Exploring the Role of Digital Stablecoins in Money Laundering and Terrorist Financing: Analysis of Blacklisted USDT Addresses

Introduction

In recent years, stablecoins have developed rapidly, and their scope of application has been continuously expanding. This has led to increasing calls from regulatory agencies for the establishment of mechanisms to freeze illegal funds. Mainstream stablecoins such as USDT and USDC already possess this capability on a technical level and have proven their role in combating money laundering and other illegal financial activities in practice.

It is worth noting that stablecoins are not only involved in Money Laundering but also frequently appear in the financing processes of terrorist organizations. This article will analyze from two perspectives:

1. The system reviews the freezing status of USDT blacklisted addresses;

2. Discuss the relationship between frozen funds and terrorist financing.

1. Analysis of USDT Blacklist Addresses

We identified and tracked Tether’s blacklisted addresses through on-chain event monitoring. The analysis method has been verified by Tether’s smart contract source code, and the core logic is as follows:

• Event Identification: The Tether contract manages the blacklist status through two events
• Dataset Construction: Record relevant information for each blacklisted Address.

1.1 Main Findings

Based on Tether data on the Ethereum and Tron chains, we found:

Since January 1, 2016, a total of 5,188 addresses have been blacklisted, involving frozen funds of over 2.9 billion USD.

During the period from June 13 to June 30, 2025, a total of 151 addresses were blacklisted, of which 90.07% came from the Tron chain, with a frozen amount of up to 86.34 million USD. June 15, 20, and 25 were peak days for blacklisting, with June 20 seeing a single-day total of 63 blacklisted addresses.

• Frozen amount distribution: The top ten addresses have frozen $53.45 million, accounting for 61.91% of the total. The average frozen amount is $571,800, while the median is only $40,000, indicating that a small number of large addresses have skewed the overall average.

• Lifecycle Fund Distribution: These addresses have cumulatively received $808 million, with $721 million transferred out before being blacklisted, and only $86.34 million actually frozen. 17% of the addresses have no outgoing transaction records, possibly used as temporary storage or fund aggregation points.

• New addresses are more likely to be blacklisted: 41% of blacklisted addresses were created less than 30 days ago, 27% have been active for 91-365 days, and only 3% have been in use for over 2 years.

• Most addresses achieve “escape before freezing”: about 54% of addresses had transferred out over 90% of their funds before being blacklisted, and 10% had a balance of 0 at the time of freezing.

• New Address Money Laundering Efficiency is Higher: New addresses perform outstandingly in terms of quantity, blacklisting frequency, and transfer efficiency.

1.2 Fund Flow Tracking

We used on-chain tracking tools to analyze the fund flows of 151 USDT addresses that were blacklisted from June 13 to June 30.

1.2.1 Source of Funds Analysis

• Internal contamination (91 Address ): Funds come from other blacklisted addresses, indicating the existence of an interconnected Money Laundering network.

• Phishing Label (37 Addresses ): Upstream addresses are often marked as “Fake Phishing”, which may be a deceptive label to cover illegal sources.

• Exchange hot wallet (34 addresses ): The source of funds includes hot wallets from several well-known exchanges, which may be related to stolen accounts or “mule accounts.”

• Single Main Distributor ( 35 Addresses ): The same blacklisted address used multiple times as upstream, possibly a fund aggregator or coin mixer.

• Cross-chain bridge entry ( 2 addresses ): Some funds come from the cross-chain bridge, indicating the existence of cross-chain Money Laundering operations.

1.2.2 Fund Flow Analysis

• Flowing to other blacklisted Address (54 ): There is an “internal loop chain” between blacklisted addresses.

• Flowing to centralized exchanges (41 ): These addresses transfer funds to the deposit addresses of several well-known exchanges, achieving “cash out”.

• Flowing to cross-chain bridge (12: Some funds are attempting to escape the Tron ecosystem, continuing cross-chain Money Laundering.

It is worth noting that some exchanges appear on both the inflow and outflow sides, highlighting their core position in the capital chain. The current insufficient execution of AML/CFT by exchanges and the delay in asset freezing may allow criminals to complete asset transfers before regulatory intervention.

It is recommended that major cryptocurrency exchanges strengthen real-time monitoring and risk interception mechanisms to prevent problems before they occur.

2. Terrorist Financing Analysis

To understand the use of USDT in terrorist financing, we analyzed the administrative seizure order issued by the Israeli National Bureau for Counter Terrorist Financing )NBCTF(. This serves as a representative sample for a conservative estimate of USDT-related transactions involving terrorism.

) 2.1 Main Findings

• Release Date: Since June 13, 2025, only 1 new seizure order has been added on June 26, ###. The previous document was dated June 8, indicating a lag in law enforcement response during a period of geopolitical tension.

• Target Organization: Since the outbreak of conflict on October 7, 2024, the NBCTF has issued a total of 8 seizure orders, 4 of which explicitly mention “Hamas”, and the latest one mentions “Iran” for the first time.

• The seizure order involves Address and assets:

  • 76 USDT ( Tron ) Address
  • 16 BTC Addresses
  • 2 Ethereum Addresses
  • 641 accounts on a certain trading platform
  • 8 accounts on a certain trading platform

On-chain tracking of 76 USDT( Tron) addresses reveals two response patterns from Tether:

1. Proactive Freezing: 17 Hamas-related addresses were blacklisted an average of 28 days before the seizure order was issued.

2. Quick Response: The remaining addresses will be frozen within an average of 2.1 days after the seizure order is announced.

This indicates that Tether may have a close, even proactive, cooperative mechanism with some national law enforcement agencies.

3. Summary and Challenges Faced by AML/CFT

Although stablecoins provide technical means for controllability in transactions, challenges still exist in AML/CFT practices:

( 3.1 Core Challenges

• Reactive Law Enforcement vs Proactive Prevention: Most law enforcement still relies on post-event handling, giving criminals room to transfer assets.

• Regulatory blind spots of exchanges: As a hub for capital inflow and outflow, they often lack sufficient monitoring, making it difficult to timely identify abnormal behaviors.

• Cross-chain money laundering is becoming increasingly complex: multi-chain ecosystems and cross-chain bridges make fund transfers more covert, increasing the difficulty of regulatory tracking.

![Exploring Money Laundering and Terrorist Financing of Digital Stablecoins: On-chain Tracking of USDT Blacklist])https://img-cdn.gateio.im/webp-social/moments-5d800b1ecf4e47e2dbea7149c7146b97.webp###

( 3.2 Suggestion

Suggestions for stablecoin issuers, exchanges, and regulatory agencies:

• Strengthen on-chain intelligence sharing
• Investment Real-time Behavior Analysis Technology
• Establish a cross-chain compliance framework

Only by establishing a timely, collaborative, and technologically mature AML/CFT system can the legitimacy and security of the stablecoin ecosystem be truly guaranteed.

![Exploring Money Laundering and Terrorist Financing of Digital Stablecoins: On-Chain Tracking of USDT Blacklist])https://img-cdn.gateio.im/webp-social/moments-ead6b417dc0065a068fabca94d96176b.webp###