Source: Cointelegraph
Original: (The report states that Tether's USDT blacklist execution delay led to $78 million in suspicious funds evading freezing)
According to a new report from blockchain compliance company AMLBot, the delays in Tether's wallet blacklist processing allowed over $78 million in illicit funds to be moved before the enforcement actions took effect.
In a report dated May 15, 2025, AMLBot's on-chain investigation team explained that the blacklist processing for Tether's addresses, once initiated on Ethereum and Tron networks, takes quite a long time to take effect.
The report states: “This delay stems from Tether's multi-signature contract setup on Tron and Ethereum, turning what should be an immediate compliance action into an opportunity window for illicit actors.”
Tether's blacklist program is a multi-step process, where the first transaction is effectively a warning of the impending blacklist. First, a multi-signature transaction from Tether administrators submits a pending 'addBlackList' call on the USDT-TRC20 contract.
This results in the target address being publicly 'submitted' as a blacklist candidate. Subsequently, a second multi-signature transaction confirms the submission, ultimately triggering the 'AddedBlackList' event, making the blacklist effective.
In an example shared with Cointelegraph, an on-chain transaction submitted a Tron address as a blacklist candidate at 11:10:12 AM UTC. However, the second transaction that actually executed this action occurred at 11:54:51 AM UTC on the same day, resulting in a 44-minute delay.
In practice, this delay may be perceived by USDt holders about to be blacklisted as a notification, prompting them to transfer assets to avoid being frozen. The report states:
“The delay between freezing requests and their on-chain execution creates a critical attack window, allowing malicious actors to preemptively execute, transfer, or launder funds before the freeze takes effect.”
The report claims: “For blockchain-savvy attackers, these delays are golden opportunities.” By tracking Tether's calls in real-time, scammers can immediately learn that their address is being targeted. When Cointelegraph inquired whether this delay is a technical limitation or an action delay from multi-signature wallet key holders, AMLBot researchers stated that without knowledge of Tether's internal procedures, they could not determine the cause.
As of the time of publication, Tether has not responded to Cointelegraph's request for comment.
AMLBot claims that its data shows over $28.5 million in USDT was withdrawn during the delay period between two transactions on the Ethereum blockchain. This amount evading freeze occurred between November 28, 2017, and May 12, 2025. The average amount transferred during the delay was over $365,000.
Similarly, it was reported that during the freeze delay window on the Tron blockchain, $49.6 million was withdrawn, bringing the total amount on Ethereum and Tron to $78.1 million. According to AMLBot, it is not uncommon to exploit this delay on Tron:
“On the Tron blockchain, 170 out of 3480 wallets (4.88%) exploited this delay before being blacklisted. Each wallet made 2 to 3 transfers during the delay, with an average withdrawal amount of $291,970.”
Tether has previously promoted its asset freezing capability as a compliance feature. In 2024, Tether, Tron, and analytics firm TRM Labs collaborated to freeze over $126 million in USDT associated with illegal activities.
Nevertheless, AMLBot's report raises questions about the effectiveness and speed of these enforcement actions.
Related: After the addition of 1 billion in minting, the supply of USDT on Tron will exceed that of Ethereum.
