A single Tron address moved 15.2 million USDT in one transaction five minutes after Tether proposed the freeze on-chain, with the blacklist taking effect 64 minutes later, according to a year-long review of USDT freezes by wallet-risk project FreezeCheck.

The address, which begins TT5KQg, moved the funds on September 20, 2026. Tether's proposal landed at 13:05 UTC that day, and the freeze executed at 14:14 UTC. FreezeCheck's data indicates nothing was sent out of the address during an equal stretch before the proposal.

FreezeCheck, which operates a Telegram wallet-checking bot, cautioned that a transfer inside the window is not proof that the sender saw the proposal, since some addresses are simply active on their own schedules. The episode nevertheless points to a structural feature of on-chain enforcement: the gap between a blacklist proposal becoming public and taking effect is a measurable stretch of time, and the study quantifies what moved inside it.

About 30% of blacklist orders waited more than an hour

Tether's USDT contract on Tron is governed by a multisig wallet that requires two of its three owners to sign. One owner submits a transaction containing the call addBlackList(address), which anyone can decode at the same moment to reveal the target. A second owner then confirms the transaction, and only then can the flagged address no longer send USDT. Because the target is visible the moment the proposal is submitted, the interval before enforcement is observable on-chain by anyone monitoring the pending transaction.

FreezeCheck identified 4,199 frozen addresses together with their proposals, covering every freeze from November 4, 2025 to November 7, 2026. Half executed within 9.7 minutes. However, 1,257 orders, or about 30%, waited more than an hour, and 338 of them waited more than six hours. Thirty-five waited longer than a day, with the longest wait stretching to 167 hours.

219 targeted addresses sent out 65.4 million USDT before execution

Of the 3,476 addresses still frozen on November 8, 219 sent out an aggregate of 65.4 million USDT after the proposal became public and before the freeze took effect. In an identical run-up before each proposal, 177 of those addresses sent 27.9 million. Outflows inside the window were therefore 2.3 times larger.

The heaviest losses occurred in windows of an hour or more, where 165 of 1,150 addresses moved 53.3 million USDT out, versus 23.6 million in the comparable period beforehand.

FreezeCheck said 94.5% of the money went to addresses that carried no exchange, service, or scam label in its base of 71 million labels—typically fresh wallets. Exchange deposit addresses received 130,000 USDT, while another 3.2 million went to addresses Tether later froze.

In August, Cryptopolitan reported an analysis of 2,955 Tether freeze events on Ethereum and Tron, which pegged the average wait at 2 hours and 16 minutes. Some $34 million of the more than $165 million held in Iran-linked wallets subject to sanctions moved out in July before the block arrived.

A completed freeze only stops outgoing USDT, so a blacklisted address can still receive funds but cannot send onward anything it holds. During the year, 1,945 senders moved 104.2 million USDT to 982 addresses that had already been frozen. Of that total, 3.7 million came from exchanges, and 280 transfers arrived within an hour of the freeze.

FreezeCheck released all proposals and freeze transaction hashes in a CSV file, archived on Zenodo, making it possible to verify each event against on-chain records. The full research write-up is published on FreezeCheck.