A Preliminary Study on Money Laundering and Terrorist Financing via Digital Stablecoins: On-chain Tracking of USDT Blacklists
TechFlow Selected TechFlow Selected
A Preliminary Study on Money Laundering and Terrorist Financing via Digital Stablecoins: On-chain Tracking of USDT Blacklists
Only with a timely, coordinated, and technologically mature AML/CFT framework can the legitimacy and security of the stablecoin ecosystem be truly ensured.
Navigating Web3 tides with focused insightsAuthor: BlockSec
0. Introduction
Stablecoins have grown rapidly in recent years. With their widespread adoption, regulators are increasingly emphasizing the need for mechanisms to freeze illicit funds. We observe that major stablecoins such as USDT and USDC already possess this capability technologically. In practice, multiple cases have demonstrated that these mechanisms indeed play a role in combating money laundering and other illegal financial activities.
Furthermore, our research indicates that stablecoins are not only used for money laundering but also frequently appear in terrorist financing operations. Therefore, this report analyzes the issue from two perspectives:
-
A systematic review of USDT blacklist address freezing actions;
-
An exploration of the connection between frozen funds and terrorist financing.
This report is based on publicly available on-chain data, which may contain inaccuracies or omissions. For suggestions or corrections, please contact us at: contact@blocksec.com.
1. Analysis of USDT Blacklisted Addresses
We identify and track Tether blacklisted addresses through monitoring on-chain events. The methodology has been verified against the Tether smart contract source code. The core logic is as follows:
-
Event Identification: The Tether contract maintains blacklist status via two events:
-
AddedBlackList: Adds a new blacklisted address -
RemovedBlackList: Removes a blacklisted address
-
-
Dataset Construction: For each blacklisted address, we record the following fields:
-
The address itself
-
Time when added to the blacklist (blacklisted_at)
-
If removed from the blacklist, the unblocking time (unblacklisted_at)
-
Below is the implementation of the relevant functions in the contract:
1.1 Key Findings
Based on Tether data from Ethereum and Tron blockchains, we observe the following trends:
Since January 1, 2016, a total of 5,188 addresses have been blacklisted, involving over $2.9 billion in frozen funds.
Between June 13 and June 30, 2025, 151 addresses were blacklisted, with 90.07% originating from the Tron chain (address list in appendix), resulting in a freeze of up to $86.34 million. The temporal distribution shows peaks on June 15, 20, and 25—with June 20 alone seeing 63 addresses blacklisted.
-
Frozen Amount Distribution: The top ten addresses account for $53.45 million in frozen assets, representing 61.91% of the total. The average freeze amount is $571,800, while the median is only $40,000, indicating that a few large holdings skew the average upward, while most frozen amounts are relatively small.
-
Lifetime Fund Flow Distribution: These addresses received a cumulative total of $808 million, of which $721 million was transferred out before being blacklisted, leaving only $86.34 million actually frozen. This suggests that most funds had already been successfully moved prior to regulatory intervention. Additionally, 17% of the addresses show no outgoing transactions, possibly serving as temporary storage or aggregation points—warranting further scrutiny.
-
Newly Created Addresses Are More Likely to Be Blacklisted: 41% of blacklisted addresses were created less than 30 days before being flagged; 27% existed for 91–365 days, and only 3% were active for more than two years, suggesting newer addresses are more commonly used for illicit activities.
-
Most Addresses Achieve "Pre-Freeze Escape": Approximately 54% of addresses transferred out more than 90% of their funds before being blacklisted, and another 10% had zero balances at the time of freezing, indicating enforcement actions often capture only residual balances.
-
Newer Addresses Exhibit Higher Money Laundering Efficiency: The scatter plot of FlowRatio vs. DaysActive reveals that newly created addresses perform exceptionally well in terms of volume, frequency of blacklisting, and transfer efficiency—indicating the highest success rate in laundering.
1.2 Fund Flow Tracking
Using BlockSec’s on-chain tracking tool MetaSleuth (https://metasleuth.io), we further analyzed the fund flows of the 151 USDT addresses blacklisted between June 13 and 30, identifying key sources and destinations.
1.2.1 Source Analysis
-
Internal Contamination (91 addresses): Funds originated from other previously blacklisted addresses, indicating a highly interconnected money laundering network.
-
Phishing Labels (37 addresses): Many upstream addresses are labeled “Fake Phishing” in MetaSleuth, likely deceptive tags used to obscure illicit origins.
-
Exchange Hot Wallets (34 addresses): Sources include hot wallets from Binance (20), OKX (7), and MEXC (7), potentially linked to compromised accounts or “mule” accounts.
-
Single Major Distributor (35 addresses): One blacklisted address repeatedly appears as an upstream source, possibly functioning as an aggregator or mixer for fund distribution.
-
Cross-Chain Bridge Entry Points (2 addresses): Some funds originate from cross-chain bridges, indicating cross-chain money laundering operations.
1.2.2 Destination Analysis
-
To Other Blacklisted Addresses (54): A structure of internal recycling chains exists among blacklisted addresses.
-
To Centralized Exchanges (41): These addresses sent funds to deposit addresses of CEXs like Binance (30) and Bybit (7), effectively cashing out.
-
To Cross-Chain Bridges (12): Indicates attempts to exit the Tron ecosystem and continue laundering across chains.
Notably, Binance and OKX appear on both ends—as sources (hot wallets) and destinations (deposit addresses)—highlighting their central role in the transaction flow. Current shortcomings in exchanges’ AML/CFT enforcement and delayed asset freezing may allow bad actors to complete transfers before regulatory intervention.
We recommend that major cryptocurrency exchanges, as critical financial gateways, strengthen real-time monitoring and risk interception mechanisms to prevent illicit activities proactively.
2. Terrorist Financing Analysis
To better understand the use of USDT in terrorist financing, we analyzed Administrative Seizure Orders issued by Israel's National Bureau for Counter-Terrorist Financing (NBCTF). While our reliance on a single data source limits comprehensive reconstruction, it serves as a representative sample for a conservative assessment and estimation of USDT-related terrorist transactions.
2.1 Key Findings
-
Timing of Issuance: Following the escalation of the Israel-Iran conflict after June 13, 2025, only one additional seizure order was issued (on June 26). The previous document dated back to June 8, revealing a lag in law enforcement response during periods of geopolitical tension.
-
Targeted Organizations: Since the outbreak of conflict on October 7, 2024, NBCTF has issued eight seizure orders—four explicitly mentioning “Hamas,” and the latest one marking the first reference to “Iran.”
-
Addresses and Assets Involved in Seizure Orders:
-
76 USDT (Tron) addresses
-
16 BTC addresses
-
2 Ethereum addresses
-
641 Binance accounts
-
8 OKX accounts
-
Our on-chain tracking of the 76 USDT (Tron) addresses revealed two behavioral patterns by Tether in responding to these official directives:
-
Proactive Freezing: Tether had already blacklisted 17 Hamas-related addresses prior to the issuance of the seizure orders, on average 28 days earlier, with the earliest occurring 45 days in advance.
-
Rapid Response: For the remaining addresses, Tether completed freezing within an average of just 2.1 days after the orders were published, demonstrating strong cooperation with law enforcement.
These findings suggest that Tether maintains close—and even preemptive—collaboration mechanisms with certain national law enforcement agencies.
3. Summary and Challenges Facing AML/CFT
Our research shows that although stablecoins like USDT offer technical means for transaction control, AML/CFT efforts still face the following challenges in practice:
3.1 Core Challenges
-
Lagging Enforcement vs. Proactive Prevention: Most current enforcement actions remain reactive, leaving room for criminals to move assets before detection.
-
Regulatory Blind Spots at Exchanges: As primary gateways for fund inflows and outflows, centralized exchanges often lack sufficient monitoring to promptly detect suspicious behavior.
-
Increasing Complexity of Cross-Chain Laundering: The use of multi-chain ecosystems and cross-chain bridges makes fund movements more opaque and significantly harder to trace.
3.2 Recommendations
We recommend that stablecoin issuers, exchanges, and regulators:
-
Enhance on-chain intelligence sharing;
-
Invest in real-time behavioral analytics technologies;
-
Establish cross-chain compliance frameworks.
Only under a timely, coordinated, and technologically mature AML/CFT system can the legitimacy and security of the stablecoin ecosystem be truly safeguarded.
4. BlockSec’s Initiatives
At BlockSec, we are committed to advancing security and compliance in the crypto industry, focusing on delivering practical, actionable on-chain solutions for AML and CFT. We have launched two key products:
4.1 Phalcon Compliance
Designed for exchanges, regulators, payment projects, and DEXs, it supports:
-
Multi-chain address risk scoring
-
Real-time transaction monitoring
-
Blacklist identification and alerts
Helping users meet increasingly stringent compliance requirements.
4.2 MetaSleuth
Our visual on-chain tracking platform, adopted by over 20 regulatory and law enforcement agencies worldwide, enables:
-
Visual fund tracing
-
Multi-chain address profiling
-
Reconstruction and analysis of complex transaction paths
Together, these tools embody our mission—to safeguard order and security in decentralized financial systems.
Some addresses referenced in this article:
https://docs.google.com/spreadsheets/d/1pz7SPTY2J4S7rGMiq6Dzi2Q5p0fXSGKzl9QF2PiV6Gw/edit?usp=sharing
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@BlockSecTeam
