The USDT blacklist is a list of Ethereum and Tron addresses that Tether has flagged as blocked from sending or receiving USDT. Tether maintains the list on-chain via the addBlackList function on the USDT smart contract, which only Tether's owner address can call.
As of July 26, 2026, the list contains 9,597 addresses across the two chains and immobilizes $5.69 billion in stablecoin value. Ten new addresses were added in the last twenty-four hours. That scale, plus the regulatory shifts of the last eighteen months (GENIUS Act, Hong Kong Stablecoins Ordinance), is why the blacklist matters to every OTC desk, payment processor, exchange, and serious USDT holder. This is the plain-English guide: what the list is, who runs it, who ends up on it, and what changes in 2026.
What the USDT blacklist actually is
The USDT blacklist is a set of addresses stored inside the USDT smart contract (one set on Ethereum, another on Tron) for which the contract refuses to move tokens. It is not a spreadsheet at Tether headquarters. It is not a legal document. It is a mapping in on-chain contract storage that changes the behavior of USDT for the addresses it contains.
There are three functions that operate on this mapping, all restricted to Tether's owner multisig:
addBlackList(address)adds an address to the list, blocking send, receive, and transfer of USDT.removeBlackList(address)removes it, restoring transferability.destroyBlackFunds(address)permanently burns the USDT balance at a blacklisted address.
When Tether calls addBlackList, three things happen at the same time: the isBlackListed(address) view function starts returning true, transfer and transferFrom calls involving that address revert on the contract, and an AddedBlackList(address) event is emitted for indexers to pick up. Any wallet, block explorer, or compliance dashboard can verify the freeze state within seconds. For a full code-level walkthrough, see the pillar USDT Freeze: The Complete 2026 Guide.
Who controls it. Only Tether's owner multisig can modify the blacklist. On Ethereum, that authority sits on the USDT contract at 0xdAC17F958D2ee523a2206206994597C13D831ec7; on Tron it sits on the TRC-20 USDT contract at TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t. The multisig has a public delay between proposal and execution, so anyone watching the owner's activity can see a proposed freeze before it lands. No court, regulator, exchange, or DAO can force a freeze at the contract layer.
Two separate lists, one policy. Ethereum USDT and TRC-20 USDT are technically different tokens on different chains and maintain independent blacklists. Freezing an address on Tron does not freeze an equivalent address on Ethereum, though the same policy governs both lists. In practice, most 2026 freeze activity happens on Tron, where the majority of USDT payment volume flows.
A short history of the blacklist
2017-2019: origins
The blacklist functions have been in the USDT contract since the current Ethereum deployment in 2017. The variable naming in the deployed code (_evilUser in addBlackList, _clearedUser in removeBlackList) reveals the original framing: designed from day one as a punitive mechanism, not a neutral hold. Through 2018 and 2019, use was rare and mostly reactive: exchange hacks or clear thefts would prompt an isolated freeze, often after weeks of coordination.
2019-2022: growth and the first major freezes
As USDT supply scaled from single-digit billions to over $70B, the blacklist grew from a niche tool into a routine compliance instrument. The most visible use in this era was around exchange breaches. The Poly Network case in August 2021 is worth remembering because it ended in a full unfreeze: 33.4 million USDT was frozen, held for fifteen days, then released back to Poly Network's multisig via removeBlackList after the attacker voluntarily returned every other asset. It is one of the cleanest examples of the mechanism working as a reversible hold rather than a permanent seizure.
2022-2024: the sanctions era
The August 2022 OFAC designation of Tornado Cash marked a shift. OFAC named 44 Ethereum addresses associated with the mixing service on the Specially Designated Nationals list, and Tether froze the corresponding USDT balances. That set the pattern that dominated the next two years: sanctions designations at government level, freeze execution at issuer level, typically within hours of the public announcement. Through 2023 and 2024, coordination expanded to what Tether now describes as cooperation with more than 340 law enforcement agencies across 65 countries and over $4.4 billion frozen in aggregate.
2025: the record year
Per the BlockSec 2025 USDT blacklisting analysis, Tether blacklisted 4,163 addresses and froze about $1.26 billion in USDT across Ethereum and Tron in a single year, the highest on record. In the same period, Tether destroyed $698 million via destroyBlackFunds (55.6% of the year's freeze value) and removed 3.6% of blacklisted addresses via removeBlackList, with a median 18.2-day freeze-to-remove interval for that removed subset. Read as same-period flow ratios, not strict cohort survival: destroys and removals recorded in 2025 can apply to addresses first blacklisted in earlier years. Those numbers reset the compliance conversation for 2026.
Who gets blacklisted (and why)
There are three broad reasons an address ends up on the USDT blacklist: a law enforcement request, a match against a sanctions program, or a flag from Tether's own risk models. The categories overlap. A single address can hit all three at once.
Law enforcement requests
The most publicly visible freezes come from specific criminal cases. In 2026, three cases have set the scale:
- April 23, 2026 · $344M coordinated freeze across two Tron addresses (
TNiq9...QZH81holding $213M andTTiDL...pjSr9holding $131M). OFAC designated both addresses as property of Iran's Bank Markazi (Central Bank of Iran) with linkages to the IRGC-Qods Force and Hizballah; both addresses' behavior fit sovereign reserve storage rather than active laundering. The official Tether announcement confirmed the coordination. - July 14, 2026 · $131M Iran freeze (Operation Economic Fury). Four Tron addresses tied to Iran's Islamic Revolutionary Guard Corps and Central Bank were designated by OFAC under Executive Order 13902; Tether executed all four freezes within hours.
- Cumulative Iran seizures · roughly $1 billion since Operation Economic Fury began, per Treasury Secretary Bessent.
These freezes typically originate as formal information requests to Tether's compliance team. No court order is required for the freeze itself. Tether can freeze pre-emptively while an investigation is ongoing.
Sanctions programs
The second category is sanctions compliance: OFAC's SDN List, EU sanctions, UN designations. When a wallet appears on a sanctions list, Tether treats the designation as a freeze trigger and typically executes within hours of the public announcement. The 2022 Tornado Cash designations and the 2026 Iran designations both followed this pattern. What has changed in 2026 is speed: coordination between OFAC and Tether has become tight enough that some freezes now precede the public announcement.
Tether's own risk models
The largest bucket, by address count, is neither law enforcement nor sanctions. It is Tether's own on-chain monitoring for scam signatures, phishing patterns, and clustered theft addresses. The 4,163 addresses blacklisted in 2025 far exceeded any published count of formal law-enforcement or OFAC requests, and small-value freezes (five- and six-figure amounts) dominate the count. Those numbers fit scam and phishing wallets, not large seizures.
The cross-reference gap
Tether does not publish per-address reasoning. If one of the addresses you touch appears on the blacklist and no public sanctions or law-enforcement filing matches, you will typically not find the "why" in any external database. That gap is one of the harder problems in USDT compliance today, and the subject of a companion Cluster S spoke on cross-referencing USDT freezes against public sanctions data.
Current state of the blacklist (live)
Here is the current picture, drawn live from the BlockSec USDT Freeze Tracker as of July 26, 2026, 12:58 UTC:
| Metric | Value |
|---|---|
| Total USDT frozen (all chains) | $5,685,941,960 |
| Blacklisted addresses (all chains) | 9,597 |
| New freezes in last 24 hours | 10 |
| Frozen on Tron | $3,709,576,603 (6,901 addresses) |
| Frozen on Ethereum | $1,976,365,356 (2,696 addresses) |
Tron dominates by roughly 2× on frozen value and by 2.6× on address count. TRC-20 USDT is the dominant payment rail for cross-border stablecoin flows across Southeast Asia, Latin America, and parts of Africa. Where the volume is, the risk is; where the risk is, the freezes are.
Pace check versus 2025. 2025's full-year totals were 4,163 addresses and $1.26B frozen. In the first six months of 2026, Tether has already added 347 Ethereum freezes plus 2,116 Tron freezes and frozen $79M on Ethereum plus $1.58B on Tron, roughly $1.66B in stablecoin value in six months. That extrapolates to a 2026 pace running well ahead of 2025 on both count and value.
As one recent example: on July 25, 2026, Tether blacklisted Tron address TNJ1tm...nKchef, freezing $4.75M in a single event that accounted for 79% of that day's total. This is the cadence a compliance program is operating against: single freeze events in the millions, happening multiple times per day.
Follow every blacklist event in real time on the BlockSec USDT Freeze Tracker →.
What happens after a freeze
A freeze is not the end of the story. Once an address is on the blacklist, one of three things happens next: it stays frozen indefinitely, it moves to permanent destruction via destroyBlackFunds, or it gets removed via removeBlackList. Measured as same-period flows in 2025, destroy volume equalled 55.6% of the year's freeze value and 3.6% of blacklisted addresses were unfrozen, with the remainder still frozen at year-end. These are flow ratios rather than a cohort survival table: destroys and removals booked in 2025 can attach to addresses first frozen in prior years.
Frozen ≠ destroyed by default
An addBlackList call by itself does nothing to the underlying USDT balance. The tokens sit at the frozen address, untransferable, but they still exist on the ledger and still count against total supply. Nothing is destroyed until Tether separately calls destroyBlackFunds on that address.
destroyBlackFunds and burn-and-reissue
When Tether does call destroyBlackFunds, the USDT balance at the frozen address goes to zero and total supply decrements by that amount. But destroyed does not mean lost to the victim. In the recovery flow, destroyBlackFunds is step one of a two-step process: destroy the tokens at the bad address, then reissue an equivalent amount of new USDT to a court-designated or victim address. Net supply change is zero. Net effect for the rightful owner is full recovery, delivered as freshly minted USDT at a different address.
This exists because there is no reassign function on the USDT contract: the only way to move tokens without the sending private key is to burn and re-mint. Timelines from freeze to destroy-and-reissue typically run six to eighteen months for civil forfeiture cases, faster with active criminal proceedings. For the full mechanics and case examples, see How Tether Burns USDT and Reissues to Victims.
Removal (removeBlackList)
Freezes are reversible. Tether can call removeBlackList(address) to clear the flag, emit a RemovedBlackList event on-chain, and restore transferability. In 2025 as a same-period flow, removals equalled 3.6% of blacklisted addresses, with an 18.2-day median freeze-to-remove interval for that removed subset. This is not a cohort survival curve, since some removals in 2025 apply to addresses first blacklisted in earlier years. The three real paths to pursue an unfreeze (direct petition to Tether, legal challenge in a chosen jurisdiction, U.S. federal-forfeiture innocent-owner defense) are covered in How to Unfreeze a USDT Address.
For a step-by-step response playbook, the pillar's What to do if your USDT address is frozen section is the operational reference.
What 2026 changes
Two regulatory shifts have reset how the blacklist mechanism should be read.
The U.S. GENIUS Act, passed in 2025, treats payment stablecoin issuers as regulated financial institutions under the Bank Secrecy Act. Express Travel Rule obligations attach to transfers at or above $3,000, mandatory sanctions-list screening applies to every counterparty, and the ability to freeze specific addresses becomes a licensing precondition. Freezes stop being a discretionary courtesy and become a compliance duty.
The Hong Kong Stablecoins Ordinance, effective August 1, 2025, applies the same pattern regionally: any fiat-referenced stablecoin issuer serving the Hong Kong market needs an HKMA license, HK$25 million paid-up capital, full 1:1 reserves, Travel Rule compliance for transfers at or above HK$8,000, and freeze capability. Two licenses have been granted so far. USDT is not one of them.
The likely 2026-2027 direction is harmonization. Regulators in the U.S., Hong Kong, and (via MiCA) the EU are converging on a common set of stablecoin-issuer obligations, and industry groups have begun discussing standardized freeze APIs. Nothing is standardized yet, but the direction of travel is toward more, not less, freeze activity across every payment stablecoin.
Frequently asked questions
Is USDT decentralized?
No. USDT is issued by Tether Ltd., a private company, and the underlying smart contract has owner-only functions (including addBlackList, removeBlackList, and destroyBlackFunds) that only Tether's multisig can call. USDT is a centrally administered dollar-referenced token that settles on public blockchains.
Can I appeal a USDT blacklist? Yes, via three paths: direct petition to Tether with KYC and transaction evidence, legal challenge in a chosen jurisdiction against Tether Ltd., or (in the U.S.) an innocent-owner defense in a federal forfeiture proceeding. The 2025 same-period flow ratio was 3.6% of blacklisted addresses removed, with an 18.2-day median for that removed subset, read as a base rate rather than a strict cohort success probability. See How to Unfreeze a USDT Address for the full decision matrix.
Does the blacklist apply on all chains? Ethereum USDT and TRC-20 USDT each maintain independent blacklists. Freezing an address on one chain does not automatically freeze the equivalent address on the other, though Tether typically applies the same reasoning across chains when an entity operates on both. USDT on other chains (Solana, Avalanche, and so on) has its own contract-level behavior, which varies by deployment.
What's the difference between blacklist and destroy?
A blacklist entry (via addBlackList) is a hold: the tokens still exist but cannot move. A destroy (via destroyBlackFunds) burns the tokens at the frozen address; supply decrements and the specific tokens are gone. Destroys are frequently paired with a fresh mint of equivalent USDT to a court-designated or victim address, so "destroyed" does not always mean "lost to the victim."
How often does Tether freeze addresses? In 2025, Tether blacklisted 4,163 addresses across Ethereum and Tron. In the first half of 2026, that pace has accelerated to roughly 2,463 addresses across the two chains in six months. The typical cadence is several freeze events per day, concentrated on Tron.
Does USDC have a similar blacklist? Yes. Circle, the issuer of USDC, operates equivalent blacklist and burn functions on its contracts. Over 2023-2025, Circle blacklisted 372 addresses and froze about $109 million in USDC, versus Tether's 7,268 addresses and $3.29 billion, roughly a 30× gap on both count and value. That gap is expected to narrow as regulatory obligations equalize across issuers under the GENIUS Act and comparable regional frameworks.
Related reads
- USDT Freeze: The Complete 2026 Guide · the pillar with full mechanics and case studies
- How to Check If a USDT Address Is Frozen · free tool walk-through
- How to Unfreeze a USDT Address · three unfreeze paths and decision matrix
- How Tether Burns USDT and Reissues to Victims · burn-and-reissue deep dive
- The OTC Desk USDT Freeze Playbook · operational playbook for volume desks
- The $1.26B Frozen: USDT Blacklisting in 2025 (BlockSec Report)
- Tether Announcement · $344M Coordinated Freeze (April 2026)
- Following the Frozen · On-Chain Analysis of USDT Blacklisting
If your compliance workflow needs more than reading blacklist history
Phalcon Compliance is BlockSec's crypto AML and address-screening platform. It gives compliance teams real-time blacklist screening across chains, subscription to freeze and unfreeze events on watched addresses, and case-management workflow for regulator-facing reporting.
For teams running screening at volume (OTC desks, exchanges, payment processors), Phalcon Compliance offers API and webhook access with pay-as-you-go pricing above the free quota.
About the author
Andy is co-founder of BlockSec and the technical lead behind MetaSleuth, Trace AI, and Phalcon Compliance. He is also an Associate Professor at The Chinese University of Hong Kong, where his research on system and blockchain security includes the SIGMETRICS 2026 Best Paper Runner-Up Shedding Light on Shadows. Personal homepage: yajin.org.
Follow: X / Twitter · LinkedIn
