The Application of Stablecoins in Money Laundering and Terrorism Financing: An Analysis of USDT Blacklisted Addresses

Introduction

In recent years, the development momentum of stablecoins has been rapid, and their widespread application has drawn the attention of regulatory agencies to establish mechanisms for freezing illegal funds. Mainstream stablecoins such as USDT and USDC have the technical capability for this, and practice has also proven the effectiveness of these mechanisms in combating illegal financial activities.

Research shows that stablecoins are not only used for Money Laundering but also frequently appear in the financing activities of terrorist organizations. This article will analyze from two perspectives:

1. The system reviews the freezing actions of USDT blacklisted addresses;

2. Discuss the connection between frozen funds and terrorist financing.

1. Analysis of USDT Blacklist Addresses

Through on-chain event monitoring, we have identified and tracked USDT blacklisted addresses. The analysis method has been verified through the smart contract source code, and the core logic is as follows:

• Event Identification:

  • Add blacklisted Address
  • Remove blacklisted Address

• Dataset Construction:

  • Address
  • Blacklist Time
  • Blacklist Removal Time (if applicable)

1.1 Core Findings

Based on USDT data on the Ethereum and Tron chains, we found:

Since January 1, 2016, a total of 5,188 addresses have been blacklisted, involving frozen funds of over 2.9 billion USD.

During the period from June 13 to June 30, 2025, 151 addresses were blacklisted, of which 90.07% came from the Tron chain, with a frozen amount reaching USD 86.34 million. June 15, 20, and 25 were peak days for blacklisting, with 63 addresses blacklisted on June 20 alone.

• Frozen amount distribution: The top ten addresses have frozen a total of 53.45 million USD, accounting for 61.91% of the total. The average frozen amount is 571,800 USD, with a median of only 40,000 USD, indicating that a small number of large addresses have inflated the overall average.

• Lifecycle fund distribution: These addresses have cumulatively received $808 million, with $721 million transferred out before being blacklisted, leaving only $86.34 million actually frozen. 17% of the addresses have no outgoing transaction records, possibly serving as temporary storage or fund aggregation points.

• New addresses are more likely to be blacklisted: 41% of blacklisted addresses were created less than 30 days ago, 27% have existed for 91-365 days, and only 3% have been in use for over 2 years.

• Most addresses realize "escape before freezing": about 54% of addresses have transferred out over 90% of their funds before being blacklisted, and 10% have a balance of 0 at the time of freezing.

• New Address Money Laundering Efficiency is Higher: The new address performs outstandingly in terms of quantity, blacklisting frequency, and transfer efficiency, with the highest money laundering success rate.

1.2 Fund Flow Tracking

We analyzed the fund flows of 151 USDT addresses that were blacklisted between June 13 and 30, identifying the main sources and destinations of the funds.

1.2.1 Source of Funds Analysis

• Internal contamination (91 Addresses): Funds come from other blacklisted Addresses, indicating a highly interconnected Money Laundering network.

• Phishing Tags (37 Addresses): Many upstream addresses are labeled as "Fake Phishing", which may be deceptive labels to obscure illegal sources.

• Exchange Hot Wallets (34 Addresses): The source of funds includes hot wallets from certain well-known exchanges, which may be related to stolen accounts or "mule accounts".

• Single main distributor (35 addresses): The same blacklisted address is used multiple times as an upstream, possibly functioning as an aggregator or mixer for fund distribution.

• Cross-chain bridge entry (2 addresses): part of the funds comes from the cross-chain bridge, indicating the existence of cross-chain Money Laundering operations.

1.2.2 Fund Flow Analysis

• Flowing to other blacklisted addresses (54): There is an "internal circulation chain" structure among the blacklisted addresses.

• Flowing to centralized exchanges (41): These addresses transfer funds to the deposit addresses of certain well-known exchanges for "getting off the car".

• Flowing to cross-chain bridges (12): Indicating that some funds are attempting to escape the Tron ecosystem, continuing cross-chain Money Laundering.

It is worth noting that certain exchanges appear on both ends of capital inflows (hot wallets) and outflows (deposit addresses), highlighting their core position in the capital chain. The current exchanges' insufficient execution of AML/CFT and the lag in asset freezing may allow criminals to complete asset transfers before regulatory intervention.

It is recommended that major cryptocurrency exchanges, as the core channels of funds, should strengthen real-time monitoring and risk interception mechanisms to prevent potential issues.

2. Terrorism Financing Analysis

We analyzed the administrative seizure order issued by the National Bureau for Counterterrorism Financing of Israel (NBCTF) to evaluate the conservative analysis and estimates of USDT-related terrorist transactions.

2.1 Core Findings

• Release Time: Since the escalation of the Israel-Iran conflict on June 13, 2025, only 1 new seizure order has been added (June 26). The previous document was dated June 8, indicating a lag in law enforcement response.

• Target organization: Since the outbreak of conflict on October 7, 2024, the NBCTF has issued a total of 8 seizure orders, 4 of which specifically mention "Hamas", and the latest one mentions "Iran" for the first time.

• The addresses and assets involved in the seizure order:

  • 76 USDT (Tron) Address
  • 16 BTC Addresses
  • 2 Ethereum Addresses
  • 641 accounts on a certain exchange
  • 8 accounts on a certain exchange

On-chain tracking of the address (Tron for 76 USDT ) reveals two behavioral patterns:

1. Proactive freezing: 17 addresses related to Hamas were blacklisted before the seizure order was issued, averaging 28 days in advance, with the earliest being 45 days in advance.

2. Quick response: The remaining addresses were frozen within an average of 2.1 days after the seizure order was issued, demonstrating good law enforcement cooperation.

These signs indicate that there may be close, even proactive, cooperative mechanisms between stablecoin issuers and some national law enforcement agencies.

3. Summary and the Challenges Faced by AML/CFT

Research shows that while stablecoins provide technical means for transaction controllability, there are still the following challenges in AML/CFT practices:

3.1 Core Challenges

• Reactive Law Enforcement vs Proactive Prevention: Currently, most law enforcement actions still rely on post-event handling, leaving space for criminals to transfer assets.

• Regulatory Blind Spots of Exchanges: As the hub for deposits and withdrawals, centralized exchanges often have insufficient monitoring, making it difficult to timely identify abnormal behaviors.

• Cross-chain money laundering is becoming increasingly complex: the use of multi-chain ecosystems and cross-chain bridges makes the transfer of funds more concealed, greatly increasing the difficulty of regulatory tracking.

3.2 Suggestion

It is recommended for stablecoin issuers, exchanges, and regulatory agencies:

• Strengthen on-chain intelligence sharing;
• Investment Real-time Behavior Analysis Technology;
• Establish a cross-chain compliance framework.

Only under a timely, collaborative, and technologically mature AML/CFT system can the legitimacy and security of the stablecoin ecosystem be truly guaranteed.

4. Industry Efforts

Some professional institutions are committed to promoting the security and compliance of the cryptocurrency industry, focusing on providing feasible and actionable on-chain solutions for AML and CFT. The main products include:

4.1 Compliance Solutions

Designed for exchanges, regulatory agencies, payment projects, and DEX, supports:

• Multi-chain Address Risk Score
• Real-time Trading Monitoring
• Blacklist Identification and Alert

Help users meet increasingly stringent compliance requirements.

4.2 On-chain Tracking Platform

A visual on-chain tracking platform that has been adopted by regulatory and law enforcement agencies worldwide. Supports:

• Visual Fund Tracking
• Multi-Chain Address Portrait
• Complex Path Restoration and Analysis

These tools collectively embody the industry's efforts to safeguard the order and security of decentralized financial systems.