Criminals Move Millions in USDT Before Tether Can Freeze It

On June 5, 2025, a Tron wallet containing $37.3 million in USDT was targeted for a blacklist by Tether. The freeze process, which requires multisignature approval, took 5.7 minutes, but the full balance was transferred two minutes before the final signatures were applied.

How Tether Executes a Freeze

Tether can block USDT at a specific address by adding it to a contract blacklist. On Ethereum, three of six owners must approve; on Tron, two of three owners must approve. The first signer submits the address, making the pending action public, while the tokens remain transferable until the required threshold is met.

Speed Improvements Over Time

Blockchain analytics firm BitOK tracked blacklist events from May 1 2024 to May 9 2026. Median submission‑to‑execution times fell from 3 hours 10 minutes to 1 hour 46 minutes on Ethereum, and from 1 hour 57 minutes to 1 hour 30 minutes on Tron. The reduction reflects faster coordination among signers, not changes to the multisig structure.

Scale of Clean Interceptions

• BitOK identified 107 “clean” interceptions in the latest 12‑month period, with $127.6 million leaving targeted addresses between submission and execution.
• These outflows were 6.1 times the amount measured in the preceding year.
• On Tron, 93 events moved $75.25 million; on Ethereum, 14 events moved $52.38 million.

Case Studies of Rapid Transfers

The $37.3 million Tron case shows that a prepared transfer can clear the address in under three minutes, moving the funds to a SunSwap V3 router and converting them into roughly 133.7 million TRX, after which the USDT contract can no longer freeze the assets.

On Ethereum, July 2025 saw five related transfers of about $3.83 million each that occurred 24–96 seconds before separate freezes, and another address moved $27.12 million with 528 seconds remaining.

Fast‑Track Freezes

In March 2026, Ethereum’s median freeze window dropped to zero minutes, with some submissions and executions occurring in the same block; Tron’s median fell to 1.6 minutes. Approximately 16 % of Ethereum and 17 % of Tron freezes were executed in under two minutes, suggesting pre‑arranged off‑chain signature collection.

Implications and Recommendations

The research highlights a persistent race between Tether’s freeze mechanisms and criminal actors, often decided in seconds. BitOK recommends private signature collection before submission or an emergency route for high‑risk cases to reduce the window for illicit transfers.