USDT Freeze: The Complete 2026 Guide

As of July 26, 2026, Tether has blacklisted 9,597 USDT addresses across Ethereum and Tron, freezing $5.69 billion in stablecoin value. In the last twenty-four hours alone, ten new addresses were added to the list.

If you handle USDT, as a compliance operator, an OTC desk, a payment processor, a merchant, or simply a person who just received a payment, those numbers are not abstract. Any of your incoming addresses could be next, and the same on-chain function that flagged those 9,597 addresses could freeze yours in a single transaction.

This guide is the complete reference for USDT freezes in 2026: how the on-chain mechanic actually works, why Tether freezes addresses (with real 2025-2026 case data), what "destroyed" USDT really means for victims, whether a frozen address can be unfrozen, and how to build compliance around freeze risk. Every statistic is drawn from live Tether contract data via the BlockSec USDT Freeze Tracker; every case study is publicly sourced and linked.

Worried about a specific address? Use the free BlockSec USDT Freeze Checker →, no signup, on-chain answer in seconds.

How USDT freezes work: the on-chain mechanic

A USDT freeze is Tether calling the addBlackList function on the USDT smart contract to flag a specific address, blocking that address from sending, receiving, or having its USDT transferred. Everything else about the freeze (who decides, how long it lasts, whether it becomes permanent) is downstream of that one contract call.

There are actually three related functions on the USDT contract, and the difference between them is the difference between a temporary hold, a permanent destruction, and a reversal:

addBlackList: the freeze function

addBlackList(address) is the on-chain equivalent of a hold. When Tether calls it, three things change for the target address:

1. isBlackListed(address) starts returning true. Any wallet or explorer querying the contract can verify the address is now flagged.
2. transfer and transferFrom calls that involve the address as sender revert, the USDT sitting at that address can no longer move.
3. An AddedBlackList(address) event is emitted, which any indexer (Etherscan, Tronscan, BlockSec's USDT Freeze Tracker) picks up in real time.

The function is owner-only. On the Ethereum USDT contract (0xdAC17F958D2ee523a2206206994597C13D831ec7), only Tether's owner multisig address can call it. The same restriction applies on the TRC-20 USDT contract (TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t) on Tron. No court, regulator, exchange, or DAO can force this at the contract layer, the decision sits entirely with Tether Ltd.

Here is the actual code from the deployed USDT contract on Ethereum:

function addBlackList (address _evilUser) public onlyOwner {
    isBlackListed[_evilUser] = true;
    emit AddedBlackList(_evilUser);
}

function removeBlackList (address _clearedUser) public onlyOwner {
    isBlackListed[_clearedUser] = false;
    emit RemovedBlackList(_clearedUser);
}

Note the naming: _evilUser and _clearedUser, which reveals that the contract's original 2017 authors framed the mechanism explicitly as a punitive tool, not a neutral hold. The comment history and the variable names are part of the on-chain record forever.

The multisig delay window. Tether's owner is not a single hot key; it's a multisig with a delay period between transaction proposal and execution. That delay is public information: anyone watching the mempool and the owner-multisig activity can see a proposed freeze transaction before it lands. An AMLBot analysis of 3,480 Tron blacklist events between November 2017 and May 2025 documented that targeted addresses moved roughly $78 million out during freeze-delay windows, sometimes up to 44 minutes (additional coverage in Cointelegraph). Tether has publicly framed that delay as a trade-off for protecting a $100 billion-plus ecosystem while still collaborating with law-enforcement partners worldwide.

This isn't a "vulnerability" in the strict sense. Tether can't practically freeze faster without giving up multisig governance, but it is a known compliance-side implication: if you're monitoring for freeze events on your book, you should watch for the proposal transaction, not just the executed freeze. That's typically a several-minute head start.

destroyBlackFunds: the burn

destroyBlackFunds(address) is the second function, and it is fundamentally different from addBlackList. Where a freeze is a hold, a destroy is a burn: the USDT balance at that address goes to zero, the total supply decrements by that amount, and there is no contract-level path to recover the specific burned tokens.

There are a few important nuances that most 2022-era explainers get wrong:

• You cannot call destroyBlackFunds on a non-blacklisted address. The contract has a require guard: the address must already be blacklisted first. Freeze always precedes destroy.
• The burn is irreversible at the source address, but the value is not always lost. Tether commonly pairs a destroyBlackFunds call with a fresh mint of equivalent USDT to a victim or court-designated address, the "burn-and-reissue" pattern. We cover this in detail in the Destroyed doesn't mean lost section below.
• The destroy rate is high. According to BlockSec's 2025 USDT blacklist analysis, the destroy volume in 2025 was equivalent to 55.6% of the freeze volume in the same period: $698 million destroyed against $1.26 billion frozen. This is a same-period flow ratio, not a cohort-survival number: some of 2025's destroys correspond to addresses first blacklisted in earlier years.

removeBlackList: the unfreeze (yes, this happens)

removeBlackList(address) reverses a freeze. It clears the flag, emits a RemovedBlackList(address) event, and restores the address's ability to transact. The USDT balance is untouched: nothing was destroyed, and once removed, the address behaves normally.

Whether Tether will call removeBlackList on a given frozen address is a much harder question than whether the function exists. Per BlockSec's 2025 data, only about 3.6% of that year's blacklisted addresses were removed by year-end, with a median 18.2 days between freeze and unfreeze for the subset removed. The full three-path playbook for pursuing an unfreeze is in the companion spoke, How to Unfreeze a USDT Address.

Live snapshot: the current state of the blacklist

The state of the USDT blacklist changes every day, sometimes every hour. Here is the current picture as of July 26, 2026, 12:58 UTC, drawn live from the BlockSec USDT Freeze Tracker API:

As one concrete example: on July 25, 2026 at 14:12 UTC, Tether blacklisted Tron address TNJ1tmwF1AhcumgzyY3WrVKf4DQmnKchef, freezing $4,745,173 in USDT in transaction 0x43602453a16ecb137116952081d4d3fcfa1141ebcf29703287598d74c9039f4b. This is the volume-and-cadence you're operating around: single freeze events in the millions, happening multiple times per day.

Data source: BlockSec USDT Freeze Tracker, public dashboard, live data as of the timestamp above.

Why Tether freezes addresses

Tether freezes an address for one of three reasons: (a) a law-enforcement request in a specific case, (b) a match to a sanctions program like OFAC's SDN List, or (c) Tether's own on-chain risk models flagging fraud, theft, or scam activity. The lines between these categories blur (sometimes a single address triggers all three), but the categories help explain what you're actually seeing when a freeze happens on your book.

Law-enforcement requests (case-by-case freezes)

The most publicly visible freezes are the ones tied to specific criminal cases, and 2026 has produced the largest ones in the mechanism's history:

• April 23, 2026, $344M coordinated freeze (largest single Tether freeze on record). Two Tron addresses (TNiq9...QZH81 holding $213M and TTiDL...pjSr9 holding $131M) were frozen in coordination with U.S. authorities. OFAC subsequently designated both addresses as property of Iran's Bank Markazi (Central Bank of Iran) with linkages to the IRGC-Qods Force and Hizballah. Per on-chain analysis, both addresses' behavior fit sovereign reserve storage rather than active laundering: one address had no outbound history; the other moved less than $16M against $228M inbound. Tether CEO Paolo Ardoino confirmed the coordination via the official Tether announcement.
• July 14, 2026, $131M Iran freeze (Operation Economic Fury). Treasury Secretary Scott Bessent announced OFAC designations against four Tron wallets tied to Iran's Islamic Revolutionary Guard Corps and Iran's Central Bank under Executive Order 13902, with Tether executing the freeze on all four addresses within hours. Combined with the April $344M coordinated freeze, publicly disclosed Iran-linked USDT freezes in 2026 total at least $475M ($344M + $131M), a conservative floor; additional Iran-linked freezes that Treasury or Tether have not individually announced almost certainly push the true 2026 total higher.
• Earlier Operation Economic Fury tranches: earlier Iran-linked freezes throughout 2025-2026 formed part of the broader Iranian-crypto seizure campaign that culminated in the July 2026 $131M action, attribution and totals largely aggregated at the Treasury level rather than published freeze-by-freeze.
• Bybit hack response: in February 2025 Bybit lost approximately $1.5B in ETH, a breach the FBI attributed to North Korea's Lazarus Group. Because the theft was overwhelmingly in ETH rather than stablecoin, Tether's specific USDT freeze in this case was small, and industry-wide freeze coordination played out across issuers and exchanges in the days that followed.
• Iran IRGC $6.76M freeze (2024): Tether coordinated with U.S. and Israeli authorities to freeze USDT tied to Iran's Islamic Revolutionary Guard Corps and Houthi forces (BlockSec case study).
• Hamas terrorist-financing patterns: Multiple freezes across 2023-2025 targeted USDT flows to Hamas-affiliated wallets, documented in BlockSec's Following the Frozen analysis.

These freezes typically originate as formal information requests from law enforcement to Tether's compliance team. Tether can and does freeze pre-emptively while investigations are ongoing, no court order is required for the freeze itself. Per Tether's own aggregate reporting around the April 2026 $344M coordinated freeze, the company has frozen more than $4.4 billion in assets since launch, with over $2.1 billion tied directly to U.S. authorities, and cooperates with more than 340 law enforcement agencies across 65 countries on over 2,300 cases globally (including over 1,200 tied to U.S. law enforcement, per the CoinDesk write-up of the same announcement).

Sanctions programs (OFAC, EU, UN)

The second category is sanctions compliance. OFAC's Specially Designated Nationals (SDN) List has included crypto wallet addresses for years (the Tornado Cash 2022 designation is the canonical stablecoin-relevant example), and Tether treats those designations as freeze triggers.

Notable episodes:

• Tornado Cash (2022): OFAC designated Ethereum addresses associated with the Tornado Cash mixing service, and Tether froze the corresponding USDT balances at those addresses. The designation was later contested and delisted in 2025.
• Iran Central Bank $344M (April 23, 2026): OFAC designated two Tron wallets tied to Iran's Bank Markazi with linkages to the IRGC-Qods Force and Hizballah, and Tether froze approximately $344 million in USDT ($213M + $131M) in coordination with U.S. authorities. This remains the largest single Tether freeze on record per the Tether announcement.
• Iran IRGC + Central Bank $131M (July 14, 2026): Four additional Tron addresses added to the OFAC SDN list under Executive Order 13902 as part of Operation Economic Fury, with Tether freezing all four within hours of Bessent's announcement.

Cross-referencing what Tether has frozen against public sanctions lists is a compliance research topic in its own right. Because Tether doesn't publish per-address reasoning, matching a blacklisted address to a specific sanctions program requires external data, a topic we cover in the upcoming Cluster S spoke on OpenSanctions cross-referencing.

Tether's own fraud and theft risk models

The largest bucket, by address count, is neither government requests nor sanctions matches: it's Tether's own risk models. Tether operates internal on-chain monitoring for scam signatures, phishing patterns, and clustered theft addresses. When those models flag a wallet, Tether freezes.

This is the least documented category, because Tether doesn't publish the specific reasoning per freeze. What we know from aggregate data:

• The 4,163 addresses blacklisted in 2025 (per BlockSec) far exceeded any published count of law-enforcement or OFAC requests.
• Small freezes (five- and six-figure amounts) dominate the count, which fits scam/phishing wallets rather than large seizures.
• Tether's own token recovery policy frames fraud-victim protection as an ongoing use of the mechanic.

The compliance gap this creates: if you see one of your addresses in the blacklist and there's no public sanctions or LE reason, you probably won't find the "why" in any external database. The cross-reference gap is one of the harder problems in USDT compliance right now.

Freezing as a regulatory obligation, not just a discretion

Historically, USDT freezes were framed, including by Tether itself, as a discretionary compliance tool: Tether can freeze if it wants to, doesn't have to if it doesn't. That framing is out of date. In the 2025-2026 regulatory shift, the ability to freeze specific addresses has become a licensing prerequisite in multiple jurisdictions, and the willingness to freeze in coordination with sanctions authorities has become a de facto condition of continued operation.

Hong Kong Stablecoins Ordinance (effective August 1, 2025)

Hong Kong's Stablecoins Ordinance is the most explicit example. Effective August 1, 2025, it brings any issuer of a fiat-referenced stablecoin (including overseas issuers whose stablecoin claims to maintain value by reference to the Hong Kong dollar) under a mandatory HKMA licensing regime. Core obligations include:

• HK$25 million minimum paid-up capital
• Full 1:1 reserve backing segregated in high-quality liquid assets
• Prompt redemption at par: issuer must be able to honor redemption requests without delay
• Local Hong Kong substance: meaningful operational presence
• AML / CFT compliance including Travel Rule for transfers ≥ HK$8,000
• Governance and internal controls at the level expected of financial institutions
• Freeze capability: implicit in the AML / CFT and sanctions-cooperation requirements; issuers must be able to identify and block sanctioned addresses on demand

Penalties for unlicensed activity are steep: HK$5 million fine and up to 7 years imprisonment, plus HK$100,000 per day the offense continues. HKMA has since begun granting licenses to a small initial cohort of issuers, with more expected as the regime matures.

The MiCA divergence

The counterpoint to Tether's active cooperation with U.S. authorities is its posture toward the EU's Markets in Crypto-Assets (MiCA) framework. MiCA imposes stablecoin issuer requirements broadly similar to Hong Kong's (reserve backing, redemption obligations, prudential capital, licensing), but Tether has not pursued MiCA licensing for USDT, which affects USDT's availability through regulated EU distribution channels.

The pattern is worth noting: Tether cooperates aggressively with OFAC (publicly-disclosed Iran-linked freezes in 2026 total at least $475M ($344M + $131M) across the April $344M coordinated action and the July $131M Operation Economic Fury tranche, a conservative floor since not every freeze is individually announced) while taking a different approach to EU stablecoin regulation. For compliance operators, this signals asymmetric enforcement priorities. OFAC compliance is non-negotiable for any dollar-denominated stablecoin, the freeze pattern is set. Regional stablecoin regulation may see the same issuer make very different licensing choices.

U.S. GENIUS Act (2025)

The GENIUS Act, signed into law as Public Law 119-27 on July 18, 2025, formalizes what Tether has been doing informally: payment stablecoin issuers are treated as financial institutions under the Bank Secrecy Act, with AML program obligations and, as Treasury has begun implementing, mandatory sanctions-list screening and technical capability to block, freeze, and reject illicit transactions. The "freeze capability" is no longer a nice-to-have; it's a licensing precondition for payment stablecoin issuance in the U.S.

What this means for the compliance operator

Two takeaways:

1. A freeze is no longer just Tether's discretionary act; it's the visible consequence of an issuer meeting a regulatory obligation. When you see a freeze, the underlying trigger is increasingly a specific compliance duty, not just Tether's own risk model.
2. The mechanism is spreading beyond USDT. As Hong Kong, MiCA, and GENIUS Act licensing regimes mature, expect every payment stablecoin issuer (USDC, PYUSD, RLUSD, FDUSD, and future HKD-referenced tokens) to build equivalent freeze capabilities into their contracts. Address screening + freeze monitoring becomes not just a USDT problem but a stablecoin category problem.

Compare Tether's enforcement scale (~9,600 addresses and $5.7B frozen per the BlockSec USDT Freeze Tracker) to Circle's much smaller USDC blacklist footprint: AMLBot's on-chain analysis measured more than $3.29B in USDT frozen across 7,268 addresses in 2023-2025 versus a substantially smaller USDC total, with Circle typically acting only on explicit judicial mandates. That gap will narrow as regulatory obligations equalize across issuers.

The 2025-2026 USDT freeze landscape (data section)

In 2025 alone, Tether blacklisted 4,163 addresses, freezing about $1.26 billion in USDT, with destroy volume in the same period equal to 55.6% of freeze volume ($698 million destroyed via destroyBlackFunds). Those numbers come from BlockSec's year-end analysis of the entire USDT blacklist event stream on both Ethereum and Tron.

2025 by the numbers

Source: BlockSec USDT Blacklisting 2025 Report.

The 55.6% ratio is a compliance-narrative-shifting number: burn volume running above half of same-period freeze volume means a large share of freezes progress to a permanent destroy rather than sitting as indefinite holds. (Read this as a same-period flow ratio, not as a strict "of the addresses blacklisted in 2025, 55.6% were destroyed" cohort claim; some 2025 destroys correspond to addresses first frozen in earlier years.) And most of those burns are paired with a fresh mint of equivalent USDT to a victim or court-designated address. We come back to that in the burn-and-reissue section.

Chain distribution: Ethereum versus Tron

Live data as of July 26, 2026:

Tron dominates by roughly 2×. The reason isn't sinister: it's just where the USDT is. TRC-20 USDT is a dominant payment rail for cross-border stablecoin flows, and the BlockSec USDT Freeze Tracker reflects that: where the volume is, the risk is, and where the risk is, the freezes are.

For compliance teams, that means Tron-side monitoring is the higher-yield surface. If your infrastructure only covers Ethereum, you're missing the majority of freeze events.

2026 monthly freeze activity (Jan–Jun)

Pulled from the BlockSec USDT Freeze Report Archive, monthly totals for the first half of 2026:

Two observations from six months of on-chain data:

1. Tron freezes outnumber Ethereum freezes by roughly 6:1 on count, and by roughly 20:1 on frozen value. Tron is where USDT compliance risk concentrates in 2026.
2. March 2026 was an outlier month with 754 Tron freezes, nearly triple the six-month monthly average. Investigating the outlier month is a useful compliance signal in itself: sharp upticks correlate with coordinated multi-address enforcement actions (Iran-related activity has driven much of 2026's freeze volume; see the case data in the "Why Tether freezes" section above).

The last 30 days from the archive

BlockSec publishes daily, weekly, and monthly USDT freeze reports covering every freeze, unfreeze, burn, and proposal executed on both Ethereum and Tron. Pulled directly from those reports:

June 2026 (monthly):

• 364 freezes, 14 unfreezes, 65 burns, 443 total executed proposals
• $185.48M USDT frozen (Tron $180.66M / Ethereum $4.82M)
• $37.58M USDT burned (Tron $29.08M / Ethereum $8.50M)
• Largest single freeze: Tron address TBzrPE...X9Ak9W at $72.03M (proposal #9600)
• Round-tripping observed: two Tron addresses were frozen and then unfrozen for identical amounts within the month (fast-track legitimate-owner petitions)
• Source: June 2026 Monthly Report

Week 29 (July 13-19, 2026, weekly):

• 71 freezes, 5 unfreezes, 12 burns
• $142.7M USDT frozen (Tron $142.4M / Ethereum $297K)
• Largest single freeze: Tron address TFQbqa...C9wC7k at $85.53M, 60% of the entire week's frozen value in one wallet
• Burn value on Ethereum ($1.81M) exceeded freeze value ($297K) that week, a cleanup pattern where already-frozen Ethereum balances progressed to destroy
• Source: Week 29 Weekly Report

July 25, 2026 (daily):

• 11 freezes, 0 unfreezes, 0 burns
• $6.02M USDT frozen, all on Tron
• Largest: address TNJ1tm...nKchef at $4.75M (proposal #10258), 79% of the day's total
• Three freeze proposals executed against addresses whose target balances had already moved before execution (the multisig-delay window at work: targets recording $0 amounts despite being flagged for six-figure balances)
• Source: Daily Report 2026-07-25

The pattern across those windows: Tron dominates ~85-97% of activity by both count and value, single freeze events routinely account for the majority of a day's or week's total, and the multisig delay window is empirically exploited by a small number of watched addresses each week. These are the numbers your compliance program is operating against.

Data source: BlockSec USDT Freeze Tracker, live dashboard; full archive reports.

Follow every blacklist event in real time on the BlockSec USDT Freeze Tracker →.

"Destroyed" doesn't always mean lost: the burn-and-reissue mechanism

When Tether calls destroyBlackFunds, the tokens at that address are permanently burned, but Tether often pairs the burn with a fresh mint of equivalent USDT to a court-designated or victim address. The tokens are gone; the value is not.

This is the single most misunderstood aspect of the USDT freeze mechanic, and it changes how you should think about the 55.6% same-period destroy-to-freeze ratio.

How burn-and-reissue works (the 2-step)

The pattern has two on-chain steps:

1. Step 1, destroy at the bad address. Tether calls destroyBlackFunds(bad_address). The USDT balance at that address goes to zero, DestroyedBlackFunds fires, and total supply decrements by that amount.
2. Step 2, mint at the good address. Tether calls the standard issuance function (owner-only) to mint an equivalent amount of USDT to a court-designated or victim address. Total supply increments back by the same amount.

Net effect on USDT total supply: zero. Net effect on the specific tokens that were at the bad address: gone. Net effect on the value: it now sits at a different address, controlled by the rightful owner or a government custodian.

Why the two-step, rather than just "reassign" the balance? Because there is no reassign function on the USDT contract. The transfer and transferFrom functions require the private key of the sending address, which by definition the good-faith victim doesn't have. Burn-and-reissue is the workaround.

Tether's official recovery policy

Tether publishes an official token recovery policy that spells out the process for victims:

• Recovery requests are accepted for amounts greater than $1,000.
• Tether charges a fee of up to 10% of the recovery amount, or $1,000 minimum, whichever is greater.
• Tether's evaluation is at "sole and absolute discretion" and is final.
• Formal channel: the Tether Information Requests team.

The 10% fee is not trivial for large recoveries, and the "sole discretion" clause means there is no formal right to recovery. But for victims of theft, hack, or sanctions error, the pathway exists.

The internal secondary audit

Before Tether pulls the trigger on a destroy-and-reissue, its compliance team reviews the tracing evidence (whether the source is a government request or a private-party petition), and Tether's published recovery policy reserves final evaluation to Tether's "sole and absolute discretion." The motive is legal exposure: if Tether destroys USDT belonging to an innocent third party, it opens itself to conversion claims, breach-of-fiduciary-duty suits, and potentially class actions.

Practically, the timeline from freeze to destroy-and-reissue is often measured in many months for civil forfeiture cases (subject to the innocent-owner defense window codified at 18 U.S.C. § 983), and faster when criminal proceedings are involved.

Case example: Drift Protocol recovery (April 2026)

The Drift Protocol exploit on April 1, 2026 drained roughly $285M (later revised to about $295M in user losses) from the Solana-based perpetual futures venue after attackers spent months infiltrating the protocol's inner circle and compromised its multisig via Solana's durable-nonces feature (Mandiant attribution tied the operation to DPRK-linked actors). Tether led a coordinated recovery: up to $127.5 million from Tether plus $20 million from partners, a $147.5M package total, funding a user-recovery pool that grows through exchange revenue until the full $295.4M in losses is covered (Drift's own recovery-plan update). At relaunch Drift also migrated its settlement layer from USDC to USDT, one factual counter-datapoint to the "Tether vs Circle compliance agility" narrative that emerged after Circle declined to freeze the $232M of USDC the attacker bridged through CCTP.

Case example: Bybit hack response (February 2025)

The Bybit exchange breach in February 2025, a roughly $1.5 billion loss that the FBI attributed to North Korea's Lazarus Group, generated a coordinated response across Tether, other stablecoin issuers, exchanges, and industry-wide investigation networks. Because the theft was overwhelmingly in ETH rather than stablecoin, Tether's direct USDT freeze was small; the meaningful action was multi-issuer, multi-exchange coordination in the days that followed. This case illustrates a key limit of the burn-and-reissue mechanic: it works well for stablecoin-denominated proceeds, but does nothing for the vast majority of high-profile hacks where the losses are in ETH or other non-issuer-controlled assets.

Case example: the $344M Iran freeze (April 23, 2026)

The largest single Tether freeze on record: $344 million across two Tron addresses (TNiq9...QZH81 at $213M and TTiDL...pjSr9 at $131M), executed in coordination with U.S. authorities and reported at the same $344M total by CoinDesk. OFAC designated both addresses as property of Iran's Bank Markazi with linkages to the IRGC-Qods Force and Hizballah. This case is the canonical example of the "burn-and-reissue as sanctions enforcement" pattern: the frozen USDT is expected to progress through civil forfeiture to government custody via destroyBlackFunds + reissue.

What the 55.6% destroy ratio really means

The 55.6% same-period destroy-to-freeze ratio is often reported as "$698 million lost." That framing is incomplete on two counts: the ratio is a flow measurement (2025 destroys measured against 2025 freezes, not a cohort survival number), and "lost" isn't the right verb for burn-and-reissue.

For the address that was blacklisted, yes, the USDT is gone. But for the value those tokens represented, the destroy is often paired with a fresh mint to the rightful owner or a government custodian, which then goes to law enforcement, to the victim, or to a court-controlled disposition process.

The right frame for compliance narrative: destroyBlackFunds is a recovery primitive, not a punishment. Journalists writing about destroy events should always ask whether the destroy was paired with a reissue.

Tax and accounting implications for victims

If you are a victim whose USDT gets destroyed and reissued through this process, the tax and accounting picture is jurisdictionally messy: general property-loss, wash-and-reacquisition, and stolen-property-recovery frameworks each treat paired burn/reissue transactions differently, and none of them were written with destroyBlackFunds in mind. Engage local tax counsel before booking either leg.

The practical guidance we recommend to compliance teams and to individual victims:

1. Document both the destroy and the reissue transactions on-chain, with the block numbers, timestamps, and amounts. Tether's Information Requests team will provide reference numbers.
2. Get a written statement from Tether confirming that the reissue was paired with the destroy for the same underlying value.
3. Engage tax counsel in your jurisdiction before treating either transaction on your books.

Neither U.S. IRS crypto guidance nor the EU MiCA framework addresses destroyBlackFunds/reissue pairs specifically. Treat this as unresolved terrain and document defensively.

For the full code-level walkthrough of the burn mechanic, the reissue timing, and additional case studies, see the companion spoke: destroyBlackFunds Explained.

Can a frozen USDT address be unfrozen? (removeBlackList)

Yes. Tether can call removeBlackList(address) to reverse a freeze, and does so for about 3.6% of blacklisted addresses (per BlockSec's 2025 analysis). The unfreeze emits a RemovedBlackList event on-chain and restores the address's ability to transfer USDT. Whether it will happen for your address is a much harder question.

Three paths to unfreeze

There are three real paths to pursue an unfreeze, each with different odds, costs, and timelines.

Path 1, Direct proof to Tether. The owner (usually via counsel) submits KYC documentation and transaction evidence to Tether's Information Requests team. Tether evaluates internally, at "sole and absolute discretion." Time: weeks to months. Success: only if the underlying reason (sanctions match, LE request) has been resolved.

Path 2, Legal challenge in a chosen jurisdiction. File a lawsuit against Tether Ltd. Tether relocated its headquarters to El Salvador in January 2025 after previously being registered in the British Virgin Islands, with historical operational centers in Hong Kong and other financial hubs. Cross-border stablecoin-issuer litigation is long, expensive, and uncertain; best when Tether has declined Path 1 and you have strong evidence of innocent ownership.

Path 3, US federal-forfeiture innocent-owner defense. If the freeze is part of a US civil forfeiture proceeding, the innocent-owner defense codified in 18 U.S.C. § 983(d) can succeed: proving by a preponderance that you did not know the property was subject to forfeiture, or did all that reasonably could be expected to terminate its illegal use. Winning the defense triggers the agency to instruct Tether to call removeBlackList.

Realistic odds and timelines

The BlockSec 2025 analysis gives the hard numbers:

• 3.6% of that year's blacklisted addresses were removed by year-end.
• 18.2 days median time from freeze to unfreeze, for the small subset removed.
• The distribution is wide: some unfreezes happen within days (typically LE error corrections), others take much longer.

The practical takeaway: plan for the loss while pursuing unfreeze. Do not treat unfreeze as a compliance strategy. And if any "unfreeze service" promises you a success rate above 20%, treat it as a scam signal: Tether's process is not gameable, and no external party can modify the blacklist.

On-chain visibility of unfreezes

Every removeBlackList call emits a RemovedBlackList(address) event that is publicly indexed on Etherscan and Tronscan. Compliance teams monitoring their address book can subscribe to this event and get real-time notice when a previously frozen address gets unfrozen, useful both for reputation restoration and for auditing.

The full three-path playbook, with the Poly Network case as canonical unfreeze study and the decision matrix for choosing between paths, is in the companion spoke: How to Unfreeze a USDT Address.

What to do if your USDT address is (or might be) frozen

First, verify with a public checker. Second, understand why it was frozen. Third, if you're a legitimate owner, gather documentation and pursue the appropriate legal path. Realistic odds of unfreeze are ~3.6%, so plan for the loss while pursuing recovery.

Step 1: check the address (free, in your browser)

The fastest way is BlockSec's public checker: paste an address, get a yes/no answer plus the freeze date if applicable. It queries the USDT contract directly, so the answer is authoritative and free.

Check any USDT address free →, no signup, on-chain answer in seconds.

For a full walkthrough of the checker plus alternative methods (Etherscan/Tronscan direct queries), see How to Check If a USDT Address Is Frozen.

Step 2: understand why it was blacklisted

This is where most reader-facing content stops, but it shouldn't. The reason for the freeze governs which path (if any) has a chance of working:

• Sanctions match: cross-reference the address with public sanctions lists (OpenSanctions.org, OFAC SDN List, EU sanctions consolidated list).
• Entity clustering: use a tool like MetaSleuth to see whether the frozen address is clustered with known scam, ransomware, or terror-financing entities.
• No public match: this typically means Tether's internal risk models flagged the address, and there's no way to know the specific trigger without a formal Tether inquiry.

For the OpenSanctions cross-reference methodology, see the upcoming Cluster S spoke on why-this-usdt-address-is-blacklisted (shipping in Week 2 of this batch).

Step 3: pursue unfreeze or reissue

If the frozen USDT belongs to you: pursue unfreeze via one of the three paths described above. Realistic odds are 3.6%.

If the frozen USDT was stolen from you (i.e., you're the victim, not the frozen party): do not pursue unfreeze; you're not the owner of that address. Pursue reissue via Tether's official recovery process (see the burn-and-reissue section above).

If the frozen USDT is contested in a US forfeiture: pursue Path 3 (innocent-owner defense).

In all cases: do not expect unfreeze; plan for the loss. The 3.6% rate is honest, not pessimistic.

A warning about "unfreeze services"

There is an entire cottage industry of scams targeting people whose USDT has been frozen. The pattern is: an operator finds a public discussion of a frozen address (on Reddit, Twitter, a Telegram support channel) and reaches out claiming to be able to unfreeze it for a fee, typically 10-20% of the frozen amount, paid upfront.

No external party can modify Tether's blacklist. The addBlackList, removeBlackList, and destroyBlackFunds functions are all owner-only, restricted to Tether's multisig. There is no back door, no exploit, no "insider contact." Any promise otherwise is a scam.

Legitimate legal counsel will:

• Not promise a specific outcome.
• Not ask for upfront payment of a percentage of the frozen amount.
• Charge on a standard billable-hours basis or a flat fee for defined work.
• Be willing to walk you through the realistic odds (3.6%) and the specific path they'd pursue.

If someone contacts you claiming they can unfreeze your USDT, report them to your local financial regulator, to the exchange (if applicable), and to Tether's Information Requests team. That's the whole industry's problem, and reporting is how it gets smaller.

Building compliance around USDT freeze risk

For teams handling USDT at volume (exchanges, OTC desks, payment processors, custodians), compliance around freeze risk means pre-transaction address screening, real-time monitoring for freeze events on active addresses, and a documented response playbook.

Pre-transaction screening

Every incoming address gets checked before deposit credit. Every outgoing address gets checked before payout. The SLA, the time between "receive an address" and "get a screening answer", matters as much as the coverage.

For OTC desks and real-time payment use cases, the operating SLA is sub-5-second. Anything slower and you're either delaying settlement (customer friction) or crediting/paying out before you've screened (compliance risk). Full API-based screening is typically the only way to hit that SLA at production volume.

For a one-off manual check, the free BlockSec Freeze Checker works. For team-scale screening, Phalcon Compliance's address-screening API is designed for this workload: sub-second lookups, batch endpoints, and webhook alerts on state changes.

Real-time monitoring for freeze events

Screening at the moment of transaction is necessary but not sufficient. The bigger operational risk is an address you already accepted getting frozen after the fact, the "post-deposit freeze" scenario. Every custodial address you hold, every customer withdrawal address you've paid out to, every counterparty payout wallet on your books is a monitoring surface.

The compliance pattern is:

1. Subscribe to AddedBlackList and RemovedBlackList events for all addresses on your book.
2. When an event fires: pause any pending transactions to/from that address, notify the compliance queue, initiate case-management workflow.
3. Alert triage: N alerts per day → K actions per day (via risk scoring, dedup, and case linking).

For an OTC-desk-specific playbook including SLA math and sample policy templates, see the OTC Desks USDT Freeze Playbook spoke.

A concrete integration architecture

Here's what a production-grade USDT freeze compliance stack looks like at a mid-size exchange or payment processor:

1. Ingest layer: every incoming address (deposit, counterparty, payout) is enqueued to the screening service before the business logic proceeds. The queue is bounded so business logic never blocks on network I/O for the check.
2. Screening service: sub-500ms lookup against a cached in-memory copy of the blacklist plus a real-time API fall-back for cache-miss addresses. Cache is refreshed from the source of truth every few seconds.
3. Decision layer, a rule engine that maps screening results to actions (allow, hold, block, escalate). The rules encode your risk appetite: e.g. "hold-and-review any address with any historical blacklist event, even if currently removed."
4. Event subscriber, a persistent connection to a AddedBlackList/RemovedBlackList/DestroyedBlackFunds event stream for both Ethereum and Tron. When any address on your book fires an event, an alert is pushed to the compliance queue within seconds.
5. Case management: every alert generates a case with an audit trail: what fired, when, what was done in response, who signed off. This is the artifact your regulator asks for.
6. Reg reporting, for jurisdictions requiring SAR (Suspicious Activity Report) or equivalent filings, the case management system feeds a filing pipeline with the required fields pre-populated.

The whole stack can be built in-house if you have the engineering resources, or bought via a compliance platform. The right choice depends on your volume, your regulatory exposure, and the depth of your compliance team.

When you outgrow one-off checks

There's a natural progression from free tools to self-service to full API:

• Occasional single-address checks → free tools like BlockSec Freeze Checker fit perfectly. No signup, no cost.
• Solo compliance analyst, small volume → Phalcon Compliance's self-service tier fits here. Register with an email address and start with 3 free scans per month, no integration required. Above the free quota, pricing is pay-as-you-go.
• Team / production / OTC / payment processor → the full API + webhook + case management tier of Phalcon Compliance. This is where you need the sub-5-second SLA, batch endpoints, and audit trail for regulator reporting.

For teams running screening at volume:

Frequently asked questions

What is a USDT freeze? A USDT freeze is a call to the addBlackList function on the USDT smart contract by Tether's owner multisig, which flags a specific address as blocked from sending, receiving, or having USDT transferred. The freeze is on-chain and publicly verifiable via the isBlackListed(address) view function.

How do I check if my USDT address is frozen? The fastest way is a public checker like BlockSec's USDT Freeze Checker: free, no signup, on-chain answer in seconds. You can also query the USDT contract directly on Etherscan or Tronscan via the isBlackListed(address) view function. See our full checking guide for a walkthrough.

Can a frozen USDT address be unfrozen? Yes, via removeBlackList, but only about 3.6% of 2025-blacklisted addresses were removed, with a median 18.2 days for the subset that was removed. Three paths exist (direct petition to Tether, legal challenge, US federal-forfeiture innocent-owner defense). See our full unfreeze guide for the decision matrix.

Are destroyed USDT tokens gone forever? The tokens at the destroyed address are gone forever: destroyBlackFunds is irreversible at that address. But Tether commonly pairs the burn with a fresh mint of equivalent USDT to a court-designated or victim address, so the value is often not lost. See destroyBlackFunds Explained for the full burn-and-reissue mechanism.

Who at Tether decides to freeze an address? Freezes are executed by Tether's compliance team via calls to the USDT contract's addBlackList function, which is restricted to Tether's owner multisig. The decision to freeze can be triggered by law-enforcement requests, sanctions program matches, or Tether's own on-chain risk models. No court order is required for the freeze itself.

Does Tether freeze USDT on both Ethereum and Tron? Yes, the same set of functions (addBlackList, removeBlackList, destroyBlackFunds) exists on both the Ethereum USDT contract and the TRC-20 USDT contract on Tron. As of July 2026, Tron has significantly more frozen value ($3.71B across 6,901 addresses) than Ethereum ($1.98B across 2,696 addresses).

How can I get frozen funds back if I'm the victim? Submit a recovery request to Tether via the official Tether Token Recovery process. Recovery requests above $1,000 are accepted; Tether charges up to 10% or $1,000 minimum. Evaluation is at Tether's sole discretion. For amounts under $1,000, recovery is generally not available.

Related reads

• BlockSec USDT Freeze Report Archive: daily, weekly, and monthly reports
• The $1.26B Frozen: USDT Blacklisting in 2025 (BlockSec Report)
• Tether Announcement: $344M Coordinated Freeze (April 2026)
• Decrypt: $131M Iran USDT Freeze (July 2026)
• Hong Kong Monetary Authority: Regulatory Regime for Stablecoin Issuers
• Tether Freezes $6.76M Linked to Iran's IRGC and Houthi Forces
• Following the Frozen: On-Chain Analysis of USDT Blacklisting and Terrorist Financing
• BlockSec USDT Freeze Tracker is Live
• Tether Token Recovery: Official Policy
• Shedding Light on Shadows: SIGMETRICS 2026 (Andy et al.)

Companion spokes in this batch:

• How to Check If a USDT Address Is Frozen
• The USDT Blacklist, Explained (2026)
• The OTC Desk USDT Freeze Playbook
• destroyBlackFunds Explained
• How to Unfreeze a USDT Address

About the author

Andy is co-founder of BlockSec and the technical lead behind MetaSleuth, Trace AI, and Phalcon Compliance. He is also an Associate Professor at The Chinese University of Hong Kong, where his research on system and blockchain security includes the SIGMETRICS 2026 Best Paper Runner-Up Shedding Light on Shadows. Personal homepage: yajin.org.

Follow: X / Twitter · LinkedIn