Update (May 15 at 3:10 pm UTC): This article has been revised to incorporate comments from Tether.
A delay in Tether’s wallet blacklisting mechanism permitted over $78 million in illicit funds to be transferred before enforcement measures were enacted, as reported by the blockchain compliance firm AMLBot.
Tether’s address blacklisting becomes effective only after a significant lag from when the process is initiated on Ethereum and Tron, according to the report published on May 15.
“This delay stems from Tether’s multisignature contract configuration on both Tron and Ethereum, turning what should be an immediate compliance measure into a window of opportunity for illicit entities,” the report states.
Tether’s blacklisting protocol consists of multiple steps, with an initial transaction effectively alerting about the impending blacklisting. Firstly, a Tether administrator multisignature transaction submits a pending request to “addBlackList” on the USDT-TRC20 contract.
This results in a public “submission” of the targeted address as a candidate for the blacklist. It is followed by a second multisignature transaction that confirms the submission, leading to an “AddedBlackList” output, thereby making the blacklisting actionable.
Related: Tether, Tron, and TRM Labs collectively froze $126M USDT in 2024
A caution regarding impending blacklisting
In one instance shared with Cointelegraph, an onchain transaction submitting a Tron address as a blacklist candidate occurred at 11:10:12 UTC. The subsequent transaction that actually enforced the action did not take place until 11:54:51 UTC on the same day, indicating a 44-minute delay.
In practical terms, this delay can be perceived by owners of USDt about to be blacklisted as a signal to relocate their assets to evade freezing. The report mentioned:
“This interval between a freeze request and its execution on-chain creates a crucial attack window, enabling malicious actors to pre-empt enforcement and transfer or launder funds before the freeze is initiated.”
The report indicates that “for blockchain-savvy attackers, these delays represent optimal opportunities.” By monitoring Tether’s requests in real time, a fraudster can be promptly informed that their address is under scrutiny. When questioned by Cointelegraph about whether the delay is a technical constraint or merely a lag in the actions of a multisignature wallet keyholder, AMLBot researchers remarked that they cannot ascertain it without insight into Tether’s internal protocols.
In a statement to Cointelegraph, a Tether representative clarified that “while any delay in enforcement merits scrutiny, the notion that this represents a fundamental loophole is both misconstrued and lacking nuance.” The company asserts it collaborates with law enforcement to freeze addresses daily. The statement continues:
“Tether functions on public blockchains, where all actions are transparent […] This openness enables Tether, in partnership with over 255 law enforcement entities across 55 nations, to track, trace, and freeze illicit funds more rapidly than most realize.”
According to Tether, the delay cited in the report arises from its “multisignature governance model,” designed to prevent unilateral freezes and maintain the system’s integrity. The company concedes that the model also leads to enforcement delays, stating that “it’s a trade-off for responsible responsiveness to a $100+ billion ecosystem,” with enhancements in progress:
“We are actively improving this process to eliminate any potential advantage for malicious actors. If you believe you can use Tether to transfer illicit funds, think again.”
Related: Tether stablecoin issuer and Tron establish financial crime unit
Not merely theoretical
AMLBot reported that its data shows over $28.5 million in USDT was withdrawn during the interval between the two transactions on the Ethereum blockchain. This amount of freeze evasion was recorded between Nov. 28, 2017, and May 12, 2025. The average amount transferred during the delay exceeded $365,000.
Likewise, $49.6 million was reportedly withdrawn during freeze delay periods on the Tron blockchain, leading to a total of $78.1 million on Ethereum and Tron combined. Taking advantage of this delay on Tron is not particularly uncommon, according to AMLBot:
“170 out of 3,480 wallets (4.88%) on the Tron blockchain exploited the delay prior to being blacklisted. Each of these wallets performed 2–3 transfers during the delay, averaging: $291,970.”
A Tether spokesperson stated that “the $76 million mentioned in this report should be contextualized with the more than $2.7 billion in USD₮ that Tether has successfully frozen and blocked thus far.”
Tether has previously highlighted its capability to freeze assets as a compliance feature. In 2024, Tether, Tron, and analytics firm TRM Labs worked together to freeze over $126 million in USDT tied to illicit activities.
Nonetheless, the AMLBot report raises concerns regarding the efficacy and promptness of those enforcement actions.
Magazine: Chinese Tether laundromat, Bhutan enjoys recent Bitcoin boost: Asia Express
Be the first to comment