Who Tether freezes on TRON, and who it doesn't

Originally published on freezecheck.org. Disclosure: FreezeCheck is our project.

We compared six groups of "dirty" TRON addresses with Tether's USDT blacklist as of November 8, 2026. Sanctioned addresses are frozen almost without exception. Addresses that steal from ordinary users mostly are not.

• 355 of 355 US, UK and EU sanctioned addresses frozen
• 52 Xinbi addresses frozen before the OFAC designation
• 0 of 17 address-poisoning factories frozen
• 0 of 369 approval drainers frozen (8,337 victim wallets)
• 2 of 642 addresses from criminal fraud verdicts frozen
• 1.25M USDT still sitting on unfrozen addresses

The table

Balances were read from TRON on November 8, 2026. For drainers the balance covers the drainer address, the wallets that call it and the wallets the stolen USDT went to.

Key findings

• Sanctions: complete and fast. Every one of the 355 TRON addresses on the US, UK and EU sanctions lists is frozen. For Xinbi Guarantee, 52 addresses were frozen a day or more before OFAC published the designation, some of them 166 days before. The UK-sanctioned Byex exchange was frozen 3 days after designation; about 2.46M USDT left the address in those 3 days.
• Court cases: partial. 70% of addresses named in US civil forfeiture complaints are frozen. Unfrozen ones still hold 306k USDT. A complaint can list addresses that were never charged, so an unfrozen address here is not proof of crime.
• Convicted fraud: almost untouched. An open dataset of criminal court rulings lists 642 TRON addresses of fraud platforms and fake brokers. Tether has frozen 2 of them. The rest hold 139,744 USDT today.
• Poisoning factories: none frozen. We found 17 wallets that create look-alike addresses in bulk to trick people into copying the wrong address. The largest, TWkvff…98cdn, activated 43,661 fakes over the year and holds 620,229 USDT. Together the 17 hold 723,813 USDT. None is frozen.
• Drainers: none frozen. 369 wallets and contracts collected unlimited USDT approvals from victims and pulled the funds out, 8,337 victim wallets in total. None is on the blacklist.

Still active

We read every USDT transfer to and from these addresses over the last 90 days (August 10 – November 8, 2026). 15 of the 17 poisoning factories are still working: 2.88M USDT came in and 2.55M went out. 145 of the 369 drainers (with their operator wallets) received USDT in the same 90 days.

Why it matters

• Freezing follows requests, not harm. Tether has said publicly (October 2022) that it freezes USDT when there are legitimate law-enforcement requests. Sanctions come with a legal order, so the list catches them at once. Thieves who hit thousands of small users rarely become a law-enforcement case, so they stay off the list.
• For users. "Not frozen by Tether" does not mean clean. A wallet can be a working drainer or a poisoning factory and still move USDT freely.
• For exchanges and AML tools. Screening only against the Tether blacklist and sanctions lists misses the theft infrastructure that ordinary users meet most often.

Method

• Blacklist. All 8,206 TRON addresses Tether had frozen by November 8, 2026, with the freeze date, from AddedBlackList events of the USDT contract.
• Sanctions. OFAC SDN, UK and EU sanctions lists (TRON addresses), deduplicated. Israel: the official NBCTF seizure list.
• Forfeiture complaints. TRON addresses quoted in US civil forfeiture complaints found through CourtListener RECAP.
• Fraud verdicts. Open dataset of criminal court rulings with crypto addresses (Mendeley Data, doi:10.17632/62dmsngtfb.1, CC BY 4.0). These are rulings of courts in Taiwan; roles "fraud platform" and "fake broker".
• Poisoning factories. A wallet that activated at least 3 look-alike addresses (see the poisoning map).
• Drainers. An address that received unlimited USDT approvals from at least 5 wallets and called transferFrom on them. We count only strict cases with at most 2 pulls per victim on average; addresses that pull from the same wallets dozens of times look like payment services with auto-debit and are excluded.

What to keep in mind

• Factories and drainers are identified by our own on-chain rules, not by a court or by Tether. The CSV lists every address so anyone can check it on Tronscan.
• Court and complaint addresses come from documents; some may belong to victims or intermediaries.
• Freezing is Tether's discretion. We do not claim any specific address should have been frozen, only show which groups are and are not on the list.

Data

CC BY 4.0: categories CSV, 1,778 unfrozen addresses with balances and 90-day flows. Questions: [email protected]. To check a single address before a deal: @freezecheck_bot.