How USDT laundered – BlockSec’s breakdown reveals frozen funds, blind CEX entry points, and delayed AML enforcement. According to their investigation, 41% of all blacklisted addresses were less than 30 days old, indicating a preference for newly created accounts to obfuscate assets. A total of 151 addresses were blacklisted by Tether over 18 days, with 90% on the Tron network. The 91 addresses received funds from previously blacklisted wallets, revealing an internal laundering loop. The 35 addresses acted as central fund aggregators in the laundering chains.
Want your trades to actually mean something this month? Join the WWFC challenge and trade your way into the top. We’ve already got the team set up — all you need to do is register, trade and go for a piece of the $900K prize pool.
BlockSec on Laundering Loops, Exchange Blind Spots, and Tether’s Collaboration with Regulators
A fairly comprehensive report demonstrates how cryptocurrency can serve as a double-edged sword. More specifically, the analysis of blacklisted USDT addresses revealed persistent laundering loops, blind spots on centralized exchanges, and also highlighted Tether’s active collaboration with law enforcement.
The primary focus of the investigation was 151 addresses blacklisted by Tether between June 13 and June 30, 2025. Of those, 90.07% were on the Tron network, which may play a significant role in laundering infrastructure due to its speed and low fees. The total amount of frozen assets during that period reached $86.34 million, with blocking activity peaking on certain days. For example, on June 20, Tether froze 63 addresses in a single day.
The distribution of funds was not proportional. The 10 largest addresses held $53.45 million in total, which accounted for 61.91% of the total amount frozen. The average balance at the time of blacklisting was $571.76K, while the median was significantly lower – $40.01K. This indicates a skewed distribution: the majority of addresses held only small amounts, while a few key nodes concentrated most of the flows.
NBCTF Orders: Preemptive Blacklisting and Tether’s Response Timeline
Particular attention was given to a subset of 76 USDT-Tron addresses listed in the orders of Israel’s National Bureau for Counter Terror Financing (NBCTF). In 17 cases, Tether blacklisted the addresses before the official publication of the orders. These preemptive blocks occurred on average 28 days before publication, and in one instance, 45 days prior. This time lag may indicate the existence of a direct information-sharing channel between the stablecoin issuer and enforcement authorities. For the remaining addresses, blacklisting occurred after publication, with an average delay of 2.1 days. According to BlockSec, it suggests both reactive mechanisms and Tether’s readiness to act swiftly on external requests.
The NBCTF orders cover assets linked to the Israeli-Palestinian and Iranian conflicts. Of the eight orders issued since October 2024, four explicitly identify Hamas as a recipient, and one names Iran. In addition to Tron-based addresses, the orders also listed 16 BTC addresses, two Ethereum addresses, and associated accounts – 641 on Binance and eight on OKX.
A broader MetaSleuth analysis showed that 91 of the 151 addresses received funds from other already blacklisted addresses, forming a self-contained laundering network. This level of linkage indicates the presence of internal laundering loops. Within these flows, 35 addresses played a key role, appearing repeatedly as upstream sources. These nodes likely acted as aggregators or mixers, redistributing funds to other network segments.
A distinct category consisted of 34 addresses tied to exchange hot wallets. This group was dominated by Binance (20), OKX (7), and MEXC (7), suggesting the use of either compromised accounts or mule wallet schemes. Notably, these addresses served as both inflow sources and off-ramp routes, confirming the dual role of centralized platforms in laundering operations.
Want your trades to actually mean something this month? Join the WWFC challenge and trade your way into the top. We’ve already got the team set up — all you need to do is register, trade and go for a piece of the $900K prize pool.
Tracing the Flows: Where the Funds Went
BlockSec also provided a detailed breakdown of outflows from the blacklisted addresses. In 54 cases, funds were sent to other addresses already on the blacklist, further reinforcing the argument for persistent laundering loops. In 41 cases, assets were deposited into centralized exchange addresses. The remaining 12 flows were routed through cross-chain bridges, indicating deliberate use of interchain obfuscation to bypass monitoring and regulatory restrictions.
AML Enforcement Challenges: Reacting Too Late
BlockSec emphasizes that in 54% of the cases, addresses had already withdrawn ≥90% of their funds before being frozen. Additionally, 10% of the addresses had zero balance at the time of blacklisting. This reflects the retrospective nature of current AML/CFT architecture, where enforcement often captures empty wallets but fails to intercept the movement of funds itself. Learn our detailed guide on the crucial role of KYC and AML in Crypto: Learn How Safety is Realized in Web3?
The analysis also found that 41% of the addresses were created less than 30 days before being blacklisted. Only 3% had a long operational history (≥730 days), while 27% were in the medium range (91–365 days). As the data shows, newer addresses are used more frequently for rapid laundering operations and are less likely to be monitored.
Conclusion
Despite the availability of mechanisms like address freezing, the current effectiveness of AML/CFT systems remains limited. The core weaknesses include delayed reaction to transactions, insufficient coordination between CEXs and enforcement agencies, and the increasing complexity of cross-chain laundering schemes. As a result, even large-scale freezes like the $86.34 million case reflect only residual amounts, while the bulk of the assets is typically moved beforehand.
To address such vulnerabilities, at minimum, a coordinated institutional effort is needed, encompassing real-time monitoring, advanced behavioral analytics, and collaborative compliance protocols between issuers, exchanges, and regulators.
