cyberx_█
← back to indexOn-Chain Tracing10 min read

Tether can freeze USDT. What that means if you've lost money

The button exists, it's written into the USDT contract, and only Tether can press it. As a rule, the request comes from law enforcement, not the victim. Freezing stops the money, but it doesn't send it back on its own. And everything depends on the funds still being there.

Robert F.
Tether can freeze USDT. What that means if you've lost money
▸In this article

Anyone who loses money to a crypto scam hears, sooner or later, that "Tether freezes wallets." It's true, and it's written in code. What almost never comes with it is the rest of the sentence: who can make the request, what happens to a frozen balance, and why a freeze only reaches what hasn't already moved.

This analysis draws on the USDT contract itself, on Tether's own publications, and on public records. Where something is one party's account, it is labelled as such. Quotations from English-language sources appear in our translation, except where kept in the original.

The button is in the contract

USDT is not like bitcoin. It is issued by a company, Tether, through a smart contract that has an owner. The published and verified source code of the contract on Ethereum contains a block called BlackList, with three functions: addBlackList, which adds an address to the block list; removeBlackList, which removes it; and destroyBlackFunds, which zeroes out the balance of an address already on the list. All three can only be called by the contract owner. The USDT contract on TRON exposes the same functions.

Every use is recorded on-chain as a public, timestamped event: AddedBlackList, RemovedBlackList, DestroyedBlackFunds. And anyone can ask the contract whether an address is on the list through the read function isBlackListed. A USDT freeze, then, is neither rumour nor favour: it is a state you can verify.

The block applies only to outgoing funds

The detail almost nobody mentions sits in two lines of code. The transfer function rejects the operation when the sender is on the list. There is no equivalent check on the recipient. In practice, a frozen address can no longer send USDT, but it keeps receiving, and everything that comes in is trapped along with the rest.

Three consequences:

  • Sending USDT to a frozen address means losing access to the funds. That applies both to someone who sends by mistake and to someone talked into "completing" a payment.
  • The freeze applies to USDT, not to the whole wallet. Other assets at the same address, such as TRX or ether, follow different rules, because they are different contracts or the network's native coin.
  • It is network-specific. The Ethereum and TRON contracts are separate, each with its own list. Being blocked on one network says nothing about the other.

This analysis examined the USDT contract. Other company-issued coins may have a similar mechanism, but they were not reviewed here. Bitcoin and ether have no issuer, and none of this exists on them.

Who presses it, and at whose request

Only Tether changes the list. The useful question is what prompts it to do so, and the answer has three parts.

A law enforcement request. Tether's law enforcement request policy, published with a 2018 date, states that, as part of an investigation, police may want an address frozen, and that such requests "should be accompanied by appropriate legal process." The same page concedes that this "varies from place to place" and even covers requests for voluntary cooperation. The channel is built for authorities. The page describes no route for a victim to make the request directly.

Sanctions. Since 1 December 2023, Tether has unilaterally frozen addresses that appear on the US Treasury's sanctions list, OFAC's SDN list. OFAC publishes crypto addresses as identifiers for sanctioned persons and warns that the list "may not be exhaustive."

Its own initiative. In November 2023, the company announced it had "proactively and voluntarily" frozen roughly 225 million USDT tied to a network running romance-then-investment scams out of Southeast Asia. By the company's account, the investigation was conducted with an exchange and taken to US authorities, and only then did a freeze request arrive from the Secret Service, alongside the voluntary block. The terms of service in force reserve Tether the right to freeze funds "in its sole and absolute discretion" in the face of prohibited use.

A freeze, then, is an act of the issuer. It usually follows a request from an authority, but it is not a ruling and does not always depend on a court order.

As for scale, the only figures available are the company's own, with no published methodology. In a statement dated 23 April 2026, Tether cited more than US$4.4 billion frozen across more than 2,300 cases, with 340 agencies in 65 countries. On 11 September 2026, the figures were more than US$5 billion and 2,800 cases, across 67 countries. These are cumulative, self-reported totals.

In Brazil: the police and the courts

There is a public record of two routes.

The first runs through law enforcement. Together with TRON and the analytics firm TRM Labs, Tether maintains a unit called the T3 FCU. In its first-year report, dated 31 October 2025, the unit counted US$300 million frozen across 23 jurisdictions — a different and far smaller universe than Tether's overall total. Brazil appears there with more than US$13 million, across seven cases. The same text states that the Polícia Federal formally acknowledged the unit's assistance in Operação Lusocoin, a money laundering and illegal foreign exchange investigation involving crypto assets, said to have included 4.3 million USDT. These are two distinct figures, and both are Tether's account: the PF's statement on the operation was inaccessible on the government portal when this piece was closed. Lusocoin is a laundering case, not a scam against an individual. What it shows is that the channel between Brazilian police and the issuer exists.

The second runs through the courts. According to the specialist press, the Tribunal de Justiça de São Paulo ruled in May 2026, unanimously and overturning the lower court, that Tether must freeze USDT linked to a fake mining pool scam. The victim reportedly lost more than US$42,000, and a tracing report followed the funds on TRON to five addresses. We were unable to locate the decision, and the reports do not give the case number. For that reason the ruling appears here as press reporting, not as a document we have read.

In both routes, the party making the request is an authority. The victim's role is to reach that authority with what makes the request possible.

What a freeze is not

It is not a refund. The destroyBlackFunds function zeroes out the blocked address's balance and reduces the total USDT supply. It is a burn. The contract also has an issuance function, issue, likewise restricted to the owner. Whether the burned amount is reissued, and to whom, is decided outside the code, case by case. In August 2024, the company reported freezing wallets at the FBI's request, leading to the seizure of nearly US$5 million in USDT taken from victims of a fake investment scam. The statement refers to seizure and forfeiture. It does not say how much went back to each victim.

It only reaches what is still there. The block captures whatever USDT balance sits at the address at the moment Tether adds it to the list. If the funds have already been transferred or swapped for another asset, there is nothing there to freeze. The trail remains public, because blockchain is not anonymity, but the freeze then depends on reaching the next address.

It is neither infallible nor beyond challenge. In its 2023 statement, Tether itself anticipated unfreezing legitimate wallets caught in the net. And since 31 August 2026 a suit has been pending in New York against the company (Rukthammachalern v. Tether Holdings) in which, according to press reports, the plaintiffs allege their funds were frozen without a court order. That is one party's allegation, with no ruling yet.

It cannot be bought. Since only Tether changes the list, nobody "unfreezes" or "releases" USDT for a fee. Anyone promising a victim that is running the second scam.

What to do with the hash in hand

What an authority needs in order to request a freeze starts with what the victim already has: the transaction hash, which identifies the transfer, and the sending and receiving addresses. Keep the hash, file a police report, and bring those details. Do not send anything further to "validate," "release," or "unlock" what was lost.

Time matters for the reason already given: the block only catches what hasn't moved. Knowing where the money went before you get to the police station shortens the conversation, and a document that can be verified is worth more than a screenshot, as the ABCs of digital evidence shows.

Our own tool

CyberX offers a free wallet lookup. It's ours, which is why it sits in this section, separate from the argument.

At cyberx.to/carteira-cripto, you paste an address or a transaction hash from Bitcoin, Ethereum and compatible networks, or TRON. The lookup reads the freeze list directly from the USDT contract, compares the address and its direct counterparties against the OFAC list, flags behavioural signals from the wallet, and follows the funds for up to three hops. No sign-up required. The preliminary report arrives by email, with a reference number.

It is a signal, not a verdict. The report is not a forensic examination or a legal opinion, and no factor, alone or combined, proves conduct or identifies a person. CyberX does not recover funds and is not a law enforcement authority. Every PDF issued has its hash recorded at issuance, and anyone can check whether a file is the original at cyberx.to/verificar.

In one line

Tether can stop a scammer's USDT, but the request comes from an authority, what stops does not come back on its own, and only what hasn't already moved can be stopped.

Sources

The contract

  • TetherToken contract on Ethereum, address 0xdAC17F958D2ee523a2206206994597C13D831ec7, verified source code: BlackList block and the transfer and transferFrom functions
  • TetherToken contract on TRON, address TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t: public contract interface, queried via the TronGrid API (wallet/getcontract) on 21 September 2026

Tether

Public records

Press

About the author

Robert F.

Robert F.

request a secure channel

Robert F. is the founder of CyberX, a digital intelligence operation applied to investigation, based in Brazil with cross-border reach.

He works in OSINT, on-chain tracing and antifraud for legal teams, corporate compliance, banking antifraud and public authorities.

In CyberX publications we write about what can be said in public — fraud and scam typologies, digital threats, on-chain tracing, regulation, and what separates an investigation from a database lookup. Never about a case we work on, clients, matters under judicial secrecy, or operational detail that would compromise an investigation in progress — ours or anyone else's. A third party's case enters through the public official act, and through what it teaches, not through what it exposed.

Related reading

CyberX works in digital intelligence applied to investigation — OSINT, on-chain tracing, and fraud prevention. This content is informational and does not constitute legal advice.

how we write →

Tags

[Cryptocurrency][Investment scam][Prevention][Digital evidence]

Share

LinkedInWhatsAppX