The Application of Stablecoins in Money Laundering and Terrorist Financing: Analysis of USDT Blacklisted Addresses

Introduction

Stablecoins have developed rapidly in recent years, and their widespread use has attracted the attention of regulatory agencies. Mainstream stablecoins such as USDT and USDC have the technical capability to freeze illegal funds and have played a role in combating money laundering and illegal financial activities in practice.

This article will analyze from two perspectives:

1. Systematic review of the freezing actions of USDT blacklist addresses;
2. Discuss the connection between frozen funds and terrorist financing.

1. USDT Blacklist Address Analysis

We identify and track Tether blacklist addresses through on-chain event monitoring. The analytical method has been validated through the Tether smart contract source code. The core logic is as follows:

• Event Identification: The Tether contract maintains the blacklist status through the "AddedBlackList" and "RemovedBlackList" events.
• Dataset Construction: Record the basic information of each blacklisted Address, including the Address itself, the time it was added to the blacklist, and the time it was removed ( if applicable ).

1.1 Core Findings

Based on the Tether data on the Ethereum and Tron chains, we found:

As of January 1, 2016, a total of 5,188 addresses have been blacklisted, involving frozen funds of over 2.9 billion USD.

From June 13 to June 30, 2025, 151 addresses were blacklisted, with 90.07% coming from the Tron chain, and a frozen amount of $86.34 million. The blacklist incidents peaked on June 15, 20, and 25, with 63 addresses blacklisted on June 20 alone.

• Frozen Amount Distribution: The top ten addresses with the highest amounts have frozen a total of 5.345 million USD, accounting for 61.91% of the total. The average frozen amount is 571.8 thousand USD, and the median is 40 thousand USD.

• Lifecycle fund distribution: These addresses have received a total of $808 million in funds, of which $721 million was transferred out before being blacklisted, leaving only $86.34 million actually frozen. 17% of the addresses have no outgoing transaction records.

• Newly created addresses are more likely to be blacklisted: 41% of blacklisted addresses were created less than 30 days ago, 27% have existed for 91-365 days, and only 3% have been in use for more than 2 years.

• Most addresses achieved "escape before freeze": About 54% of addresses transferred out more than 90% of their funds before being blacklisted, and 10% had a balance of 0 at the time of freezing.

• New Address Money Laundering Efficiency is Higher: The new address performs outstandingly in terms of quantity, blacklisting frequency, and transfer efficiency.

1.2 Fund Flow Tracking

We analyzed the fund flows of 151 USDT addresses that were blacklisted between June 13 and June 30, identifying the main sources and destinations of the funds.

1.2.1 Source of Funds Analysis

• Internal Pollution (91 Addresses): Funds come from other blacklisted addresses, showing a highly interconnected Money Laundering network.
• Phishing Tags (37 Addresses): Many upstream addresses are labeled as "Fake Phishing", which may be deceptive tags that conceal illegal sources.
• Exchange hot wallets (34 addresses): The sources of funds include multiple exchange hot wallets, which may be related to stolen accounts or "mule accounts."
• Single main distributor (35 addresses): The same blacklisted address appears multiple times as an upstream, which may be a fund aggregator or mixer.
• Cross-chain bridge entry (2 addresses): Some funds come from the cross-chain bridge, indicating the presence of cross-chain Money Laundering operations.

1.2.2 Fund Flow Analysis

• Flowing to other blacklisted addresses (54): There is an "internal loop chain" structure among the blacklisted addresses.
• Flowing to centralized exchanges (41): These addresses transfer funds to the deposit addresses of multiple exchanges to achieve "exit".
• Flow to cross-chain bridges (12): Indicates that some funds are attempting to escape the Tron ecosystem and continue cross-chain money laundering.

It is worth noting that some exchanges appear on both the inflow and outflow sides, highlighting their core position in the capital chain. The current insufficient execution of AML/CFT by exchanges and the delay in asset freezing may allow criminals to complete asset transfers before regulatory intervention.

2. Terrorist Financing Analysis

We analyzed the administrative seizure order issued by the Israeli National Bureau for Counter-Terrorism Financing (NBCTF) to assess the use of USDT in terrorist financing.

2.1 Core Findings

• Release Timing: There is a lag in law enforcement response during periods of geopolitical tension.
• Target Organization: Since the outbreak of the conflict on October 7, 2024, the NBCTF has issued a total of 8 seizure orders, 4 of which explicitly mention "Hamas", and the latest one mentions "Iran" for the first time.
• The addresses and assets involved in the seizure order: including 76 USDT (Tron) addresses, 16 BTC addresses, 2 Ethereum addresses, 641 accounts from a certain trading platform, and 8 accounts from a certain platform.

On-chain tracking of 76 USDT (Tron) Address reveals two behavioral patterns of Tether:

1. Proactive Freezing: Tether had already blacklisted 17 related Addresses an average of 28 days before the seizure order was issued.
2. Quick Response: For other addresses, Tether completes the freeze on average within 2.1 days after the announcement of the seizure order.

These signs indicate that there is a close, even proactive cooperation mechanism between Tether and some national law enforcement agencies.

3. Summary and Challenges Faced by AML/CFT

Although stablecoins provide technical means for transaction controllability, AML/CFT still faces the following challenges in practice:

3.1 Core Challenges

• Reactive Law Enforcement vs Proactive Prevention: Currently, most law enforcement actions still rely on post-event processing, leaving room for criminals to transfer assets.
• Regulatory Blind Spots of Exchanges: Centralized exchanges, as gateways for fund inflows and outflows, often have insufficient monitoring and struggle to identify abnormal behaviors in a timely manner.
• Cross-chain money laundering is becoming increasingly complex: the use of multi-chain ecosystems and cross-chain bridges makes the transfer of funds more covert, significantly increasing the difficulty of regulatory tracking.

3.2 Suggestion

We recommend stablecoin issuers, exchanges, and regulatory agencies:

• Strengthen on-chain intelligence sharing;
• Investment real-time behavior analysis technology;
• Establish a cross-chain compliance framework.

Only under a timely, collaborative, and technologically mature AML/CFT system can the legitimacy and security of the stablecoin ecosystem be truly guaranteed.