Tether Freezes Five Ethereum Addresses Holding 24.35 Million USDT

Tether froze five Ethereum addresses holding a combined 24.35 million USDT at approximately 3 p.m. ET on Nov. 9, or about 20:00 UTC, according to on-chain records of the freeze action. The five wallets had been active in 2021 and 2023, and blockchain security firm SlowMist said one of them had interacted with wallet addresses it identified as tied to phishing and pig-butchering scams.

The action places roughly $24.35 million in dollar-pegged tokens beyond the reach of the addresses' controllers. For context, that figure approaches the annual budget of a mid-sized compliance department at a major exchange — a sum large enough that its immobilization materially affects whatever operation depended on it.

What does this change for practitioners?

Tether's freeze function operates at the token-contract level on Ethereum. Because USDT is a centrally administered asset on that chain, the issuer can blacklist an address without a court order or exchange intervention, rendering the balance unspendable. Recovery for victims, however, remains a separate process that typically requires law-enforcement engagement and issuer cooperation.

For compliance teams, the freeze confirms a working pattern practitioners already know: on-chain analysis by firms such as SlowMist frequently precedes issuer action. The flagged address had prior exposure to wallets associated with two of the most damaging fraud categories targeting retail users — phishing and pig-butchering schemes.

The operational signal

Three details stand out:

• Scale. 24.35 million USDT across five addresses averages roughly $4.87 million per wallet, indicating consolidated holdings rather than dust-level accounts.
• Timing. The freeze landed around 20:00 UTC on Nov. 9, a window consistent with active monitoring rather than routine batch processing.
• History. The addresses were active in 2021 and 2023, meaning the funds had sat or circulated for years before the action — a reminder that exposure attributed through chain analysis can surface long after the underlying transactions.

Why the linkage matters

SlowMist's attribution is analytical, not judicial. The firm identified interactions between one frozen address and wallets it associates with phishing and pig-butchering operations. That standard of proof governs private-sector blacklisting decisions, not criminal liability, and the source material does not state whether law enforcement requested or joined the action.

Still, the mechanism matters for anyone tracing stolen funds. A USDT blacklist on Ethereum seizes liquidity at the contract layer — no private key compromise required, no chain reorganization possible, and no reliance on the cooperation of whoever controls the wallet.

What comes next

The frozen balance now sits in a holding pattern. Historically, such funds move only after a verified-claims process, a law-enforcement request, or a court directive reaches the issuer. Practitioners tracking these five addresses should watch for a subsequent transfer from blacklisted balances to a Tether-controlled recovery wallet — the clearest on-chain signal that a restitution or forfeiture process has begun.