A statistical report on known USDT freezes: mechanics, documented cases, legal basis — and what this means for asset recovery.
Frozen Assets (Tether, Apr 2026)
Blocked wallets (Tether, Jul 2025)
Blacklist proposals ETH+TRON (BlockSec)
in 65 countries · 340+ authorities
Report 2026
Executive Summary
addBlacklist block and balance via destroyBlackFunds destroy.The publicly attributable USDT freezes range from the Omni hack response in 2017 through major fraud and sanctions cases to the US-coordinated freezes in 2026. In July 2025, Tether stated that it had blocked over 5,000 wallets and frozen over 2.9 billion USDT; by April 2026, Tether was reporting more than 2,300 cases, cooperation with over 340 authorities in 65 countries, and more than 4.4 billion USD in frozen assets.
These named cases represent only a small part of the entire blacklisting universe: BlockSec analyzed a total of 8,310 executed cases up to February 14, 2026. addBlacklist-Proposals on Ethereum and TRON; for 2025 alone, 4,163 unique addresses with a total of 1.26 billion USD of USDT frozen.
The documented case volumes show a clear escalation over the years — with a marked jump in 2026, driven by two very large sanctions and investigation-related shutdowns (Pig-Butchering 61 million, Iran/OFAC 344 million USD).
The decisive date is always the first reliably documented freeze as the incident date; subsequent procedural steps (seizure, burn, reissue) are explained in the text. „—“ = chain not specified in the primary source; „∼“ = rounded.
| Date | Chain | Amount USDT | instigator | Occasion |
|---|---|---|---|---|
| 2017-11-19 | Omni | 30.950.010 | Tether | Response to Omni-Hack („Critical Announcement“) |
| 2021-08-10 | Ethereum | 33.000.000 | Tether | Poly-Network Hack |
| 2022-01-13 | Ethereum | >160,000,000 | Official inquiry | 3 ETH addresses |
| 2022-11-10 | TRON | 46.549.320 | Law Enforcement | FTX-associated wallet (unconfirmed) |
| 2023-11-21 | — | 225.000.000 | USSS · DOJ · OKX | Crime Syndicate; voluntary self-exclusion |
| 2023-11-21 | — | ~9,000,000 | DOJ · USSS | Asset transfer supported |
| 2024-03-12 | — | ~1,400,000 | DOJ · FBI | multiple wallets |
| 2024-03-19 | Ethereum | 200.000 | Tether → Burn/Reissue | Ohio Case Seizure Warrant |
| 2025-03-07 | — | 23.000.000 | USSS | Garantex (OFAC-sanctioned) |
| 2025-07 | — | 460.000 | RCMP | Ontario Fraud (Recovery) |
| 2025-07-24 | — | ~1,600,000 | US authorities | BuyCash / Terrorism Financing |
| 2025-11-13 | — | ~12,000,000 | Royal Thai Police · USSS | Transnational scam network |
| 2026-02-24 | — | ~61,000,000 | HSI · DOJ | Pig butchering fraud |
| 2026-04-23 | — | 344.000.000 | OFAC · US authorities | Iran „Economic Fury“ (2 addresses) |
Frozen mid-transfer. Centrally administered smart contract functions allow the issuer to block an address — the crucial technical lever for asset recovery.
On Ethereum/ERC-20, USDT is a smart contract with centrally administered permissions. The official Solidity file details the owner-only functions. addBlacklist, removeBlacklist and destroyBlackFunds; transfer and transferFrom Check if the sender or source address is blacklisted — if so, the movement will fail.
On Omni, the model was historically different, but also centrally controllable (omni_sendfreeze / omni_sendunfreeze (for managed properties). According to BlockSec, Ethereum and TRON will have a Multisign Governance Additionally: a freeze is considered submitTransaction() plus several confirmTransaction() (3 confirmations on ETH, 2 on TRON). The median delay between proposal and block was > 5 hours (ETH) and approximately 2.6 hours (TRON) — an operationally relevant delay. Front-running gap, in which destination addresses can still transfer funds.
Tether's power to intervene rests on two levels: First, the Terms allow tokens to be frozen "as required by applicable law" or at its own discretion (British Virgin Islands law). Second, the Law Enforcement Policy generally requires "appropriate legal process"—subpoenas, search warrants, production orders—with a narrowly defined review of voluntary requests.
US court documents reveal the translation into an asset recovery model: The Ohio forfeiture lawsuit cites 18 USC § 981(a)(1)(C) (Civil Forfeiture) as well as §§ 1343 and 371 — and describes freezing, subsequent burning after a seizure warrant, and reissuance to a government wallet. Sanctions law is the second pillar: Since December 2023, Tether has been proactively freezing new OFAC SDN listings; in the Garantex and Iran cases, sanctions enforcement, investigative cooperation, and issuer blocking capabilities are closely intertwined.
USDT freezeability is a recovery lever. Unlike native coins, the issuer can centrally block access — those who provide the correct addresses early significantly increase their chances of securing their funds.
Off-ramp and CEX experience is invaluable. The documented reason and the cooperation between authorities usually arise where regulated service providers are involved.
Speed beats the front-running gap. The multisig delay of hours is precisely the window in which perpetrators transfer funds — monitoring and fast, accurate reporting are crucial.
Documentation is key. Complete Tx hashes, timelines and address mapping turn a freeze request into a usable forfeiture/recovery case.
USDT value is generally 1 USDT ≈ 1 USD. Evaluation status: ongoing until 2026; aggregate figures vary depending on the Tether/BlockSec cut-off date.
David Lüdtke
Managing Director · OSINT Analyst & Crypto Forensic Expert · Financial Forensics GmbH
Court-admissible crypto transaction analysis, OSINT-based asset investigation, and expert reports for defense attorneys, insolvency administrators, and companies. Certified Crystal Expert (CECF, CEEI, CEUI). Financial Forensics Supports law firms, companies, investigative bodies and insolvency administrators — focus areas: Blockchain forensics, wallet analysis, court-admissible documentation, OSINT.
Contact: postfach@finanz-forensik.de · +49 6057 772 994 86 · finanz-forensik.de
We cluster transactions, identify off-ramps, and provide authorities with the precise addresses for freeze and seizure requests — before the front-running vulnerability is exploited.
You are currently viewing a placeholder content from Vimeo. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from YouTube. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou need to load content from reCAPTCHA to submit the form. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Google Maps. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Vimeo. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from YouTube. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Instagram. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Google Maps. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More informationYou need to load content from hCaptcha to submit the form. Please note that doing so will share data with third-party providers.
More informationYou need to load content from reCAPTCHA to submit the form. Please note that doing so will share data with third-party providers.
More informationYou are currently viewing a placeholder content from Turnstile. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More information