Tether’s capacity to freeze addresses holding USDT is not an operational vulnerability nor an exceptional emergency measure. It constitutes a fundamental feature of the smart contract architecture, integrated at deployment and persistent across all supported blockchains.
For crypto ecosystem—from over-the-counter desks to decentralized finance protocols and individual holders—a technical and operational comprehension of this mechanism is not optional; it is a prerequisite for risk assessment and asset management.
The Trifecta: Freeze, Unfreeze, Destroy
Tether’s control over its token supply materializes through three privileged functions within the smart contract. Access to these functions is restricted exclusively to the multisignature wallet controlled by Tether Ltd. These functions operate on a persistent mapping stored in the contract’s state, which records every address included in the restriction list.
addBlackList(address) : The activation function. When invoked against a target address, the contract establishes an on-chain flag that inhibits any outgoing transfer from that address. Incoming transfers remain technically executable; the transaction will confirm, and the balance will increase. However, the funds become permanently trapped within the frozen address, unable to be mobilized through any standard transfer or decentralized exchange interaction.
removeBlackList(address) : The unfreezing function. It eliminates the restriction flag and restores full transferability to the address. Its application is exceptional. Empirical data indicates that only approximately 3.6% of addresses added to the blacklist are eventually unfrozen. The remaining addresses retain the flag indefinitely, rendering their balances operationally inert.
destroyBlackFunds(address) : The most consequential function in the control set. It can only be invoked on addresses previously flagged by addBlackList. Its execution permanently burns the USDT balance held at the target address, reducing the total circulating supply on that specific chain.
Tokens destroyed through this method are irrecoverable at the source address. In operational practice, however, destruction is nearly always accompanied by a remint of an equivalent amount to a destination address designated by a court order or specified by the victim of a fraudulent scheme. This transforms a nominal supply reduction into a forced transfer of value, mediated entirely by Tether’s administrative authority.
In 2025, Tether destroyed approximately $698 million in USDT, representing 55.6% of the total value frozen during that year ($1.26 billion). These destroyed funds did not vanish from the economic system; they were reallocated through the remint mechanism to comply with judicial or law enforcement directives.
The Multisignature Process and the Freeze Gap
The execution of any privileged function does not occur instantaneously. The USDT contract on Ethereum and Tron is governed by a multisignature wallet. On Ethereum, 3 confirmations from authorized signers are required; on Tron, 2 confirmations suffice.
The operational sequence follows three discrete stages:
-
A signer submits a proposal viaÂ
submitTransaction()Â to the multisig contract. -
Other authorized signers confirm the proposal usingÂ
confirmTransaction(). -
Upon reaching the required threshold, the proposal executes, triggering theÂ
addBlackList()Â function on the target address.
The critical structural element is that stage one is public. Any entity monitoring the multisig contract can observe, in real time, which address is scheduled for freezing. The interval between the initial proposal and final execution constitutes what BlockSec defines as the “freeze gap”.
Aggregated data from 8,293 executed freeze proposals between 2017 and February 2026 reveals a median delay of approximately 5.1 hours on Ethereum and 2.6 hours on Tron. Only 21.8% of freezes on Ethereum and 33.3% on Tron execute within one hour of proposal submission. At the opposite extreme, 24.6% of freezes on Ethereum and 20.8% on Tron require more than one day to reach execution.
BlockSec estimates that more than $215.5 million in USDT has escaped freezing since 2017, exploiting this operational window. At least 60 addresses completely drained their holdings between proposal submission and execution. The most significant documented case occurred in July 2026, when OFAC sanctioned four Tron-based wallets containing over $165 million. Tether successfully froze $131 million, but approximately $34 million had already been withdrawn before the multisig threshold was reached.
Regulatory Framework and Application Cases
Tether maintains formal collaboration channels with more than 340 law enforcement agencies across 65 jurisdictions. Freezes are triggered through four primary pathways:
-
Formal requests from law enforcement agencies: national or international bodies, frequently initiated before formal judicial proceedings commence.
-
Sanctions compliance: since December 2023, Tether enforces a policy of freezing wallets associated with the OFAC SDN List.
-
Proactive blockchain intelligence: internal analysis of on-chain patterns and address clustering, executed without prior external request.
-
Exchange-level restrictions: centralized exchanges that restrict access to USDT based on referrals from regulatory authorities.
In April 2026, Tether coordinated the freezing of more than $344 million across two addresses in direct collaboration with OFAC. Within a 30-day period in 2026, the company froze over $514 million distributed across 370 addresses. As of July 2026, the cumulative total of addresses included in the blacklist stands at 9,597, with a frozen aggregate value of $5.69 billion.
The Rukthammachalern & Kasamvilas v. Tether Case
On October 30, 2025, Tether added 10 Ethereum addresses to the blacklist, containing 42,417,785.62 USDT. The judicial seizure order authorizing this action was not issued until February 19, 2026, a delay of nearly four months. The plaintiffs, two Thai entrepreneurs, allege that Tether acted solely on the basis of an informal request from a Homeland Security Investigations (HSI) agent, without a valid court order, subpoena, or warrant.
The case, filed in the U.S. District Court for the Southern District of New York on August 31, 2026, raises a central legal question:Â can a private issuer freeze assets based on informal agency requests?
Section 2(16) of the GENIUS Act defines a “lawful order” as one issued by a competent court or an authorized federal agency. Section 4(a)(6)(B) of the same legislation requires issuers to maintain the technical capacity to comply with lawful orders but does not explicitly grant issuers the authority to act as an arm of law enforcement in the absence of such an order. If the court determines that informal agency requests do not meet the threshold of a “lawful order,” the current operational model of “cooperative freezes” could face significant regulatory and legal obstacles.
Implications for the Crypto Sector
The control architecture of Tether generates three structural tensions that participants must evaluate.
- First: centralization of freeze authority. Tether issues tokens on permissionless, decentralized networks but is expected to fulfill the same compliance obligations as traditional financial institutions. The freeze power is centralized—only Tether can execute it—but the mechanism of execution operates within the consensus rules of the underlying networks. This creates a hybrid model where a single private entity holds veto power over liquidity on otherwise neutral infrastructure.
- Second: exposure of secondary market participants. The plaintiffs in Rukthammachalern emphasize that they had no direct contractual relationship with Tether, having acquired the tokens through secondary market transactions. This implies that any USDT holder, regardless of acquisition channel, is exposed to Tether’s freeze capacity without the due process mechanisms that typically characterize direct contractual relationships. The absence of privity does not shield the holder from administrative action.
- Third: the freeze gap as an exploitation vector. The inherent delay in the multisig process creates a rational incentive for automated monitoring of freeze proposals. On-chain data indicates that transfers from target addresses begin on average 14 minutes after a freeze proposal is submitted, signaling real-time surveillance of the Tether multisig contract. A March 2026 arXiv paper describes how blacklist function calls, operating as standard blockchain transactions, are susceptible to front-running and MEV extraction strategies. This transforms a compliance mechanism into a competitive information asymmetry.
The freeze mechanism is no longer a technical footnote in the USDT specification. It is the central feature defining the relationship between issuer, holder, and regulator. Participants who treat USDT as a commodity-neutral reserve asset overlook the programmable authority embedded in its contract. The question for the crypto sector is not whether Tether can freeze, but under what conditions and with what oversight it will do so in the future.
