Tether’s capacity to freeze USDT at specific addresses has solidified as a central compliance instrument within the stablecoin ecosystem. Since 2023, the company has frozen over $3.3 billion in USDT, and in the first half of 2026 alone, it coordinated with OFAC to freeze $526 million.
However, a technical examination of the underlying mechanisms reveals an operational contradiction: the freezing process incorporates a systematic time interval between the public proposal and the effective execution, an interval that can be exploited by holders of targeted addresses.
This lag is neither a programming error nor a fortuitous vulnerability. It is a direct consequence of the multisig governance architecture Tether employs to manage the blacklist function in USDT contracts on Ethereum and Tron. The question facing the sector is not whether this interval exists, but whether the industry can continue tolerating a compliance mechanism that, by design, publicly announces its targets before it can neutralize them.
The Mechanism: Two Steps, a Public Interval
The USDT freezing process operates in two distinct stages. A signer of the multisig wallet submits a proposal via a submitTransaction() call to the multisig contract. This transaction is immediately visible on-chain and includes the target address and the action type (addBlackList). Subsequently, other signers must approve the proposal via confirmTransaction() calls. Once the confirmation threshold is reached—three on Ethereum, two on Tron—the proposal executes and the address is frozen.
Any entity monitoring the multisig contract can identify the address to be frozen before the freeze materializes. The interval between proposal and execution constitutes what BlockSec terms the “freeze gap.”
An analysis of 2,955 freezing events on Ethereum and Tron yielded an average time between proposal and execution of 2 hours, 16 minutes, and 15 seconds. BlockSec, analyzing 8,293 proposals executed between 2017 and February 2026, reported a median of approximately 5.1 hours on Ethereum and 2.6 hours on Tron. Only 5% of freezes execute within five minutes, and fewer than 30% within one hour. This implies that for over 70% of USDT freezes, a window of at least one hour exists between public proposal and execution.
Quantitative Evidence: Funds in Motion
Data from multiple sources document substantial transfers occurring during the freeze window.
The analysis of the 2,955 freezing events identified that at least 60 addresses managed to fully empty their USDT holdings between proposal and execution, totaling $20.4 million. These transfers began, on average, 14 minutes after the freeze proposal, with the majority of funds moving within the first 15 minutes. Another 113 addresses transferred a portion of their assets prior to freezing, amounting to approximately $35.5 million.
The most documented case occurred in July 2026, when OFAC sanctioned four Tron wallets containing over $165 million in stablecoins. Tether managed to freeze $131 million, but approximately $34 million had already been withdrawn before block confirmation.
BlockSec, in a broader analysis of 8,310 executed freeze proposals, estimates that the total amount of USDT that escaped freezing amounts to $215.5 million, of which $141.7 million corresponds solely to 2025. The largest single escape recorded was $37.3 million from a single Tron wallet, moved in under six minutes.
A BitOK study covering the period from May 2024 to May 2026 classified 107 events as “clean interceptions,” in which $127.6 million exited target addresses between proposal and execution. This figure represents an increase of 6.1 times compared to the prior period.
Automation and Informational Asymmetry
The observed patterns suggest that actors successfully evading freezes do not operate reactively or casually. The fact that transfers begin on average 14 minutes after the proposal indicates the existence of automated monitoring systems that track Tether multisig proposals in real time.
A March 2026 arXiv paper describes how blacklist calls, operating as standard blockchain transactions, are susceptible to front-running and MEV (miner-extractable value) attacks. Validators and block producers order transactions according to fees and incentives, not regulatory priority. A freeze transaction does not have a priority lane. This is a fundamental property of public blockchains: transaction ordering is competitive by design.
If the delay interval is known and predictable, sophisticated actors can construct automated systems to anticipate freeze transactions. MEV bots already operate in this manner in other contexts.
The company has in fact reduced execution times significantly. BitOK documented that the median on Ethereum decreased from 3 hours and 10 minutes to 1 hour and 46 minutes between 2024 and 2026. In March 2026, the median on Ethereum reached zero minutes in some periods, and approximately 16% of freezes on Ethereum and 17% on Tron executed in under two minutes.
However, reducing average times does not eliminate the structural problem. The interval persists because it is inherent to the multisig governance model. Tether has demonstrated the ability to execute freezes within single blocks when coordinating mass operations—such as the freeze of $38.4 million across 19 Tron addresses in a single block—but these cases require prior coordination that is not viable for all situations.
The $37.3 million case from June 5, 2025, is illustrative: the freeze took 5.7 minutes to traverse the multisig, but the transfer occurred two minutes before final approval. Even an interval of minutes can be sufficient.
Centralization on Decentralized Networks
Tether occupies an unusual institutional position. It issues tokens on decentralized, permissionless networks, yet is expected to enforce the same compliance obligations as traditional financial institutions. This tension generates an operational paradox: freezing power is centralized (only Tether can execute it), but the execution mechanism is subject to the decentralized consensus rules of the underlying networks.
The problem is not resolvable through a software upgrade to the USDT contract. It is a consequence of how public blockchains function. Any solution that would prioritize freeze transactions over other transactions would require modifications to the consensus layer of the networks—an intervention Tether cannot unilaterally implement.
On one hand, asset freezing is an indispensable compliance tool that has enabled Tether to collaborate with over 340 law enforcement agencies across 65 countries and assist in freezing more than $4.4 billion in assets. On the other hand, the mechanism by which these freezes are implemented contains a systematic interval that can be exploited.
The data are conclusive: pre-freeze transfers are a recurring and quantifiable phenomenon, not an anomaly. The question for compliance teams, regulators, and market participants is not whether this interval exists, but how to manage the operational risk it represents. Technical solutions exist—real-time proposal monitoring, batch freeze coordination, signature time optimization—but none eliminate the fundamental interval between the public visibility of the intent to freeze and the effectiveness of the freeze at the consensus layer.
As long as Tether operates on decentralized networks, the freeze window will persist as a structural feature, not a correctable bug. The industry must incorporate this fact into its risk models and its expectations regarding the effectiveness of on-chain compliance tools.
