2021 is worth remembering because it ended in a full unfreeze: 33.4 million USDT was frozen, held for fifteen days, then released back to Poly Network's multisig after the attacker voluntarily returned every other asset. It is one of the cleanest examples of the mechanism working as a reversible hold rather than a permanent seizure.

2022-2024: the sanctions era

The August 2022 OFAC designation of Tornado Cash marked a shift. OFAC named 38 Ethereum wallet addresses (plus 6 USDC addresses) associated with the mixing service on the Specially Designated Nationals list, and Tether froze the corresponding USDT balances. That set the pattern that dominated the next two years: sanctions designations at government level, freeze execution at issuer level, typically within hours of the public announcement. Through 2023 and 2024, coordination expanded to what Tether's own reporting describes as cooperation with more than 340 law enforcement agencies across 65 countries and over $4.4 billion frozen in aggregate.

2025: the record year

Tether blacklisted 4,163 addresses and froze about $1.26 billion in USDT across Ethereum and Tron in a single year, the highest on record. In the same period, Tether destroyed $698 million via burn (55.6% of the year's freeze value) and removed 3.6% of blacklisted addresses, with a median 18.2-day freeze-to-remove interval for that removed subset. Read as same-period flow ratios, not strict cohort survival: destroys and removals recorded in 2025 can apply to addresses first blacklisted in earlier years. Those numbers reset the compliance conversation for 2026.

Who gets blacklisted (and why)

There are three broad reasons an address ends up on the USDT blacklist: a law enforcement request, a match against a sanctions program, or a flag from Tether's own risk models. The categories overlap. A single address can hit all three at once.

Law enforcement requests

The most publicly visible freezes come from specific criminal cases. In 2026, three cases have set the scale:

April 23, 2026 · $344M coordinated freeze across two Tron addresses (TNiq9...QZH81 holding $213M and TTiDL...pjSr9 holding $131M). OFAC designated both addresses as property of Iran's Bank Markazi (Central Bank of Iran) with linkages to the IRGC-Qods Force and Hizballah; both addresses' behavior fit sovereign reserve storage rather than active laundering. The official Tether announcement confirmed the coordination.
July 14, 2026 · $131M Iran freeze (Operation Economic Fury). Four Tron addresses tied to Iran's Islamic Revolutionary Guard Corps and Central Bank were designated by OFAC under Executive Order 13902; Tether executed all four freezes within hours.
Cumulative Iran seizures · roughly $1 billion since Operation Economic Fury began.

These freezes typically originate as formal information requests to Tether's compliance team. No court order is required for the freeze itself. Tether can freeze pre-emptively while an investigation is ongoing.

Sanctions programs

The second category is sanctions compliance: OFAC's SDN List, EU sanctions, UN designations. When a wallet appears on a sanctions list, Tether treats the designation as a freeze trigger and typically executes within hours of the public announcement. The 2022 Tornado Cash designations and the 2026 Iran designations both followed this pattern. What has changed in 2026 is speed: coordination between OFAC and Tether has become tight enough that some freezes now precede the public announcement.

Tether's own risk models

By address count, the largest bucket comes from Tether's own on-chain monitoring for scam signatures, phishing patterns, and clustered theft addresses, not from law enforcement or sanctions. The 4,163 addresses blacklisted in 2025 far exceeded any published count of formal law-enforcement or OFAC requests, and small-value freezes (five- and six-figure amounts) dominate the count. Those numbers fit scam and phishing wallets, not large seizures.

The cross-reference gap

Tether does not publish per-address reasoning. If one of the addresses you touch appears on the blacklist and no public sanctions or law-enforcement filing matches, you will typically not find the "why" in any external database. That gap is one of the harder problems in USDT compliance today. The standard external investigation path is cross-referencing on-chain freeze events against public sanctions data (OpenSanctions, OFAC SDN List).

Current state of the blacklist (live)

Here is the current picture, drawn live from the BlockSec USDT Freeze Tracker as of July 26, 2026, 12:58 UTC:

Metric	Value
Total USDT frozen (all chains)	$5,685,941,960
Blacklisted addresses (all chains)	9,597
New freezes in last 24 hours	10
Frozen on Tron	$3,709,576,603 (6,901 addresses)
Frozen on Ethereum	$1,976,365,356 (2,696 addresses)

Tron dominates by roughly 2× on frozen value and by 2.6× on address count. TRC-20 USDT is the dominant payment rail for cross-border stablecoin flows across Southeast Asia, Latin America, and parts of Africa. Freezes concentrate where the volume and risk concentrate.

Pace check versus 2025. 2025's full-year totals were 4,163 addresses and $1.26B frozen. In the first six months of 2026, Tether has already added 347 Ethereum freezes plus 2,116 Tron freezes and frozen $79M on Ethereum plus $1.58B on Tron, roughly $1.66B in stablecoin value in six months. That extrapolates to a 2026 pace running well ahead of 2025 on both count and value.

As one recent example: on July 25, 2026, Tether blacklisted Tron address TNJ1tm...nKchef, freezing $4.75M in a single event that accounted for 79% of that day's total. This is the cadence a compliance program is operating against: single freeze events in the millions, happening multiple times per day.

Turning that daily event stream into actionable alerts on the addresses you actually touch is what a compliance tool is for. Doing it as a subscription rather than a build-your-own event indexer is exponentially cheaper for most operations, and Phalcon Compliance is BlockSec's platform for exactly this workload: pay-as-you-go pricing, address-book upload, and real-time webhook alerts on both Ethereum and Tron.

What happens after a freeze

A freeze is not the end of the story. Once an address is on the blacklist, one of three things happens next: it stays frozen indefinitely, it moves to permanent destruction (burn), or it gets removed (unfreeze). Measured as same-period flows in 2025, destroy volume equalled 55.6% of the year's freeze value and 3.6% of blacklisted addresses were unfrozen, with the remainder still frozen at year-end. These are flow ratios rather than a cohort survival table: destroys and removals booked in 2025 can attach to addresses first frozen in prior years.

Frozen ≠ destroyed by default

A freeze by itself does nothing to the underlying USDT balance. The tokens sit at the frozen address, untransferable, but they still exist on the ledger and still count against total supply. Nothing is destroyed until Tether separately burns the balance at that address.

Burn-and-reissue: how `destroyBlackFunds` fits in

When Tether does burn the balance, the USDT at the frozen address goes to zero and total supply decrements by that amount. Destruction is the first step of a two-step recovery process. Burn the tokens at the bad address, then reissue an equivalent amount of new USDT to a court-designated or victim address. Net supply change is zero. Net effect for the rightful owner is full recovery, delivered as freshly minted USDT at a different address.

This exists because there is no reassign function on the USDT contract: the only way to move tokens without the sending private key is to burn and re-mint. Timelines from freeze to destroy-and-reissue typically run six to eighteen months for civil forfeiture cases, faster with active criminal proceedings. For the full mechanics and case examples, see How Tether Burns USDT and Reissues to Victims.

Removal (`removeBlackList`)

Freezes are reversible. Tether can unfreeze an address to clear the flag and restore transferability; the unfreeze fires a public event on-chain. In 2025 as a same-period flow, removals equalled 3.6% of blacklisted addresses, with an 18.2-day median freeze-to-remove interval for that removed subset. This is not a cohort survival curve, since some removals in 2025 apply to addresses first blacklisted in earlier years. The three real paths to pursue an unfreeze (direct petition to Tether, legal challenge in a chosen jurisdiction, U.S. federal-forfeiture innocent-owner defense) are covered in How to Unfreeze a USDT Address.

What 2026 changes

Two regulatory shifts have reset how the blacklist mechanism should be read.

The U.S. GENIUS Act, passed in 2025, treats payment stablecoin issuers as regulated financial institutions under the Bank Secrecy Act. Express Travel Rule obligations attach to transfers at or above $3,000, mandatory sanctions-list screening applies to every counterparty, and the ability to freeze specific addresses becomes a licensing precondition. Freezes stop being a discretionary courtesy and become a compliance duty.

The Hong Kong Stablecoins Ordinance, effective August 1, 2025, applies the same pattern regionally: any fiat-referenced stablecoin issuer serving the Hong Kong market needs an HKMA license, HK$25 million paid-up capital, full 1:1 reserves, Travel Rule compliance for transfers at or above HK$8,000, and freeze capability. Two licenses have been granted so far. USDT is not one of them.

The likely 2026-2027 direction is harmonization. Regulators in the U.S., Hong Kong, and (via MiCA) the EU are converging on a common set of stablecoin-issuer obligations, and industry groups have begun discussing standardized freeze APIs. Nothing is standardized yet, but the direction of travel points toward more freeze activity across every payment stablecoin.

Frequently asked questions

Is USDT decentralized? No. USDT is issued by Tether Ltd., a private company, and the underlying smart contract has owner-only functions (including addBlackList, removeBlackList, and destroyBlackFunds) that only Tether's multisig can call. USDT is a centrally administered dollar-referenced token that settles on public blockchains.

Can I appeal a USDT blacklist? Yes, via three paths: direct petition to Tether with KYC and transaction evidence, legal challenge in a chosen jurisdiction against Tether Ltd., or (in the U.S.) an innocent-owner defense in a federal forfeiture proceeding. The 2025 same-period flow ratio was 3.6% of blacklisted addresses removed, with an 18.2-day median for that removed subset, read as a base rate rather than a strict cohort success probability. See How to Unfreeze a USDT Address for the full decision matrix.

Does the blacklist apply on all chains? Ethereum USDT and TRC-20 USDT each maintain independent blacklists. Freezing an address on one chain does not automatically freeze the equivalent address on the other, though Tether typically applies the same reasoning across chains when an entity operates on both. USDT on other chains (Solana, Avalanche, and so on) has its own contract-level behavior, which varies by deployment.

What's the difference between blacklist and destroy? A blacklist entry (via addBlackList) is a hold: the tokens still exist but cannot move. A destroy (via destroyBlackFunds) burns the tokens at the frozen address; supply decrements and the specific tokens are gone. Destroys are frequently paired with a fresh mint of equivalent USDT to a court-designated or victim address, so "destroyed" does not always mean "lost to the victim."

How often does Tether freeze addresses? In 2025, Tether blacklisted 4,163 addresses across Ethereum and Tron. In the first half of 2026, that pace has accelerated to roughly 2,463 addresses across the two chains in six months. The typical cadence is several freeze events per day, concentrated on Tron.

Does USDC have a similar blacklist? Yes. Circle, the issuer of USDC, operates equivalent blacklist and burn functions on its contracts. Over 2023-2025, Circle blacklisted 372 addresses and froze about $109 million in USDC, versus Tether's 7,268 addresses and $3.29 billion, roughly a 30× gap on both count and value. That gap is expected to narrow as regulatory obligations equalize across issuers under the GENIUS Act and comparable regional frameworks.