"A TRON address beat @Tether's freeze by 6 minutes," the security firm BlockSec posted on July 7. "It emptied 3.125M $USDT out the door while the freeze was still pending."
The on-chain record backs it up. At 13:53:30 and 13:54:54 UTC on Sunday, July 5, a Tron wallet sent 100 tether and then 3,124,866 tether into an address that had never held $USDT before that minute. At 14:00:36 UTC, five minutes and 42 seconds later, Tether blacklisted the wallet it had just left. The money kept walking, through fresh hops at 14:24 and 14:43, then splits of $300,000 and $400,000 through the evening.
"Timeline on TRON (Jul 5)," BlockSec's post continued. "13:17 Tether submits the freeze proposal. 13:53 and 13:54 address sends out 3.125M $USDT in two transactions. 14:00 Tether executes the freeze. The proposal was public for 42 minutes."
Tether can freeze and then destroy any dollar it issues, a power it has used to lock up more than $4.4 billion alongside 340 law enforcement agencies. It is the closest thing to a kill switch on the rails that now carry gambling, sanctions evasion and every other kind of grey commerce. But the trigger is not pulled in secret. A freeze is a transaction submitted to a multi-signature contract, and the submission is visible the instant it is made, sitting on the ledger while co-signers approve it.
"If we talk about, like, bot interceptors, who can literally see what exactly, which exactly wallet will be blocked," said Dmitry Machikhin, founder and chief executive of the on-chain analytics firm BitOK, "Tether should improve their algorithms."
'Both Sides Became Faster'
BitOK's roughly 30-page follow-up to research it published a year ago counts, over 24 months, 7,562 addresses blacklisted and $1.08 billion in $USDT destroyed. In the most recent 12 months, it says, $127.6 million left targeted addresses during the public window across 107 cases, the largest $37.3 million on Tron inside 5.7 minutes.
Tether has got faster. BitOK puts the drop in median time from submission to freeze at 44% on Ethereum and 23% on Tron, and found a same-block urgent mode used in about one case in six.
Escapes went up anyway. "Tether has become faster, but the system has not become structurally safer," reads BitOK's written summary of the findings. Machikhin put it more plainly in an interview: "In just one year, accelerated freezes. But interceptors, of course, they made huge infrastructure to escape. Both sides became faster."
The written version draws the sharper conclusion: “The problem is no longer the length of the window. The problem is that the window is public at all.”
'Closing The Barn Door'
Part of the spread between the firms is in how the money moves, Machikhin said. "It's not like one amount. Sometimes it's nothing like one amount of crypto. It's like it's divided, separated. You have like thousands of transactions that you need to discover and to track."
Three other firms have published the same measurement. BlockSec's July 26 analysis of 8,310 freeze proposals since 2017 found $215.5 million moved out during delay windows, at a median reaction time of 77 minutes. FlashRescue counted $55.9 million on August 6 across 2,955 freeze events. AMLBot got there first, in May 2025, with $78 million across 170 wallets; its chief executive Slava Demchuk said bots "can alert wallet owners the moment a freeze is initiated but before it's enforced."
ChainArgos published the harshest finding of any of them back in September 2024: on Tron, only 0.49% of the $USDT flowing into addresses that were eventually blacklisted was actually caught. It called backward-looking blacklisting "meaningfully ineffective in stopping, or trapping, illicit funds."
'A Trade-Off For Responsible Responsiveness'
Tether's position is that the delay is the price of not letting one compromised key freeze balances on a $184 billion asset. Asked about the AMLBot findings in 2025, a spokesperson said the multi-signature structure "introduces a short delay, but it's a trade-off for responsible responsiveness to a $100+ billion ecosystem," and rejected the word loophole.
Chief executive Paolo Ardoino is blunter about intent. "USD₮ is not a safe haven for illicit activity," he said in April, announcing a $344 million freeze on Tron. "When credible links to sanctioned entities or criminal networks are identified, we act immediately and decisively."
Machikhin does not dispute the volume. He disputes the triage. "Sometimes they are pressed by governments," he said. "Our findings show that sometimes Tether should have paid more attention to some really bad stuff." He grants the constraint too: "They do their minimum and they don't want to like break the market and make hundreds of blocks every day. But you need to find a balance."
A fix has been on the table since 2025, when PeckShield proposed bundling the request and its signatures into one transaction, collapsing the window to zero. "Tether has already shown that windowless execution is possible," BitOK's written findings say. "The remaining question is why it is still the exception rather than the default."
Tether has not answered him. "They hate this topic," he said. "It's not funny things for them. They don't love it and that's why they are not very responsive." Then: "And it affirms that we are right."
The Rule That Doesn't Exist
No law requires an answer either. The GENIUS Act obliges stablecoin issuers, foreign ones included, to run policies capable of blocking, freezing and rejecting transactions, and separately to hold the technological capability to comply with any lawful order. It sets no deadline for executing one, and the word confidential does not appear in the statute.
Washington is asking a different question anyway. In a June 4 letter, Senator Richard Blumenthal, ranking member of the Permanent Subcommittee on Investigations, asked Ardoino whether Tether had "ever failed or declined to blacklist a wallet address." Nobody is asking whether the freezes it does run arrive in time.
The stakes scale with the rails. Chainalysis attributes 84% of illicit crypto transaction volume to stablecoins, the endpoint of a shift the crime economy started making years ago, and stablecoins now settle more monthly volume than ACH. Tron alone holds about $89 billion of $USDT and carries the longer blacklist.
The freeze power is less a Tether question than a question about who owns programmable dollars. "They control too much. The world right now is it's two countries to control too much. Like small countries don't have their own systems," Xin Yan, chief executive of Sign, said on the On The Margin podcast, describing US and Chinese reach over rails built for everyone else.
Machikhin is blunt about the limits of his trade. "We are not catching anybody. We are just showing the path of money," he said. He expects the traffic to move rather than stop, onto Solana and Ethereum layer-2s where Tether is paying less attention. "For now it's kind of a safe haven for guys who want to be escaped from the big brother, from the eyes of Tether."