The Tether Freeze Regime

At half past eight on a Wednesday morning in June last year, Tether started erasing balances. The whole operation took twenty-four seconds. When it finished, just under $196 million of USDT had ceased to exist. Not frozen, not seized, not moved somewhere a lawyer could argue about later. The tokens were struck from the supply, and the balances that had held them read zero.

It is the largest single-day destruction of USDT in history, five times the next-biggest day.

It was also the day the Iranian exchange Nobitex was hacked for roughly $90 million by the group Predatory Sparrow, which sent the stolen funds to unspendable vanity addresses as a political gesture. Nothing in our data ties those eight destroyed addresses to that hack. No on-chain path, no attribution label, no matching amount, and what was destroyed is more than twice what was stolen. The two things happened on the same day. That is all we can say about them.

Tether issues USDT, the most widely held stablecoin in the world. It trades as a dollar and gets used like one: by exchanges settling between themselves, by traders parking funds between positions, by businesses moving money across borders, and by ordinary savers in countries where holding actual dollars is difficult. Its contracts on Ethereum and Tron carry two switches no holder can override. addBlackList stops an address sending anything, ever again. destroyBlackFunds then deletes the balance of an address already frozen. Both switches are worked by a single key that Tether holds. The code asks for no other approval, and it gives the holder no warning. Whether anyone was told, and how often law enforcement asked first, is not something a ledger records.

That is an unusual amount of private authority over money, and it gets used far more often than most people holding USDT realise. Bitquery pulled every call to both switches on both chains, from the first freeze in 2017 to a cutoff this August, and rebuilt what each address was holding at the exact block it was frozen. This article measures how well that power works in practice. The answer turns almost entirely on one variable Tether controls, which is how quickly it moves. Two questions the record cannot answer are set out at the end, including where most of the escaping money finally lands. For the majority of it, no labelling provider has ever identified the destination.

What the blacklist holds

A freeze is a contract call. Tether's own key signs a transaction naming an address; from the next block, that address can receive USDT but cannot send it for as long as the flag stays set. Deletion is a second, separate call, and it happens to a minority of frozen addresses, 2,434 of 11,045.

Burning the tokens is not the same as destroying the value behind them. USDT is a claim on reserves Tether holds, so removing the token removes the claim and leaves the assets where they are. Tether issued a billion new USDT on the day of the June burn, which is a routine treasury operation rather than a replacement for what it had just erased. The ledger shows the tokens going. Where the value ends up is a question it does not answer.

Two things stand out from the shape of that record. The first is that this is now overwhelmingly a Tron story. Ethereum is where the practice began, but Tron is where it happens today, because Tron is where most USDT actually moves, since a transfer there costs cents rather than dollars. The balance has tipped a little further every year.

The second is the pace, which is running at roughly four times the long-run average this year. Our count also lands within one and a half percent of the figure independent researchers published in July. Two methods built separately from the same public chains, arriving at the same place, is the strongest evidence either one is right.

How much gets out depends on the clock

Every freeze has a response time: the gap between an address first receiving funds and Tether locking it. Sort the frozen population by that gap and a clean pattern appears. The longer Tether takes, the less it catches, and the relationship holds on two chains that share no infrastructure, no user base and no operational team.

The pattern is the same on both chains and it is not subtle. Freeze an address in its first week and most of what it received is still sitting there when the switch flips. Wait six months and almost none of it is. Tron runs hotter than Ethereum at every point on the curve, but the shape does not change.

Response time is the only variable here that Tether controls. Everything else, from how fast a courier network moves to which venue the money cashes out at, is set by the other side.

Freeze within a week and Tether keeps 59 cents on the dollar. Wait six months and it keeps twelve.Ethereum cohorts, ≤7 days vs >180 days

The largest destination is the blacklist itself

Follow the money that escaped from the addresses Tether caught quickly, the cases where it was genuinely fast, and much of it simply leaves the map. We can put a name to the destination of about two fifths of it on Ethereum, and less than a quarter on Tron. The rest goes to addresses no labelling provider has ever identified.

Of the named destinations, at least $101,697,457 reached addresses we identify as OKX deposits on Ethereum, at least $45,089,743 reached Binance and at least $24,370,635 reached HTX on Tron. Each of those is a floor, not a ranking: our deposit-address coverage varies 380-fold between venues, so a bigger number can simply mean a better-labelled exchange. One comparison does survive that caveat, because the bias runs against it. We hold three times fewer Ethereum labels for OKX than for Binance, and OKX still received twelve times more fast-cohort escape money.

The biggest destination isn't an exchange. $628,614,870 went to addresses that Tether later froze as well, 2.4 times everything reaching every identified exchange combined. The frozen set is a connected network passing money between its own members, not a list of unrelated wallets.

Money arrives from the regulated perimeter

Funding turns out to be far more concentrated than the raw counts suggest. Millions of addresses have sent money into the blacklist over the years, but on Tron a few dozen sources connect to half of every funded address on it.

Most of that money starts at a licensed exchange, because that is where dollars enter a blockchain in the first place. Six Binance hot wallets, the operational accounts an exchange pays out from, each fed around fourteen hundred addresses that were later frozen. Bybit, OKX, HTX, KuCoin, MEXC and the Huione Group all appear in the hundreds of millions across hundreds of addresses each.

One venue looks larger than all of them and is not. A Kraken hot wallet sits against $3.36 billion, but 94% of that is a single counterparty relationship, and the median address it fed received $11,585. Totals by venue flatter whoever happens to have one institutional customer who was later frozen, which is why the figures here are given as spread rather than as a league table.

None of that establishes wrongdoing by any venue. A withdrawal is the ordinary on-ramp from a bank account to a chain, and no exchange can know at the moment of payout which destination will be blacklisted two years later. The finding is about topology, not culpability: the frozen population is fed from the regulated edge of the system and then trades inside itself. On Tron alone, 61 frozen addresses moved $913,102,863 to other frozen addresses.

100% of every sanctioned address

Where the obligation is written down, the record is perfect. Every address designated by the U.S. Office of Foreign Assets Control is frozen: 80 of 80 on Ethereum, 100 of 100 on Tron. Not a majority, not a lag. All of them. The entities inside that set include ISIL-Khorasan, with 131 Tron addresses, North Korea's Cheil Credit Bank with 53, the Central Bank of Iran, Ansarallah, the Lazarus Group, Garantex, Chatex and SUEX.

This is the number that reframes everything above it. When a government hands Tether a list, Tether executes it completely. The delay measured in section two is not indifference to enforcement. It is a detection problem. No government publishes a list of the other 10,865, and finding them takes months.

One precision, because the distinction is routinely collapsed: 411 frozen addresses carry a sanctions label in our data, but only 180 appear verbatim on OFAC's published list. The other 231 are inferences made by labelling providers, plausible, often right, and not the same thing. We never merge the two counts.

386 days

More than thirteen hundred addresses have since been let go, holding three quarters of a billion dollars between them at the moment they were frozen. On Tron the releases are accelerating sharply: this year alone has already produced three times as many as the whole of last year.

The obvious reading is that some of these were bad actors who got a second chance. The data says otherwise, and it says it loudly. A released address is twelve to nineteen times less likely than one still frozen to have ever been flagged for anything, by any labelling provider. Across the entire released population, four addresses out of 1,303.

This is a false-positive population. People swept up next to something, then let go once somebody looked.

More than a year, on Ethereum, of holding a balance you can see, denominated in a token that is supposed to be worth a dollar, that you cannot move, and no route of appeal that Tether publishes.

The shape of the population explains who this happens to. Most of the value sits in a small number of very large addresses, but most of the addresses are small. That tail is where false positives concentrate, and a $600 balance is not worth anyone's escalation.

Circle, which issues USDC, offers the only like-for-like comparison available. On Ethereum, Tether has blacklisted 3,068 addresses to Circle's 808, and reverses 11.3% of its freezes against Circle's 27.6%. A quarter as many freezes, and reversal two and a half times as often.

Addresses in this investigation

Every figure here comes from public chain data. These are the individual addresses and transactions behind the moments described above, so any reader can go and look at them.

Amounts are the balance at the exact block of the freeze, except the final two rows, which are the totals those addresses moved onward.