The Application of Stablecoins in Money Laundering and Terrorist Financing: An On-Chain Analysis Based on the USDT Blacklist

In recent years, the rapid development of stablecoins has attracted the attention of regulators regarding their potential risks. Particularly in the fight against Money Laundering and illegal financial activities, establishing mechanisms to freeze suspicious funds has become an important topic. This article will analyze from two perspectives: a systematic review of the freezing actions on USDT blacklisted addresses, and exploring the potential links between frozen funds and terrorist financing.

1. Analysis of USDT Blacklist Addresses

We identified and tracked Tether blacklisted addresses through on-chain event monitoring. The analytical method has been validated through the Tether smart contract source code, focusing primarily on the AddedBlackList and RemovedBlackList events.

1.1 Main Findings

Based on Tether data on Ethereum and Tron blockchains, we found:

• Since January 1, 2016, a total of 5,188 addresses have been blacklisted, involving frozen funds of over 2.9 billion USD.
• From June 13 to June 30, 2025, 151 addresses were blacklisted, with 90.07% coming from the TRON chain, and the frozen amount reached 86.34 million USD.
• Uneven distribution of frozen amounts: The top ten addresses account for 61.91% of the total frozen amount, with an average frozen amount of $571,800 and a median of only $40,000.
• Lifecycle funds flow: These addresses have cumulatively received $808 million, with $721 million transferred out before being blacklisted, and only $86.34 million actually frozen.
• Newly created addresses are more likely to be blacklisted: 41% of blacklisted addresses were created less than 30 days ago.
• Most addresses achieve "escape before freezing": about 54% of addresses have transferred out more than 90% of their funds before being blacklisted.

1.2 Capital Flow Tracking

Analyzed the fund flows of 151 blacklisted USDT addresses through on-chain tracking tools:

Source of funds:

• Internal contamination: Funds from 91 addresses come from other blacklisted addresses.
• Phishing Tag: The upstream addresses of 37 addresses are labeled as "Fake Phishing".
• Exchange hot wallet: Funds from 34 addresses come from mainstream exchange hot wallets.
• Single main distributor: Funds from 35 addresses come from the same blacklisted address.
• Cross-chain bridge entry: Part of the funds from 2 addresses comes from the cross-chain bridge.

Funds Direction:

• The funds from 54 addresses are flowing to other blacklisted addresses.
• The fund flow of 41 addresses to centralized exchange deposit addresses.
• The fund flow of 12 addresses to the cross-chain bridge.

It is worth noting that certain mainstream exchanges appear on both the inflow and outflow sides, highlighting their core position in the capital chain. It is recommended that cryptocurrency trading platforms strengthen real-time monitoring and risk interception mechanisms.

2. Terror Financing Analysis

We analyzed the administrative seizure order issued by the Israeli National Counter-Terrorism Financing Bureau to assess the use of USDT in terrorist financing.

2.1 Main Findings

• Since June 13, 2025, only 1 new seizure order has been added.
• Since the outbreak of the conflict on October 7, 2024, a total of 8 seizure orders have been issued, 4 of which explicitly mention "Hamas", and the latest one mentions "Iran" for the first time.
• The seizure order involves 76 USDT( Tron) addresses, 16 BTC addresses, 2 Ethereum addresses, 641 accounts on a certain trading platform, and 8 accounts on a certain trading platform.

On-chain tracking of 76 USDT( TRON) addresses revealed two behavioral patterns:

1. Proactive freezing: 17 addresses related to Hamas were added to the blacklist an average of 28 days before the seizure order was issued.
2. Quick Response: The remaining addresses were frozen within an average of 2.1 days after the announcement of the seizure order.

This indicates that there may be a close cooperation mechanism between the stablecoin issuer and certain national law enforcement agencies.

3. Summary and the Challenges Faced by AML/CFT

Although stablecoins provide technical means for controllability in transactions, they still face the following challenges in practice:

• Reactive Enforcement vs Proactive Prevention
• Regulatory blind spots of exchanges
• Cross-chain Money Laundering is becoming increasingly complex

Suggestions for stablecoin issuers, exchanges, and regulatory agencies:

• Enhance on-chain intelligence sharing
• Investment Real-Time Behavior Analysis Technology
• Establish a cross-chain compliance framework

Only by establishing a timely, collaborative, and technologically mature AML/CFT system can we truly ensure the legitimacy and security of the stablecoin ecosystem.