How criminals race Tether's freeze before it can blacklist USDT

On June 5, 2025, a Tron wallet holding $37.3 million in USDT became a target. Tether began blacklisting the address, and the freeze took 5.7 minutes to clear the issuer's multisignature approval process, BeInCrypto reported. Two minutes before the final signature landed, the entire balance moved out, reached the SunSwap V3 router, and converted into about 133.7 million TRX. Once the funds left USDT, Tether's contract could no longer touch them.

Tether freezes USDT by adding an address to the token contract's blacklist. On Ethereum, three of six multisig owners must approve the action; on Tron, two of three. The moment the first signer submits an address, that address and the pending freeze become visible on-chain, and the funds remain transferable until enough signers approve. That window, between submission and execution, is where the race happens.

Blockchain analytics firm BitOK examined 7,562 blacklisted addresses between May 1, 2024 and May 9, 2026. Over that period, the median time between submission and execution fell from 3 hours 10 minutes to 1 hour 46 minutes on Ethereum, and from 1 hour 57 minutes to 1 hour 30 minutes on Tron. Neither multisig changed its owners or approval threshold during the study; the gains came from faster coordination among the existing signers.

BitOK defined a clean interception as a case where at least 95% of an address's balance left during the freeze window, leaving 5% or less behind when the blacklist executed. By that measure, the most recent 12-month period produced 107 clean interceptions totaling $127.6 million in outflows, versus $20.9 million across 62 events the year before, a 6.1x increase. Tron accounted for 93 of those events and $75.25 million; Ethereum accounted for 14 events and $52.38 million.

Some of the closest calls happened on Ethereum. In July 2025, five related transfers of about $3.83 million each cleared 24 to 96 seconds before their respective freezes executed. A separate address moved $27.12 million with 528 seconds to spare.

Tether has also demonstrated the opposite extreme. In March 2026, its median Ethereum window dropped to zero minutes, with some blacklist submissions and executions landing in the same block. Tron's median fell to 1.6 minutes that month. Across the full year, roughly 16% of Ethereum freezes and 17% of Tron freezes executed in under two minutes, a pattern BitOK calls urgent mode and links to signatures prepared off-chain before the transaction ever hits the network. BitOK also identified seven cases in 2025 where blacklisting and fund destruction happened inside a single block, totaling $32.02 million, almost all from one $31.77 million operation.

The speed matters because USDT is the largest stablecoin on the market, with a value of about $183 billion, and issuer-controlled freezes have become a working part of law enforcement recoveries. The US Department of Justice credited Tether's cooperation in a $225.3 million fraud case last year, and the Tether-backed T3 Financial Crime Unit says it has frozen more than $300 million across 23 jurisdictions.

• Fastest documented escape: $37.3 million left a Tron address 2 minutes before a blacklist freeze executed
• Clean interceptions, most recent 12 months: 107 events, $127.6 million in outflows, a 6.1x jump from the prior year's $20.9 million
• Median freeze window: down to 1h46m on Ethereum and 1h30m on Tron, from 3h10m and 1h57m two years earlier
• Urgent mode: about 16% of Ethereum freezes and 17% of Tron freezes executed in under two minutes over the past year
• Stakes: USDT's market value is about $183 billion, and Tether-linked units have frozen more than $300 million tied to crime across 23 jurisdictions

BitOK's recommendation targets the gap directly: collect signatures privately before submitting the freeze as a single atomic transaction, or build a formal emergency route for time-sensitive cases, so a prepared actor no longer gets a public window to react in.

The research does not identify who moved the money in each case or prove intent behind every transfer. What it captures instead is a pattern: on-chain freezes that were public and interruptible got faster over the past year, and the addresses that escaped did so by moving within seconds or minutes of visibility, not hours.

This article is for informational purposes only and does not constitute investment advice.