Tron USDT Freeze Delays Let 219 Addresses Move 65.4M Tokens

Wallet-risk analytics project FreezeCheck found that 219 addresses targeted by Tether freeze proposals on Tron moved a combined 65.4 million USDT in the interval between a public proposal and its execution. The finding, drawn from an analysis of 4,199 addresses frozen between November 4, 2025 and November 7, 2026, exposes a structural gap in the largest stablecoin issuer's enforcement mechanism on its highest-throughput chain.

The mechanics are simple and, for practitioners, consequential. Tether's USDT contract on Tron is controlled by a multisignature wallet requiring approval from two of three owners. One owner submits a proposal containing the contract address and the instruction addBlackList(address); a second owner confirms and executes the freeze. Because the proposal transaction is public, the target address is visible on-chain before any restriction takes effect.

How long do freezes actually take?

FreezeCheck measured a median delay of 9.7 minutes between proposal and execution across its 4,199-address sample. Roughly 30% of addresses — 1,257 in total — waited more than an hour before outgoing transfers were blocked.

For investigators and victims trying to preserve funds, the study separates two steps that are often conflated: identifying an address for a freeze, and actually blocking its ability to send. The public proposal accomplishes the first while leaving the second pending.

What does the delay window change for enforcement?

The transfer data suggests the gap is not merely theoretical. Among 3,476 addresses still frozen as of November 8, 2026 — after excluding 723 that had been unfrozen — the 219 addresses that moved funds during their proposal-to-execution windows sent 65.4 million USDT. Over equally long periods immediately before those proposals, the same cohort sent 27.9 million USDT. The project controlled for duration on a per-address basis rather than comparing unequal time stretches.

That puts transfers during the freeze windows at roughly 2.3 times the volume of the preceding baseline periods — a differential difficult to attribute to ordinary transaction rhythm alone.

The largest single transfer cited was approximately 15.2 million USDT on September 20, 2026. On-chain timestamps place it about five minutes after the freeze proposal was submitted and 64 minutes before execution. The target address in the proposal matched the address later recorded in the USDT contract's blacklist event, and a common multisignature transaction identifier links both steps. In total, FreezeCheck examined 1.42 million transfers, sourcing contract events from TronGrid and transfer records from SQD Portal, and published addresses, timestamps and transaction hashes in a CSV with an archive on Zenodo.

Frozen addresses can still receive funds

A completed freeze blocks outgoing transfers but does not stop incoming payments. FreezeCheck recorded 104.2 million USDT sent by 1,945 senders to 982 addresses that were already frozen — 3,033 transfers of at least 1 USDT, of which 280 occurred within an hour after the recipient's freeze took effect.

For exchanges and payout services, the operational takeaway is direct: check a recipient's blacklist status immediately before payout. That check addresses a distinct stage from monitoring pending proposals, since a frozen recipient cannot move an incoming payment onward but can still absorb it.

FreezeCheck operates a wallet-checking bot and, according to its project disclosure, plans to offer paid wallet checks and volume plans. The study's published dataset gives compliance teams a measurable baseline for how quickly blacklist proposals leak information to watch parties — and how much value can exit through that window before a second signature arrives.