How Criminals Move Millions in USDT Before Tether Can Freeze It

On June 5, 2025, a Tron wallet held $37.3 million in USDT when Tether began blacklisting it. The freeze took 5.7 minutes to pass through the issuer’s multisignature wallet. Two minutes before the final approval, the entire balance moved.

So, there is always a dramatic race between networks like Tether and criminals, often decided in seconds. Latest research from blockchain analytics firm BitOK found that Tether now completes a typical USDT blacklist faster than a year earlier. 

The first approval can still reveal the target address on-chain before enough signers complete the freeze.

BitOK classified 107 events as clean interceptions in the latest 12-month period, with $127.6 million leaving targeted addresses between submission and execution. That was 6.1 times the gross amount measured in the preceding year. The figure counts activity across blacklist events and may include the same principal more than once.

The stakes extend well beyond one analytics report. USDT is the world’s largest stablecoin, with a current market value of about $183 billion. Issuer-controlled freezes have become part of law-enforcement recoveries. 

The US Department of Justice credited Tether’s assistance in a $225.3 million fraud case in 2025, while the Tether-backed T3 Financial Crime Unit says it has frozen more than $300 million across 23 jurisdictions.

A USDT Freeze Starts With a Public Warning

Tether can stop USDT held at an address by adding it to the token contract’s blacklist. On Ethereum and Tron, the order passes through a multisignature wallet: three of six owners must approve on Ethereum, while two of three approve on Tron.

The first signer submits the address. The remaining signers confirm it. Until the approval threshold is reached, the address and pending action are public, while the USDT can still be transferred.

BitOK examined activity from May 1, 2024, through May 9, 2026. Across 7,562 blacklisted addresses, the median submission-to-execution window fell from 3 hours 10 minutes to 1 hour 46 minutes on Ethereum. 

Tron’s median dropped from one hour and 57 minutes to one hour and 30 minutes.

Neither multisig changed its owners or approval threshold during the study. The improvement came from faster coordination between signers, leaving the underlying sequence intact.

The Sixfold Jump Comes With a Counting Problem

BitOK used a strict definition for a clean case: at least 95% of the starting balance left during the window, and no more than 5% remained when the freeze executed. It found 93 such events on Tron, representing $75.25 million in gross outflows, and 14 on Ethereum worth $52.38 million. The earlier period produced $20.9 million across 62 events.

These are event totals, rather than unique losses. In one Ethereum sequence, roughly $3.83 million moved through several addresses as Tether followed it. Five blacklist events generated $19.14 million of measured outflow even though BitOK placed the directly observed principal between $3.83 million and $7.66 million.

On-chain timing also cannot identify every actor or prove why each transfer occurred. The strongest evidence for automation comes from repeated movements that beat final signatures by seconds. The dataset and calculation scripts are public on GitHub, allowing the classifications to be checked independently.

Even Five Minutes Can Be Enough

The $37.3 million Tron case shows how little time a prepared transfer needs. The USDT left the targeted address and reached the SunSwap V3 router, where BitOK traced swaps that delivered about 133.7 million TRX. Once converted, Tether’s USDT contract could no longer freeze those funds directly.

Ethereum produced a tighter race. In July 2025, five related transfers of about $3.83 million each moved 24 to 96 seconds before separate freezes executed. Another address moved $27.12 million with 528 seconds to spare.

Longer waits increased the chance of some outflow on Tron. Large dollar movements clustered at the other end: $44.94 million of the $75.25 million in clean Tron outflows occurred in windows shorter than one hour.

Tether Has Already Tested a Faster Lane

The same dataset shows that Tether can nearly remove the wait when an operation is coordinated in advance. 

In March 2026, Ethereum’s median window fell to zero minutes, with some submissions and executions landing in the same block. Tron’s median fell to 1.6 minutes that month. Over the past year, about 16% of Ethereum freezes and 17% of Tron freezes were executed in under two minutes.

BitOK calls this an urgent mode and says the pattern is consistent with off-chain preparation, although the blockchain cannot reveal Tether’s internal process. 

The study also found seven instances in 2025 where blacklisting and destruction occurred in one block, totaling $32.02 million. Almost all of that came from one $31.77 million operation.

The research recommends collecting signatures privately before submitting an atomic transaction, or creating a formal emergency route for sensitive cases. Tether has already shown that faster coordination is possible.

The post How Criminals Move Millions in USDT Before Tether Can Freeze It appeared first on BeInCrypto.