1 USDT ≠ 1 USDT
TechFlow Selected TechFlow Selected
1 USDT ≠ 1 USDT
When ordinary investors or Web3 business addresses inadvertently receive stablecoins linked to illegal activities, they may face enforcement risks.
Navigating Web3 tides with focused insightsAuthor: Bitrace
Stablecoins are one of the key infrastructures in our industry, maintaining price stability by pegging to fiat currencies of real-world nations. Ordinary users rely on them for value storage and payments, while Web3 institutions use them as operational tools. This diverse demand has fostered a thriving stablecoin market. However, they are also exploited by cybercriminals, online gambling operations, money laundering, and other illicit activities. When regular investors or Web3 enterprise addresses inadvertently receive stablecoins linked to illegal activities, they may face enforcement risks.
Bitrace's research reveals that, in order to quickly liquidate assets or disrupt investigations during the laundering process of high-risk crypto funds, criminals often accept significant deviations from the market exchange rates when transacting stablecoins of varying risk levels. Take Tether (USDT), the most widely used stablecoin, as an example.
Sources of Black USDT Risk
"Reverse freezing" is a term commonly used among cryptocurrency exchange operators. It refers to situations where an exchange address receiving tainted USDT leads law enforcement agencies to freeze the entire exchange account. Unlike traditional cases where bank accounts are frozen due to receiving illicit funds, this type of enforcement action targeting traceable crypto assets is known as reverse freezing.
Such enforcement actions are not limited to centralized cryptocurrency exchanges. On decentralized blockchain addresses, Tether—the issuer of USDT—can legally assist global law enforcement agencies in sanctioning specific addresses involved in criminal cases. This is done by selectively "blacklisting" certain addresses, thereby restricting their ability to transact USDT, effectively freezing the funds in those addresses.
A few days ago, the cryptocurrency exchange OKX announced that it had collaborated with Tether to complete targeted freezes on multiple blockchain addresses containing a total of 225 million USDT. These funds were allegedly linked to illegal activities such as pig-butchering scams and human trafficking.
Bitrace conducted fund audits on some of the disclosed addresses. In analyzing the sources of these funds, we found that the criminal group did not only exploit OKX for fund circulation; major exchanges like FTX and Binance were also utilized, involving substantial amounts of capital.
Subsequent fund tracking further revealed that more centralized exchanges, payment platforms, and even online gambling platforms have been drawn into these schemes, unfortunately becoming venues for money laundering by criminals.
Clearly, even without OKX’s cooperation, these Web3 businesses might still comply with law enforcement requests to sanction hoarding addresses tied to criminal proceeds, simply to maintain regulatory compliance. In other words, whether fiat currency or compliant stablecoins, neither serves as a “safe” store of value for criminal groups. They typically need to rapidly launder seized assets to eliminate risks or convert them into cash promptly.
We believe this urgent need for risk mitigation through rapid laundering is the primary reason behind large-scale off-market-rate illegal transactions.
Overpriced USDT Scenarios
"Money muling" is a euphemism used by criminals for money laundering operations. The goal is to transfer payments from high-risk users to low-risk user accounts to bypass risk controls imposed by payment institutions. Traditional money muling involves transferring, splitting, and cashing out illicit funds using personal bank, WeChat, or Alipay accounts. In recent years, cryptocurrencies—especially stablecoins—have become new tools for such activities.
The typical model works as follows: money muling platforms recruit individuals to register accounts on cryptocurrency exchanges and link their bank cards. These participants take orders via the platform to purchase specific amounts of USDT at market prices through the exchange’s OTC market, then resell the USDT back to the platform at higher prices. The difference becomes their income. In reality, the funds used by the platform to buy back USDT originate from illicit sources, allowing the platform to launder money without directly handling fiat currency.
The profit margins for money muling platforms come from upstream task assignments, including online gambling, black-market operations, and money laundering. Different types of illicit funds carry different commission rates. For instance, gambling-related funds are considered lower risk and thus attract lower commissions, whereas fraud proceeds are seen as high risk and command higher fees—some platforms even refuse such funds altogether.
These differing commission rates are directly reflected in USDT transaction exchange rates. Higher-risk funds lead to greater price markups. In actual case investigations, it is common to encounter illegal USDT trades priced at RMB 8 or even over RMB 10.
Underpriced USDT Scenarios
So far, most discounted USDT transactions advertised under pretexts like “black-USDT arbitrage” or “buying U with black/white funds” are fraudulent. Bitrace previously covered scams such as black-USDT pig-butchering schemes and offline cash robbery incidents—refer to earlier posts for details.
However, there remain numerous scenarios involving below-market-rate gray-market USDT trades—for example, illegal third-party payment platforms. Some payment platforms accept USDT top-ups and use fiat funds to make payments on behalf of users across various services, including depositing funds on gambling sites, settling investments for Ponzi schemes, sending virtual gifts on live-streaming platforms, generating fake e-commerce orders, or even paying employee salaries.
These platforms do not verify the source of users’ USDT nor implement robust KYC procedures, resulting in an influx of high-risk funds. This explains why, in certain cases, both transaction fees and destinations of illicit funds on-chain appear linked to online gambling platforms. By leveraging this nearly anonymous method of monetization, gray-market operators avoid registering on regulated centralized crypto exchanges, significantly reducing the likelihood of facing “reverse freezing.”
Case investigations show that USDT used in such illegal third-party payment activities typically trades at a discount of RMB 0.05 to RMB 0.3 compared to market rates, depending on the platform’s fiat funding sources and the scale of user deposits.
Beware of USDT Money Laundering Risks
Bitrace audited USDT inflows to certain Tron network addresses flagged as having money laundering risks and holding over 1 million USDT in volume. The audit period spanned from September 2021 to March 2023.
Data shows that between September 2021 and March 2023, over 64.25 billion USDT flowed into high-risk addresses on the Tron network. Notably, this volume remained unaffected by the bear market in the broader crypto sector, indicating that the participants are not genuine investors.
Combined with the two risk scenarios described above, this indicates that stablecoin-based cryptocurrencies are being maliciously exploited by money laundering networks. To evade sanctions from centralized exchanges and law enforcement, criminals mix funds through illicit entity-controlled crypto addresses or disrupt forensic tracing via over-the-counter trades. Significantly deviated market exchange rates in USDT transactions are a hallmark of such activities.
For more detailed insights, please refer to Bitrace’s earlier report titled *Investigation into the Use of Cryptocurrencies in Cybercrime and Illegal Activities*.
Final Thoughts
According to The Block, Tether’s parent company has released a letter addressed to the U.S. Senate Committee on Banking, Housing, and Urban Affairs and the House Committee on Financial Services, outlining its “commitment to security and close collaboration with law enforcement.” The company also announced plans to integrate the U.S. Secret Service and the FBI—agencies already engaged in similar cooperation—into its platform.
This clearly demonstrates Tether’s willingness to comply within the stablecoin business domain. For Web3 enterprises serving large numbers of retail customers, enhancing anti-money laundering risk controls for suspicious cryptocurrencies and establishing compliance departments capable of cooperating with government law enforcement agencies worldwide has become an imperative priority.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
