The Application of Stablecoins in Money Laundering and Terrorist Financing: Analysis of USDT Blacklisted Addresses

In recent years, the use of stablecoins has been continuously expanding, while regulatory agencies are also paying more and more attention to establishing mechanisms for freezing illegal funds. Mainstream stablecoins such as USDT and USDC have this technical capability and have played a role in combating money laundering and other illegal financial activities.

This article will analyze from two aspects:

1. Systematic review of the freezing actions of USDT blacklisted addresses;
2. Explore the link between frozen funds and terrorist financing.

1. Analysis of USDT Blacklist Addresses

We identify and track certain stablecoin blacklist addresses through on-chain event monitoring. The analysis method has been validated through smart contract source code. The core logic is as follows:

• Event Identification: Maintain blacklist status through two events
• Dataset Construction: Record relevant information for each blacklisted Address.

1.1 Core Findings

Based on the data on the Ethereum and TRON chains, we found:

Since January 1, 2016, a total of 5,188 addresses have been blacklisted, involving frozen funds of over 2.9 billion USD.

From June 13 to June 30, 2025, 151 addresses were blacklisted, with 90.07% coming from the TRON chain, and the frozen amount reached 86.34 million USD. June 15, 20, and 25 were peak days for blacklisting, with June 20 seeing a single-day record of 63 addresses blacklisted.

• Frozen Amount Distribution: The top ten addresses have frozen a total of 5.345 million USD, accounting for 61.91% of the total. The average frozen amount is 571,800 USD, with a median of 40,000 USD.
• Lifecycle fund distribution: These addresses have cumulatively received $808 million, with $721 million transferred out before being blacklisted, and only $86.34 million actually frozen.
• Newly created addresses are more likely to be blacklisted: 41% of blacklisted addresses were created less than 30 days ago.
• Most addresses achieve "escape before freeze": about 54% of addresses had transferred out over 90% of their funds before being blacklisted.
• New Address Money Laundering Efficiency is Higher: The new address performs outstandingly in terms of quantity, blacklisting frequency, and transfer efficiency.

1.2 Fund Flow Tracking

We analyzed the flow of funds from 151 USDT addresses that were blacklisted between June 13 and 30, identifying the main sources and destinations of the funds.

1.2.1 Source of Funds Analysis

• Internal Pollution (91 Addresses): Funds come from other blacklisted addresses.
• Phishing Tags (37 Addresses): Upstream Address marked as "Fake Phishing".
• Exchange hot wallets (34 addresses): The source of funds includes hot wallets from certain well-known exchanges.
• Single main distributor (35 addresses): The same blacklisted address serves as the upstream multiple times.
• Cross-chain bridge entrance (2 addresses): The funds partly come from the cross-chain bridge.

1.2.2 Fund Flow Analysis

• Flowing to other blacklisted addresses (54): There is an "internal loop chain" structure.
• Flowing to centralized exchanges (41): Funds transferred to the deposit addresses of certain well-known exchanges.
• Flowing to cross-chain bridges (12): Some funds are attempting to escape the TRON ecosystem.

It is noteworthy that certain exchanges appear on both the inflow and outflow sides, highlighting their core position in the capital chain. It is recommended that major cryptocurrency trading platforms strengthen real-time monitoring and risk interception mechanisms.

2. Terrorism Financing Analysis

We analyzed the administrative seizure order issued by the counter-terrorism financing bureau of a certain country to assess the situation of USDT-related terrorist transactions.

2.1 Core Findings

• Release Timing: Enforcement responses are delayed during periods of geopolitical tension.
• Target Organization: Some seizure orders specifically mention certain organizations.
• The addresses and assets involved in the seizure order: including 76 USDT (Tron) addresses, 16 BTC addresses, 2 Ethereum addresses, 641 accounts from a certain exchange, and 8 accounts from another exchange.

On-chain tracking of the 76 USDT ( Tron ) Address reveals two behavioral patterns:

1. Proactive freezing: 17 addresses were blacklisted 28 days on average before the seizure order was issued.
2. Quick Response: The remaining addresses are frozen within an average of 2.1 days after the seizure order is announced.

This indicates that there may be a close cooperation mechanism between stablecoin issuers and law enforcement agencies in some countries.

3. Summary and Challenges Facing AML/CFT

Although stablecoins provide technical means for transaction controllability, AML/CFT still faces the following challenges in practice:

3.1 Core Challenges

• Reactive Law Enforcement vs Proactive Prevention: Most law enforcement actions still rely on post-event handling.
• Regulatory blind spots of exchanges: Centralized exchanges often lack adequate monitoring.
• Cross-chain Money Laundering is becoming increasingly complex: the multi-chain ecosystem increases the difficulty of regulatory tracking.

3.2 Suggestion

Suggestions for stablecoin issuers, exchanges, and regulatory authorities:

• Strengthen on-chain intelligence sharing;
• Investment real-time behavior analysis technology;
• Establish a cross-chain compliance framework.

Only by establishing a timely, collaborative, and technologically mature AML/CFT system can we truly ensure the legitimacy and security of the stablecoin ecosystem.