USDT Freeze 2026: Who's Frozen, How to Check, Live Data

As of July 26, 2026, Tether has blacklisted 9,597 USDT addresses across Ethereum and Tron, freezing $5.69 billion in stablecoin value. In the last twenty-four hours alone, ten new addresses were added to the list.

If you handle USDT, as a compliance operator, an OTC desk, a payment processor, a merchant, or simply a person who just received a payment, those numbers are not abstract. Any of your incoming addresses could be next, and the same on-chain function that flagged those 9,597 addresses could freeze yours in a single transaction.

This guide is the complete reference for USDT freezes in 2026: how the on-chain mechanic actually works, why Tether freezes addresses (with real 2025-2026 case data), what "destroyed" USDT really means for victims, whether a frozen address can be unfrozen, and how to build compliance around freeze risk. Every statistic is drawn from live Tether contract data; every case study is publicly sourced and linked.

The BlockSec USDT Freeze Checker is a free on-chain tool for querying any address in seconds without signup, useful when you have a specific address to verify.

Can USDT be frozen? Short answer

Yes. Tether can freeze any USDT address at will by calling a function on the USDT smart contract, and the freeze takes effect within one on-chain transaction. Here are the essential facts for someone who arrived on this page looking for a quick answer:

• Who can freeze: only Tether Ltd., through its owner multisig wallet. No court, exchange, or user can trigger it at the contract layer.
• What "frozen" means: the USDT at that address can no longer be transferred out (inbound transfers still complete, but the balance becomes stuck at the frozen address and can be seized by Tether via destroyBlackFunds).
• How to check any address: free, 30 seconds, BlockSec USDT Freeze Checker — no signup, on-chain answer.
• Can it be reversed? Yes, but rarely — only about 3.6% of 2025's frozen addresses were unfrozen by year-end.
• Current scale (July 2026): 9,597 addresses, $5.69 billion frozen, across Ethereum and Tron. Around 10 new freezes per day.

The rest of this guide unpacks each of these facts with case data, code-level detail (where useful), and a response playbook for compliance operators, OTC desks, victims, and anyone who has just received a payment they aren't sure about.

How USDT freezes work

A USDT freeze is Tether flipping a switch on the USDT smart contract to lock a specific wallet address. Once locked, the USDT sitting at that address cannot be sent out by anyone, including the address's own owner; inbound transfers still complete at the contract layer, but the balance becomes stuck at the frozen address and can be seized by Tether via destroyBlackFunds. Everything else about the freeze (who decides, how long it lasts, whether it becomes permanent) is downstream of that one switch.

Tether can do three related things to a wallet address, and the difference between them matters:

Freeze: lock the address

A freeze is a hold. The tokens still exist at the wallet, but the smart contract refuses to move them until Tether says otherwise. Three things become true the moment the freeze lands:

• Anyone can verify the freeze from any wallet or block explorer. The freeze flag is public, so exchanges, compliance tools, and casual users can all check whether a given address is currently frozen.
• Any attempt to send USDT from the frozen address fails on-chain. Wallet software will show the transaction failing; the USDT is stuck.
• The freeze is published to the world in real time. Trackers like the BlockSec USDT Freeze Tracker, Etherscan, and Tronscan see the freeze the instant it lands and log it.

Only Tether can trigger the freeze. Specifically, only the wallet that owns the USDT smart contract, Tether's internal multi-signature wallet, has the authority. On the Ethereum USDT contract and the Tron USDT contract, the rule is the same. No court, no regulator, no exchange, no user, and no DAO can force a freeze at the contract layer. The decision sits entirely with Tether Ltd. For the code-level walkthrough of the freeze, destroy, and unfreeze functions, see How Tether Burns USDT and Reissues to Victims.

The internal names of these functions on the deployed contract are worth noting: the freeze function was named to flag a "bad user" and the unfreeze function was named to flag a "cleared user." Those labels have been in the on-chain record since 2017 and reveal how Tether's original authors framed the mechanism from day one.

The Solidity source

Here is the exact function Tether calls to freeze an address, as deployed in the USDT smart contract:

function addBlackList (address _evilUser) public onlyOwner {
    isBlackListed[_evilUser] = true;
    emit AddedBlackList(_evilUser);
}

The single write flips the isBlackListed mapping to true for the target address, and the emitted AddedBlackList event is how compliance systems and block explorers detect freezes in real time. Verify the full source in the Read Contract tab of the Ethereum USDT contract on Etherscan, or on the Tron USDT contract on Tronscan. The paired reversal function is removeBlackList; the paired destroy function is destroyBlackFunds. Only the address that owns the contract (Tether's operational multisig, covered below) can call any of the three.

The multisig delay window

Tether's owner wallet is not a single hot key; it's a multi-signature wallet with a delay between when a freeze is proposed and when it actually executes. That delay is public information: anyone watching the pending-transaction pool and Tether's owner-wallet activity can see a proposed freeze before it lands. A BlockSec analysis of every executed freeze proposal on Ethereum and Tron from November 2017 through February 2026 (8,310 proposals in total) found that targets successfully moved roughly $215.5 million out of their wallets during the delay window across 449 proposals: $132.4M on Tron and $83.1M on Ethereum. Median reaction time from proposal to first escape transfer was 77 minutes; the fastest documented escape moved funds within 3 seconds of the proposal landing. The single largest escape (Tron, June 5 2025) moved $37.3 million in 3 minutes 42 seconds.

The compliance implication is straightforward: if you monitor addresses on your book for freeze events, watch for the proposal, not just the executed freeze. At the empirically documented 77-minute median, the head start is measured in tens of minutes, not seconds.

Destroy: permanently burn the balance

A destroy is fundamentally different from a freeze. Where a freeze is a hold, a destroy is a burn: the USDT balance at that address is set to zero, the total USDT in circulation drops by exactly that amount, and there is no path in the contract to recover those specific tokens.

Three points are often missed:

• A destroy always follows a freeze; it cannot happen to a normal wallet. The contract enforces this: the wallet must already be frozen before Tether can call destroy on it.
• The burn is irreversible at the source wallet, but the value is not always lost. Tether commonly pairs a destroy with issuing an equivalent amount of fresh USDT to a victim or court-designated wallet. The tokens at the bad address are gone; the value shows up at a good address. This is the "burn-and-reissue" pattern.
• Destroys happen at scale. The 2025 destroy volume equalled 55.6% of the same-period freeze volume. Read as a same-period flow ratio, not strict cohort survival; the full 2025 breakdown appears in the data section below.

Unfreeze: reverse the freeze (rare)

Tether can also reverse a freeze. When it does, the flag is cleared, the wallet's USDT becomes movable again, and nothing is destroyed. The balance sitting at the wallet is untouched: whatever was there before the freeze is exactly what's available after the unfreeze.

The harder question is whether Tether will unfreeze a given wallet. Only about 3.6% of 2025's frozen addresses were unfrozen by year-end, with a median 18.2 days between freeze and unfreeze for the small subset that was released. The three-path playbook (direct petition, jurisdiction-of-choice legal challenge, US federal-forfeiture innocent-owner defense) is unpacked later in this guide.

Live snapshot: the current state of the blacklist

The state of the USDT blacklist changes every day, sometimes every hour. Here is the current picture as of July 26, 2026, 12:58 UTC:

The operating cadence: single freeze events routinely in the millions, several to a dozen per day. The six-month archive below quantifies it, and the daily-report snippet later in the data section shows a recent example in full detail.

Data source: BlockSec USDT Freeze Tracker, public dashboard, live data as of the timestamp above.

Why Tether freezes addresses

Tether freezes an address for one of three reasons: (a) a law-enforcement request in a specific case, (b) a match to a sanctions program like OFAC's SDN List, or (c) Tether's own on-chain risk models flagging fraud, theft, or scam activity. The lines between these categories blur (sometimes a single address triggers all three), but the categories help explain what you're actually seeing when a freeze happens on your book.

Law-enforcement requests (case-by-case freezes)

The most publicly visible freezes are the ones tied to specific criminal cases, and 2026 has produced the largest ones in the mechanism's history:

• April 23, 2026, $344M coordinated freeze (largest single Tether freeze on record). Two Tron addresses (one holding $213M, the other holding $131M) were frozen in coordination with U.S. authorities. OFAC subsequently designated both addresses as property of Iran's Bank Markazi (Central Bank of Iran) with linkages to the IRGC-Qods Force and Hizballah. On-chain analysis showed both addresses' behavior fit sovereign reserve storage rather than active laundering: one address had no outbound history; the other moved less than $16M against $228M inbound. Tether CEO Paolo Ardoino confirmed the coordination via the official Tether announcement.

• July 14, 2026, $131M Iran freeze (Operation Economic Fury). Treasury Secretary Scott Bessent announced OFAC designations against four Tron wallets tied to Iran's Islamic Revolutionary Guard Corps and Iran's Central Bank under Executive Order 13902, with Tether executing the freeze on all four addresses within hours. Combined with the April coordinated freeze, publicly disclosed Iran-linked USDT freezes in 2026 total at least $475M, a conservative floor. The Treasury's own tally puts Iran-linked crypto seizures at roughly $1 billion cumulative since Operation Economic Fury began, so unannounced additional freezes almost certainly sit between those two numbers.

• Iran IRGC $6.76M freeze (2024): Tether coordinated with U.S. and Israeli authorities to freeze USDT tied to Iran's Islamic Revolutionary Guard Corps and Houthi forces (see BlockSec case study). The February 2025 Bybit breach ($1.5B, attributed to Lazarus Group) sat overwhelmingly in ETH rather than stablecoin, so Tether's direct USDT freeze there was small.

• Hamas terrorist-financing patterns: Multiple freezes across 2023-2025 targeted USDT flows to Hamas-affiliated wallets, documented in BlockSec's Following the Frozen analysis.

These freezes typically originate as formal information requests from law enforcement to Tether's compliance team. Tether can and does freeze pre-emptively while investigations are ongoing, no court order is required for the freeze itself. In its April 2026 disclosure, Tether reported more than $4.4 billion in assets frozen since launch, with over $2.1 billion tied directly to U.S. authorities, cooperating with more than 340 law enforcement agencies across 65 countries on over 2,300 cases globally, including over 1,200 tied to U.S. law enforcement.

Sanctions programs (OFAC, EU, UN)

The second category is sanctions compliance. OFAC's Specially Designated Nationals (SDN) List has included crypto wallet addresses for years (the Tornado Cash 2022 designation is the canonical stablecoin-relevant example), and Tether treats those designations as freeze triggers.

Notable episodes (for the full historical arc from the 2017 contract deployment through the 2026 record year, see The USDT Blacklist, Explained (2026)):

• Tornado Cash (2022): OFAC designated Ethereum addresses associated with the Tornado Cash mixing service, and Tether froze the corresponding USDT balances at those addresses. The designation was later contested and delisted in 2025.
• The 2026 Iran-linked freezes (April $344M and July $131M) are OFAC-triggered too, and both landed within hours of the public SDN designation. Note the two $131M figures are different wallets: one is a component of the April $344M package, the other is the July standalone event.

Cross-referencing what Tether has frozen against public sanctions lists is a compliance research topic in its own right. Because Tether doesn't publish per-address reasoning, matching a blacklisted address to a specific sanctions program requires cross-referencing external data. The two standard sources are OpenSanctions and the OFAC SDN List, which get matched against on-chain freeze events.

Tether's own fraud and theft risk models

By address count, the largest bucket comes from Tether's own risk models rather than government requests or sanctions matches. Tether operates internal on-chain monitoring for scam signatures, phishing patterns, and clustered theft addresses. When those models flag a wallet, Tether freezes.

This is the least documented category, because Tether doesn't publish the specific reasoning per freeze. What we know from aggregate data:

• The 4,163 addresses blacklisted in 2025 far exceeded any published count of law-enforcement or OFAC requests.
• Small freezes (five- and six-figure amounts) dominate the count, which fits scam/phishing wallets rather than large seizures.
• Tether's own token recovery policy frames fraud-victim protection as an ongoing use of the mechanic.

The compliance gap this creates is real: if you see one of your addresses in the blacklist and there's no public sanctions or LE reason, you probably won't find the "why" in any external database. The cross-reference gap is one of the harder problems in USDT compliance right now.

The 2025-2026 USDT freeze landscape (data section)

2025 was the record year on the two headline dollar numbers this article has not yet named: $1.26 billion frozen in USDT across Ethereum and Tron, and $698 million destroyed through burn-and-reissue in the same period. The rest of the year's numbers (address counts, removal rate, removal timing) are the ones this article has been anchoring on above; here they sit consolidated in one table for reference:

2025 by the numbers

Source: BlockSec USDT Blacklisting 2025 Report.

That ratio shifts the compliance narrative: burn volume running above half of same-period freeze volume means a large share of freezes progress to permanent destroy rather than sitting as indefinite holds. Most of those burns are paired with a fresh mint of equivalent USDT to a victim or court-designated address, the burn-and-reissue mechanic covered in the "What to do" section further down.

Chain distribution: Ethereum versus Tron

Live data as of July 26, 2026:

Tron dominates by roughly 2× on frozen value and 2.6× on address count, and the reason is straightforward: TRC-20 USDT is a dominant payment rail for cross-border stablecoin flows. Where the volume is, the risk is; where the risk is, the freezes are.

For compliance teams, that means Tron-side monitoring is the higher-yield surface. If your infrastructure only covers Ethereum, you're missing the majority of freeze events.

2026 monthly freeze activity (Jan-Jun)

Pulled from the BlockSec USDT Freeze Report Archive, monthly totals for the first half of 2026:

Two observations from six months of on-chain data:

1. Tron freezes outnumber Ethereum freezes by roughly 6:1 on count, and by roughly 20:1 on frozen value. Tron is where USDT compliance risk concentrates in 2026.
2. March 2026 was an outlier month with 754 Tron freezes, nearly triple the six-month monthly average. Investigating outlier months is itself a useful compliance signal: sharp upticks correlate with coordinated multi-address enforcement actions, and Iran-linked designations have driven much of 2026's freeze volume.

The last 30 days from the archive

BlockSec publishes daily, weekly, and monthly USDT freeze reports covering every freeze, unfreeze, burn, and proposal executed on both Ethereum and Tron. Pulled directly from those reports:

June 2026 (monthly):

• 364 freezes, 14 unfreezes, 65 burns, 443 total executed proposals
• $185.48M USDT frozen (Tron $180.66M / Ethereum $4.82M)
• $37.58M USDT burned (Tron $29.08M / Ethereum $8.50M)
• Largest single freeze: a Tron address at $72.03M (proposal #9600)
• Round-tripping observed: two Tron addresses were frozen and then unfrozen for identical amounts within the month (likely fast-track legitimate-owner petitions or law-enforcement error corrections)
• Source: BlockSec June 2026 Monthly Report

Week 29 (July 13-19, 2026, weekly):

• 71 freezes, 5 unfreezes, 12 burns
• $142.7M USDT frozen (Tron $142.4M / Ethereum $297K)
• Largest single freeze: a Tron address at $85.53M, 60% of the entire week's frozen value in one wallet
• Burn value on Ethereum ($1.81M) exceeded freeze value ($297K) that week, a cleanup pattern where already-frozen Ethereum balances progressed to destroy
• Source: BlockSec Week 29 Weekly Report

July 25, 2026 (daily):

• 11 freezes, 0 unfreezes, 0 burns
• $6.02M USDT frozen, all on Tron
• Largest: a Tron address at $4.75M (proposal #10258), 79% of the day's total
• Three freeze proposals executed against addresses whose target balances had already moved before execution (the multisig-delay window at work: targets recording $0 amounts despite being flagged for six-figure balances)
• Source: BlockSec Daily Report 2026-07-25

The pattern across those windows: Tron dominates ~85-97% of activity by both count and value, single freeze events routinely account for the majority of a day's or week's total, and the multisig delay window is empirically exploited by a small number of watched addresses each week. These are the numbers your compliance program is operating against.

Data source: full archive reports.

Freezing has become a regulatory obligation

Historically, USDT freezes were framed, including by Tether itself, as a discretionary compliance tool: Tether can freeze if it wants to, doesn't have to if it doesn't. That framing is out of date. In the 2025-2026 regulatory shift, the ability to freeze specific addresses has become a licensing prerequisite in multiple jurisdictions, and the willingness to freeze in coordination with sanctions authorities has become a de facto condition of continued operation.

Hong Kong Stablecoins Ordinance (effective August 1, 2025)

Hong Kong's Stablecoins Ordinance is the most explicit example. Effective August 1, 2025, it brings any issuer of a fiat-referenced stablecoin (including overseas issuers whose stablecoin claims to maintain value by reference to the Hong Kong dollar) under a mandatory HKMA licensing regime. Alongside standard prudential requirements (paid-up capital, 1:1 reserve backing, redemption obligations, local substance, governance), the ordinance codifies the compliance-side obligations that matter for freeze practice:

• AML / CFT compliance including the Travel Rule for transfers at or above HK$8,000
• Freeze capability implicit in the AML / CFT and sanctions-cooperation requirements: issuers must be able to identify and block sanctioned addresses on demand

Penalties for unlicensed activity are steep (HK$5 million fine and up to 7 years imprisonment, plus HK$100,000 per day the offense continues). HKMA has since begun granting licenses to a small initial cohort of issuers, with more expected as the regime matures.

The MiCA divergence

The counterpoint to Tether's active cooperation with U.S. authorities is its posture toward the EU's Markets in Crypto-Assets (MiCA) framework. MiCA imposes stablecoin issuer requirements broadly similar to Hong Kong's (reserve backing, redemption obligations, prudential capital, licensing), but Tether has not pursued MiCA licensing for USDT, which affects USDT's availability through regulated EU distribution channels.

The pattern is worth noting: Tether cooperates aggressively with OFAC (the $475M-plus in 2026 Iran-linked freezes covered above) while taking a different approach to EU stablecoin regulation. For compliance operators, this signals asymmetric enforcement priorities. OFAC compliance is non-negotiable for any dollar-denominated stablecoin, the freeze pattern is set. Regional stablecoin regulation may see the same issuer make very different licensing choices.

U.S. GENIUS Act (2025)

The GENIUS Act, signed into law as Public Law 119-27 on July 18, 2025, formalizes what Tether has been doing informally: payment stablecoin issuers are treated as financial institutions under the Bank Secrecy Act, with AML program obligations and, as Treasury has begun implementing, mandatory sanctions-list screening and technical capability to block, freeze, and reject illicit transactions. The "freeze capability" is no longer a nice-to-have; it's a licensing precondition for payment stablecoin issuance in the U.S.

What this means for the compliance operator

Two takeaways for compliance operators.

First, a freeze is now the visible consequence of an issuer meeting a regulatory obligation. When you see a freeze, the underlying trigger is increasingly a specific compliance duty rather than just Tether's own risk model.

Second, the mechanism is spreading beyond USDT. As Hong Kong, MiCA, and GENIUS Act licensing regimes mature, expect every payment stablecoin issuer (USDC, PYUSD, RLUSD, FDUSD, and future HKD-referenced tokens) to build equivalent freeze capabilities into their contracts. Address screening + freeze monitoring becomes not just a USDT problem but a stablecoin category problem.

Compare Tether's enforcement scale (~9,600 addresses and $5.7B frozen) to Circle's much smaller USDC blacklist footprint. Over 2023-2025, Circle blacklisted about 372 addresses and froze roughly $109 million in USDC, versus Tether's several thousand addresses and multi-billion frozen value across the same window: roughly 25× on address count and 50× on frozen value, with Circle typically acting only on explicit judicial mandates. That gap is likely to narrow.

Operationally, that shift lands on every desk, custodian, and payment processor that handles USDT: freeze-awareness stops being a nice-to-have and becomes a compliance duty attached to each incoming address. The pragmatic move is to adopt a purpose-built compliance platform. Phalcon Compliance is BlockSec's platform for exactly this workload: sub-second address screening across Ethereum and Tron, real-time webhook alerts on every address in your book, and pay-as-you-go pricing so the program scales with your volume.

Can a frozen USDT address be unfrozen?

Yes, but rarely. Tether can reverse a freeze, the wallet becomes movable again, nothing is destroyed. But the 2025 base rate puts the odds well under one in twenty. Whether it will happen for your wallet is a much harder question than whether the reversal is technically possible.

Three paths to unfreeze

There are three real paths to pursue an unfreeze, each with different odds, costs, and timelines.

Path 1: Direct proof to Tether

The owner (usually via counsel) submits KYC documentation and transaction evidence to Tether's Information Requests team. Tether evaluates internally, at "sole and absolute discretion." Time: weeks to months. Success: only if the underlying reason (sanctions match, LE request) has been resolved.

Path 2: Legal challenge in a chosen jurisdiction

File a lawsuit against Tether Ltd. Tether relocated its headquarters to El Salvador in January 2025 after previously being registered in the British Virgin Islands, with historical operational centers in Hong Kong and other financial hubs. Cross-border stablecoin-issuer litigation is long, expensive, and uncertain; best when Tether has declined Path 1 and you have strong evidence of innocent ownership.

Path 3: US federal-forfeiture innocent-owner defense

If the freeze is part of a US civil forfeiture proceeding, the innocent-owner defense codified in 18 U.S.C. § 983(d) can succeed: proving by a preponderance that you did not know the property was subject to forfeiture, or did all that reasonably could be expected to terminate its illegal use. Winning the defense triggers the agency to instruct Tether to lift the freeze.

Realistic odds and timelines

The BlockSec 2025 analysis gives the hard numbers:

• 3.6% of that year's blacklisted addresses were removed by year-end.
• 18.2 days median time from freeze to unfreeze, for the small subset removed.
• The distribution is wide: some unfreezes happen within days (typically LE error corrections), others take much longer.

The practical takeaway: plan for the loss while pursuing unfreeze. Do not treat unfreeze as a compliance strategy. Any "unfreeze service" promising a success rate materially above the empirical base rate is a scam signal: Tether's process is not gameable, and no external party can modify the blacklist.

On-chain visibility of unfreezes

Every unfreeze fires a public on-chain event that Etherscan, Tronscan, and the BlockSec USDT Freeze Tracker index in real time. Compliance teams monitoring their address book can subscribe to that stream and get immediate notice when a previously frozen address gets unfrozen, useful both for reputation restoration and for auditing.

The full three-path playbook, with the Poly Network case as canonical unfreeze study and the decision matrix for choosing between paths, is in How to Unfreeze a USDT Address.

What to do if your USDT is frozen (or you're the victim)

First, verify with a public checker. Second, understand why it was frozen. Third, if you're a legitimate owner, gather documentation and pursue the appropriate legal path. Plan for the loss while pursuing recovery; the base rate is well under one in twenty.

Step 1: check the address (free, in your browser)

The fastest way is BlockSec's public checker: paste an address, get a yes/no answer plus the freeze date if applicable. It queries the USDT contract directly, so the answer is authoritative and free.

For a full walkthrough of the checker plus alternative methods (Etherscan/Tronscan direct queries), see How to Check If a USDT Address Is Frozen.

Step 2: understand why it was blacklisted

This is where most reader-facing content stops, but it shouldn't. The reason for the freeze governs which path (if any) has a chance of working:

• Sanctions match: cross-reference the address with public sanctions lists (OpenSanctions.org, OFAC SDN List, EU sanctions consolidated list).
• Entity clustering: use a tool like MetaSleuth to see whether the frozen address is clustered with known scam, ransomware, or terror-financing entities.
• No public match: this typically means Tether's internal risk models flagged the address, and there's no way to know the specific trigger without a formal Tether inquiry.

The OpenSanctions and OFAC cross-reference workflow is the single highest-leverage step for narrowing down "why" behind a blacklisted address before contacting Tether. Most sanctioned-address freezes will show a match; most risk-model freezes will not.

Step 3: pursue unfreeze or reissue

If the frozen USDT belongs to you: pursue unfreeze via one of the three paths described above.

If the frozen USDT was stolen from you (i.e., you're the victim, not the frozen party): do not pursue unfreeze; you're not the owner of that address. Pursue reissue via Tether's official recovery process, walked through in the next subsection.

If the frozen USDT is contested in a US forfeiture: pursue Path 3 (innocent-owner defense).

In all cases: do not expect unfreeze; plan for the loss. The base rate is honest.

If the USDT was destroyed and you're the rightful owner: the reissue path

Sometimes the destroy comes before any unfreeze is on the table. When it does, tokens gone does not mean value gone. Tether commonly pairs a destroy with issuing an equivalent amount of fresh USDT to a court-designated or victim wallet, so the specific tokens at the bad address are burned while the value shows up at a good address controlled by the rightful owner or a government custodian.

The mechanic is two on-chain transactions from Tether's owner wallet, in order. First, Tether zeroes out the frozen wallet's balance and USDT total supply drops by that exact amount. Second, Tether mints an equivalent amount of fresh USDT to the destination wallet, bringing total supply back to where it started. The reason for the two-step is that the USDT contract has no reassign function and every ordinary send needs the sending wallet's private key, which a good-faith victim by definition does not have. Burn-and-reissue is the workaround.

The recovery policy is public and specific. Recovery requests are accepted for amounts greater than $1,000. Tether charges a fee of up to 10% of the recovery amount, or $1,000 minimum, whichever is greater. Evaluation is at Tether's "sole and absolute discretion" and is final. The formal channel is the Tether Information Requests team.

Expect the timeline to be measured in months for civil forfeiture cases, faster when criminal proceedings are involved. Civil forfeiture is subject to the innocent-owner defense window codified at 18 U.S.C. § 983, which shapes when Tether is willing to move.

The Drift Protocol exploit on April 1, 2026 is the cleanest recent illustration. Attackers drained roughly $285M (later revised to about $295M in user losses) from the Solana perpetual futures venue by compromising its multisig via Solana's durable-nonces feature, with Mandiant attribution tying the operation to DPRK-linked actors. Tether led a coordinated $147.5M recovery package (up to $127.5M from Tether plus $20M from partners), funding a user-recovery pool that grows through exchange revenue until the full $295.4M in losses is covered (see Drift's recovery-plan update).

Tax treatment is jurisdictionally unresolved. General property-loss, wash-and-reacquisition, and stolen-property-recovery frameworks each treat paired burn/reissue transactions differently. Engage local tax counsel before booking either leg. Full detail is in How Tether Burns USDT and Reissues to Victims.

A warning about "unfreeze services"

There is an entire cottage industry of scams targeting people whose USDT has been frozen. The pattern is: an operator finds a public discussion of a frozen address (on Reddit, Twitter, a Telegram support channel) and reaches out claiming to be able to unfreeze it for a fee, typically 10-20% of the frozen amount, paid upfront.

No external party can modify Tether's blacklist. As covered in the mechanic section, only Tether's own owner wallet has that authority. There is no back door, no exploit, no "insider contact." Any promise otherwise is a scam.

Legitimate legal counsel will:

• Not promise a specific outcome.
• Not ask for upfront payment of a percentage of the frozen amount.
• Charge on a standard billable-hours basis or a flat fee for defined work.
• Be willing to walk you through the realistic base rate and the specific path they'd pursue.

If someone contacts you claiming they can unfreeze your USDT, report them to your local financial regulator, to the exchange (if applicable), and to Tether's Information Requests team. That's the whole industry's problem, and reporting is how it gets smaller.

Building compliance at team scale

For teams handling USDT at volume (exchanges, OTC desks, payment processors, custodians), the freeze problem shows up on two operationally distinct surfaces: screening every address before a transaction credits or a payout leaves, and monitoring every address after it's on your book in case a freeze lands later.

Pre-transaction screening

Every incoming address gets checked before deposit credit; every outgoing address gets checked before payout. The SLA (the time between "receive an address" and "get a screening answer") matters as much as the coverage.

For OTC desks and real-time payment use cases, the operating SLA is sub-5-second. Anything slower and you're either delaying settlement (customer friction) or crediting/paying out before you've screened (compliance risk). Full API-based screening is typically the only way to hit that SLA at production volume, which is exactly what Phalcon Compliance is built for.

Real-time monitoring for post-deposit freezes

Screening at the moment of transaction is necessary but not sufficient. The bigger operational risk is an address you already accepted getting frozen after the fact, the "post-deposit freeze" scenario. Every custodial address you hold, every customer withdrawal address you've paid out to, every counterparty payout wallet on your books is a monitoring surface, and Phalcon Compliance's webhook alerts turn every freeze event on those addresses into a real-time case for your compliance queue.

For an OTC-desk-specific playbook including SLA math and sample policy templates, see The OTC Desk USDT Freeze Playbook.

Frequently asked questions

What is a USDT freeze? A USDT freeze is Tether locking a specific wallet address on the USDT smart contract so its USDT cannot be sent out (inbound transfers still complete, but the balance becomes stuck at the frozen address). The freeze happens on-chain, is publicly visible, and can be verified from any wallet or block explorer.

How do I check if my USDT address is frozen? The fastest way is a public checker like the BlockSec USDT Freeze Checker: free, no signup, answer in seconds. Etherscan and Tronscan also let you look up freeze status directly on the contract. See our full checking guide for a walkthrough.

Can a frozen USDT address be unfrozen? Yes, but rarely. Only about 3.6% of the addresses Tether froze in 2025 were later unfrozen, with a median 18.2 days between freeze and unfreeze for the small subset released. Three paths exist (direct petition to Tether, legal challenge, US federal-forfeiture innocent-owner defense). See our full unfreeze guide for the decision matrix.

Are destroyed USDT tokens gone forever? The tokens at the destroyed address are gone forever. But Tether commonly pairs the destroy with issuing an equivalent amount of fresh USDT to a court-designated or victim wallet, so the value is often not lost, only the specific tokens. See How Tether Burns USDT and Reissues to Victims for the full burn-and-reissue mechanism.

Who at Tether decides to freeze an address? Tether's compliance team executes freezes; the decision is Tether's alone. Triggers include law-enforcement requests, sanctions designations (OFAC, EU, UN), and Tether's own on-chain monitoring for scams and theft. No court order is required for the freeze itself.

Does Tether freeze USDT on both Ethereum and Tron? Yes. The same freeze/destroy/unfreeze authority exists on both chains, but the two blacklists are independent (freezing an address on Tron does not freeze the same address on Ethereum). As of July 2026, Tron has significantly more frozen value ($3.71B across 6,901 addresses) than Ethereum ($1.98B across 2,696 addresses).

How can I get frozen funds back if I'm the victim? Submit a recovery request via Tether's official Tether Token Recovery process. Recovery requests above $1,000 are accepted; Tether charges up to 10% or $1,000 minimum, whichever is greater. Evaluation is at Tether's sole discretion. For amounts under $1,000, recovery is generally not available.

Related reads

• How to Check If a USDT Address Is Frozen
• The USDT Blacklist, Explained (2026)
• The OTC Desk USDT Freeze Playbook
• How Tether Burns USDT and Reissues to Victims
• How to Unfreeze a USDT Address
• HKMA stablecoin issuer regime
• BlockSec USDT Freeze Tracker is Live

About the author

Andy is co-founder of BlockSec. BlockSec builds MetaSleuth, Trace AI, and Phalcon Compliance. He is also an Associate Professor at The Chinese University of Hong Kong, where his research focuses on system and blockchain security. Personal homepage: yajin.org.

Follow: X / Twitter · LinkedIn