Tether's Race Against Time: Criminals Move Millions in USDT Before Blacklist Activation

On June 5, 2025, a notable incident occurred when a Tron wallet containing $37.3 million in USDT was targeted for blacklisting by Tether. The freeze process took just 5.7 minutes, but within that window, the entire balance was moved, showcasing the rapid pace at which criminals operate.

According to a study by blockchain analytics firm BitOK, Tether has improved its speed in executing USDT blacklists compared to previous years. The research indicates that the time between the submission of a blacklist request and its execution has decreased significantly. For Ethereum, the median time fell from 3 hours 10 minutes to 1 hour 46 minutes, while for Tron, it dropped from 1 hour 57 minutes to 1 hour 30 minutes.

BitOK identified 107 instances of successful transfers from blacklisted addresses, amounting to $127.6 million that left these addresses between the request submission and execution. This figure represents a dramatic increase, being 6.1 times higher than the previous year. The findings underscore a growing trend where criminals are able to exploit the time gap before a freeze takes effect.

Tether’s blacklisting process involves a multisignature wallet, requiring a majority of signers to approve the action. However, the initial submission of an address to be blacklisted is public, allowing criminals to act swiftly. The study found that in some cases, transfers occurred mere seconds before the freeze was executed.

In March 2026, Tether demonstrated its capability to expedite the process, with some blacklisting actions completed in the same block as the submission. This highlights the potential for further improvements in response times, as Tether adapts to the evolving landscape of crypto crime.