The Issuer's Key: How Tether Freezes USDT, and When It Decides To

Most of the value that moves on TRON moves as USDTA US-dollar stablecoin issued by Tether, first launched in 2014 on Bitcoin's Omni Layer and circulating on TRON as a TRC-20 token since April 2019. Tether retains privileged functions in the token contract — it can blacklist addresses and destroy blacklisted balances — so every USDT balance is ultimately conditional on the issuer's authority. Not to be confused with counterfeit tokens that copy the USDT name and symbol without any issuer or backing., and most of the flows mapped in Following the Money — pig-butchering cash-outs, nested exchanges, guarantee-market settlement — are denominated in it. That chapter describes what the flows look like. This one covers the one party that can stop them without anyone’s permission: the token’sA unit of value recorded inside a smart contract rather than in the chain's native ledger — the contract keeps the balance table, and moving tokens means asking the contract to update it. Not to be confused with a coin, which is the chain's built-in asset (TRX on TRON) used to pay for the network itself. issuer.

The power to freeze USDT on TRON is written into the TRC-20TRON's smart-contract standard for fungible tokens, derived from Ethereum's ERC-20: a compliant contract exposes transfer, approve, allowance, and transferFrom, and emits Transfer and Approval events. USDT on TRON is issued as a TRC-20 token. Because every TRC-20 transfer is a contract call, it consumes Energy (plus Bandwidth) and — unlike a TRX or TRC-10 transfer — cannot activate a not-yet-created account. contract itself. What has changed is Tether’s stated view of when to use it. In 2022 the company said that freezing a secondary-market addressA public identifier, derived from a key pair, at which an account receives funds and is looked up on-chain. Anyone can view an address's history, but only the matching private key can spend from it. TRON addresses are 34-character Base58Check strings beginning with "T". without a law-enforcement instruction would be reckless; from December 1, 2023 it acted on OFAC designations directly; by April 2026 it had, by its own count, frozen more than $4.4 billion. Two stated positions and one running tally are on the record at tether.io, and an investigator needs all of them, because a blacklistAn issuer power built into a stablecoin's contract that flags an address so its balance can no longer be moved. In Tether's USDT contract the flag is set by an addBlackList function, and a companion destroyBlackFunds function can then permanently erase the frozen balance and shrink total supply. A freeze is an administrative act by the issuer — not to be confused with a seizure, which is a legal transfer of ownership under court or state authority. entry reads differently depending on which policy was in force when the address went dark.

The key in the contract

None of the history below would exist without a design fact about USDT itself: the token is issuer-controlled at the contract level. The USDT-TRC20 contract at TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t (the TetherToken contract, readable on-chain) exposes owner-controlled functions addBlackList, removeBlackList, and destroyBlackFunds, a public read function getBlackListStatus, and emits AddedBlackList, RemovedBlackList, and DestroyedBlackFunds events when the owner functions fire. It also carries pause, issue, redeem, and deprecate. The issuer can halt the token, expand its supply, and erase a blacklisted balance outright.

The consequence for the holder is total. A blacklisted address’s USDT stops moving regardless of who holds the private keyA mathematically linked pair — a private key that signs transactions, and a public key (with the address derived from it) that lets anyone verify those signatures. Whoever holds the private key controls the address: on a blockchain, ownership is key control, whatever any off-chain record says. "Keypair", "private key", and "public key" all refer to parts of this same structure.; the key still signs, and the contract still refuses. destroyBlackFunds goes further — the balance is destroyed at the contract level, after which Tether can issue equivalent tokens elsewhere. Ownership of the key and control of the funds have come apart, which is the distinction this field guide is built on.

TRON’s base layer remains permissionless — TRXThe native coin of the TRON network. TRX settles value directly (no contract call needed), is staked to obtain Energy, Bandwidth, and voting power, and is burned to pay fees when staked resources fall short. Its smallest unit is the sun: 1 TRX = 1,000,000 sun. and other TRC-20 tokens move without anyone’s approval — but the asset carrying most of the chain’s value answers to a single key in the issuer’s custodyAn arrangement in which one party — the custodian — holds the private keys or reserves controlling assets that belong to others. On a blockchain, whoever holds the keys is the on-chain owner: custodied funds sit under the custodian's addresses, so the entity an analyst sees acting on-chain is the custodian, not the customer.. The contract does not record why that key was used: a court order, a sanctions listing and the issuer’s own assessment all produce the same AddedBlackList event. The policy behind the call has to be read from Tether’s own statements: two that state a position, and a running record of what the key has been used to do.

August 2022: “a highly disruptive and reckless move”

Tether’s clearest public statement of policy on secondary-market freezes was a refusal. On August 24, 2022, after OFAC had sanctioned the addresses of the Tornado Cash mixerA service (also called a tumbler) that pools deposits from many users and pays recipients out of the common pool, deliberately breaking the on-chain link between sender and recipient. The severed trail can sometimes be re-joined by matching amounts and timing around the mixer, and U.S. guidance has treated custodial mixing itself as money transmission since 2019., Tether published its reasoning for not freezing them. Its reasoning was explicit. Freezing secondary-market addresses unilaterally “could be a highly disruptive and reckless move”; doing so might “interfere with ongoing and sophisticated law enforcement investigations.” Tether would act on the “verified instruction of law enforcement and other government agencies,” and it stated the operative fact plainly: “Tether has not been contacted by US officials or law enforcement with a request to freeze the addresses sanctioned by OFAC” — adding, in the same sentence, that it “normally complies with such requests from US authorities.”

The refusal was narrower than it is usually described. The same release said that Tether “will freeze deposits into its walletsSoftware or hardware that stores private keys and uses them to sign transactions. A wallet holds keys, not coins — balances live on the ledger itself — so the same funds can be reached from any wallet loaded with the same keys, and losing the wallet loses nothing if the keys are backed up elsewhere. where funds are received from a sanctioned address and will not send funds to a sanctioned address” — a sanctions control it was already running, on its own initiative, for the wallets on its own platform. What it declined to do was extend that control to addresses it did not custody. And it framed the line as deference rather than defiance: “So far, OFAC has not indicated that a stablecoinA token designed to hold a steady value against a reference asset, most commonly one US dollar. The target is maintained either by an issuer holding reserves that back and redeem the token, or algorithmically through mint-and-burn incentives — two very different risk models behind the same face value. issuer is expected to freeze secondary market addresses that are published on OFAC’s SDN List or that are operated by persons and entities that have been sanctioned by OFAC.” On Tornado Cash specifically it recorded that “no specific request has been put to us related to freezing relevant Tornado Cash addresses,” and that even there, “We would expect the same process of detailed communication and coordination even in this case.” Read in full, the August 2022 position is an issuer waiting for a regulatory expectation that had not been stated, not one refusing an expectation that had.

On the specific addresses at issue, Tether’s 2022 caution aged well. On November 26, 2024 the Fifth Circuit held in Van Loon v. Department of the Treasury that Tornado Cash’s immutable smart contractsA program deployed to a blockchain that runs deterministically when called, holding its own state and balance and enforcing its rules without any operator's ongoing involvement. Because a contract executes code rather than acting on anyone's initiative, its address represents logic — funds can flow through it, but the contract itself is not a person or a controlling entity. are not “property” under IEEPA at all, because they cannot be owned, and that OFAC had therefore exceeded its statutory authority; on March 21, 2025 OFAC delisted Tornado Cash from the SDN List.

The position was restated on October 11, 2022. “Tether, a non-US company that does not operate in the US, only provides this assistance voluntarily when there are legitimate law enforcement requests.” The same piece described the company as being “in almost daily contact with numerous key law enforcement officials” and put the total it had assisted in freezing at over $360 million as of that date. Together the two statements describe an issuer that, off its own platform, would use the key often but only as the instrument of someone else’s request. For a secondary-market address, a sanctions designation on its own was not a trigger.

For a trace, that policy has a concrete meaning, and a boundary. A secondary-market address blacklisted before December 1, 2023 was, on Tether’s stated policy, blacklisted at someone’s request. The boundary is Tether’s own platform: funds arriving in its own wallets from a sanctioned address were being frozen on Tether’s own initiative throughout, with no requester behind them. The inference is about addresses Tether did not custody, and it is only that.

December 2023: the change of trigger

On December 9, 2023, Tether announced a “voluntary wallet-freezing policy designed to combat activity connected with Sanctioned persons on the Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) List.” Tether dates the decision to December 1, 2023 — “On December 1, 2023, the company made the decision to initiate” it. Its mechanism was the thing Tether had declined to do in August 2022: it would “offer on the secondary market, the Sanctions controls it already enforces for wallets on its platform.” The controls applied to “new additions to the SDN List” and to “previously added addresses” alike.

Set against the 2022 statements, this is a change of trigger, and it is worth being exact about what changed and what did not. The control itself was not new: the August 2022 release had already described sanctions screening on Tether’s own wallets, and the December 2023 release presents the secondary-market policy as an extension of “the Sanctions controls it already enforces for wallets on its platform.” What changed was the scope of that control — from wallets Tether custodies to any address on the SDN List — and with it the trigger. A listing on the SDN list now moves the key by itself, for any address; no separate request from OFAC or from a law-enforcement agency is needed. The August 2022 argument — that acting without instruction might disrupt investigations — was never withdrawn, but it stopped governing the sanctions case.

The change is defensible on its own terms. An SDN listing is a published legal designation by a government agency, not an issuer’s private suspicion, and enforcing it on the secondary market is what regulated financial institutions already do with the same list. But it is a change, and it alters what a blacklist entry tells you. From December 1, 2023 onward, an AddedBlackList event on a sanctioned address can mean only that OFAC listed the address and Tether acted on the listing, with no other agency in the loop. The 2022 inference — a secondary-market freeze implies a named requester — no longer holds for that class of address.

Freeze is not seizure

The December 2023 policy added a trigger; it did not remove the older one. Requests from law enforcement kept arriving and Tether kept acting on them — the pipeline diagram above marks that path as the older one, still live — and the largest case on record shows it running in June 2025, well after the change. The same case also separates two words that headlines blur. A freeze is Tether acting on its own contract — administrative, reversible in principle, no court involved. A seizure transfers the value to a state under legal process.

On June 18, 2025, the Department of Justice filed a civil forfeiture complaint in the District of Columbia against more than $225.3 million in cryptocurrency traced from “cryptocurrency confidence scams” — pig-butchering proceeds laundered, per the complaint, through a network that “executed hundreds of thousands of transactionsA signed instruction ("tx" for short) that changes on-chain state — transferring value, calling a contract, or updating an account's settings. Once it is included in a block and that block reaches finality the record is permanent: later transactions can supersede its effects, but the entry itself can never be edited or deleted. Before finality, a freshly included transaction can still be reversed if its block is reorganized out.” to conceal the source. The Secret Service called it the largest cryptocurrency seizure in its history, and the DOJ formally thanked “Tether for its proactive assistance in this investigation.” Tether’s own same-day statement said it “facilitated the seizure of assets identified as proceeds of pig butchering fraud.” The scale of the underlying problem was in the same release: $5.8 billion in reported losses to crypto investment fraud in 2024 alone, per the FBI’s IC3 report.

For casework the sequence matters more than the case. Frozen funds still sit at their last address — the trace ends at a live balance that cannot move. Seized funds leave the criminal flow entirely and re-enter as government-controlled value. The AddedBlackList timestamp does not tell you which of those happened. What it tells you is whether the balance was frozen in place or had already moved on before the freeze — and so whether the pre-freeze history is where your trail continues. A seizure is not visible on-chain at all unless destroyBlackFunds fires; until then, a forfeited balance and a merely frozen one leave the same record.

April 2026: the record

The totals Tether publishes are cumulative and grow fast enough that each figure is meaningful only with its “as of” date. Every entry below is from Tether’s own releases, and each was obsolete within months.

As of	Cumulative frozen	Reach, as stated by Tether
Oct 11, 2022	$360M+	“almost daily contact” with law enforcement; assistance given on “legitimate law enforcement requests”
June 18, 2025	$2.7B+	255+ law-enforcement agencies in 55+ countries
Apr 23, 2026	$4.4B+	340+ law-enforcement agencies in 65 countries; 2,300+ cases supported globally, 1,200+ of them tied to U.S. law enforcement; $2.1B+ of the total connected to U.S. authorities

The release that carries the latest totals was itself a single action. On April 23, 2026, Tether announced that it had supported the freeze of $344 million in USD₮ across two addresses, in coordination with OFAC and U.S. law enforcement. Two addresses, one coordinated action, and a sum close to everything Tether had frozen in total as of October 2022.

The same release quotes Paolo Ardoino, Tether’s chief executive: “USD₮ is not a safe haven for illicit activity,” and, in the same statement, “When credible links to sanctioned entities or criminal networks are identified, we act immediately and decisively.”

Set that sentence beside the August 2022 one. In 2022, freezing a sanctioned secondary-market address without an instruction “could be a highly disruptive and reckless move.” In 2026, the chief executive describes the company as acting “immediately and decisively” when “credible links to sanctioned entities or criminal networks are identified.” Both are Tether’s words, but they are not the same kind of document. The 2022 and 2023 releases state a policy. The 2026 sentence is a characterization by the CEO, attached to one coordinated action, and it does not say who identifies the links. The action it describes ran on the older path — the $344 million freeze was coordinated with OFAC and U.S. law enforcement — so the release is evidence of scale and of continued cooperation, not a third policy. It is the record, and the record is what an investigator takes from it.

What the issuer’s key means for a trace

The permissionless-rail era of USDT on TRON ended in stages — request-driven freezes by 2022, sanctions-driven freezes from December 1, 2023, and by April 2026 a cumulative total past $4.4 billion — and the investigative terrain changed with it.

The rail is monitored, and monitoring should be expected to change behavior. A launderer who knows a balance can be immobilized by a single call has a reason to move faster, hold shorter and convert out of USDT sooner. This chapter has not measured that response, and does not claim to. What is documented is the shape of the obfuscation itself — When the Trail Goes Cold describes the short-dwell, multi-hop layering patterns as they appear on-chain — and the issuer-level blacklist statistics in USDT on TRON, which measure the control rather than the reaction to it.

A blacklisted address is a terminal node with a timestamp, and the timestamp has a policy attached. The blacklist is public and on-chain, and every serious analytics tool indexes it. An address frozen mid-flow tells you that someone — a requesting agency, or the issuer acting on a listing — reached this flow before you did, which is itself intelligence about the case you are working. The date refines it. A secondary-market address frozen before December 1, 2023 was, by Tether’s stated policy, frozen at someone’s request; the exception is Tether’s own platform wallets, which it was screening against sanctioned counterparties on its own initiative throughout. A freeze after that date on an SDN-listed address may be nothing more than Tether enforcing the listing, and the listing — not the freeze — carries the reasoning. Check the address against the SDN list before you infer an investigation from the freeze alone.

The freeze power is an attributionThe process of identifying the entity most likely to control a blockchain address by combining on-chain signals — who created and funded it, how it transacts, which keys can act for it — with known service patterns and labels. Attribution conclusions are evidence-weighted judgments, not certainties, and are strongest when several independent signals converge. ceiling and a control datum at once. On-chain analysis can map who funds and who controls a wallet, but it has no visibility into who can immobilize the wallet’s contents, because that power lives in the token contract’s owner key. Any control assessment of a USDT-heavy wallet is incomplete without the sentence: the issuer can end this wallet’s economic life unilaterally. Write that into the finding — the standard set out in From Finding to Evidence is that a report states what the on-chain record supports, and the record here includes a standing third-party freeze power over every USDT balance in the trace.

A token that launched on TRON in 2019 as cheap, permissionless dollar plumbing had, by its issuer’s own count as of April 23, 2026, seen more than $4.4 billion of its balances frozen, under a policy the issuer stated once in 2022 and restated with a wider scope in 2023. An investigator who still pictures Tether as an issuer that waits to be asked before it touches a balance is working from a policy the company itself retired on December 1, 2023.

Sources

• Tether — Tether Explains Its Decision On Tornado Cash Addresses, Awaits Law Enforcement Instruction (Aug 24, 2022) — the refusal to freeze the OFAC-sanctioned Tornado Cash addresses, the “highly disruptive and reckless move” and “interfere with ongoing and sophisticated law enforcement investigations” reasoning, the “verified instruction” requirement, the statement that no U.S. request had been received, the platform-wallet control already in force (“will freeze deposits into its wallets where funds are received from a sanctioned address”), and the “OFAC has not indicated” deference.
• Tether — Tether, Law Enforcement and Financial Freedom (Oct 11, 2022) — the voluntary, request-driven assistance policy of a “non-US company that does not operate in the US,” the “almost daily contact” with law enforcement, and the $360M cumulative frozen figure as of that date.
• Van Loon v. Department of the Treasury, No. 23-50669 (5th Cir. Nov 26, 2024) — the holding that Tornado Cash’s immutable smart contracts are not “property” under IEEPA, because they cannot be owned, and that OFAC exceeded its statutory authority in designating them.
• U.S. Department of the Treasury, OFAC — Recent Actions (Mar 21, 2025) — the removal of Tornado Cash from the SDN List.
• Tether — Tether Introduces New Policy to Strengthen Ecosystem Security (Dec 9, 2023) — the voluntary SDN wallet-freezing policy extended to the secondary market, the December 1, 2023 decision date, the “controls it already enforces for wallets on its platform” continuity, and coverage of new additions to the SDN List and previously added addresses.
• Tether — Tether Supports Freeze of More Than $344 Million in USD₮ in Coordination with OFAC and U.S. Law Enforcement (Apr 23, 2026) — the $344M freeze across two addresses, the cumulative totals ($4.4B+ frozen, $2.1B+ connected to U.S. authorities, 2,300+ cases, 1,200+ U.S. cases, 340+ agencies in 65 countries) as of that date, and the Ardoino quote.
• U.S. Department of Justice — United States Files Civil Forfeiture Complaint Against $225M in Funds Involved in Cryptocurrency Investment Fraud Money Laundering (June 18, 2025) — the $225.3M forfeiture, largest USSS crypto seizure, DOJ’s thanks to Tether, and the IC3 $5.8B 2024 loss figure.
• Tether — Tether Acknowledged by DOJ for Support in $225M Seizure (June 18, 2025) — Tether’s account of the seizure (“facilitated the seizure”) and its all-time totals: $2.7B+ blocked, 255+ agencies, 55+ countries, as of June 2025.
• USDT-TRC20 contract TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t (Tronscan) — the TetherToken ABIThe specification of a smart contract's functions, arguments, and data encodings — the machine-readable map that tells callers how to package a call and tells observers how to decode one. Without a contract's ABI, its call data and event logs are opaque bytes; with it, they read as named functions with typed arguments. Because standard interfaces such as the fungible-token standards fix their ABIs, explorers can decode a token transfer's real recipient and amount even on contracts whose source code was never published., read from the chain: addBlackList, removeBlackList, destroyBlackFunds, getBlackListStatus, pause, issue, redeem, deprecate, and the corresponding blacklist events.