Tether added 32 Tron addresses to the USDT blacklist on Wednesday 28 October 2026, between 14:06 and 14:21 UTC, according to the event log of the USDT contract read through the TronGrid API. When Coindaro read their balances at 17:49 UTC on 29 October, the 32 addresses held 27,285,760 USDT between them, about $27.3 million, and every one of them was still flagged as blacklisted. Neither Tether nor any authority has said who asked for the freeze, or why.
The story first reached the press with a slightly different count. Criptovaluta.it reported on 29 October that 33 Tron addresses holding about $27 million had been frozen, citing data from the tracker TrustSniffer relayed by Wu Blockchain, with the largest wallet at about $7.8 million. The amount and the largest balance match what the chain shows. The count does not: we find 32 AddedBlackList events on the Tron USDT contract that afternoon, and we could not identify a 33rd address.
Nothing public ties these addresses to a person, a company or a case. A blacklisting is a decision taken by the issuer of the token, not a court ruling, and no charge, sanction listing or statement naming the holders had been published when this article went out.
Tether freezes USDT on Tron in four bursts over 15 minutes
The 32 blacklistings arrived in four groups. The largest group, 25 addresses, landed in three consecutive blocks within six seconds, and 20 of those sit in a single block, number 87,507,925, timestamped 14:17:45 UTC. Each blacklisting is a separate transaction calling the contract’s addBlackList function, which only the contract owner can call.
| Time (UTC, 28 Oct) | Tron blocks | Addresses blacklisted |
|---|---|---|
| 14:06:21 to 14:06:30 | 87,507,697 to 87,507,700 | 5 |
| 14:07:00 | 87,507,710 | 1 |
| 14:17:42 to 14:17:48 | 87,507,924 to 87,507,926 | 25 |
| 14:21:06 | 87,507,992 | 1 |
| Total | 32 |
Such tight grouping suggests, without proving it, that the 32 were handled as one job. Whether they came from one request or several, the chain cannot say.
Seven addresses hold 94% of the $27.3 million
The money is concentrated. The largest balance, 7,813,095 USDT, belongs to an address blacklisted at 14:17:42 in block 87,507,924 (transaction beginning 04118ee448). Six more hold between 2.3 million and 3.9 million USDT each. Together the top seven account for 25,597,576 USDT, or 93.8% of the total.
| Rank | USDT balance on 29 Oct, 17:49 UTC |
|---|---|
| 1 | 7,813,095 |
| 2 | 3,860,911 |
| 3 | 3,152,000 |
| 4 | 3,000,000 |
| 5 | 2,961,195 |
| 6 | 2,508,636 |
| 7 | 2,301,739 |
| 8 to 32 (25 addresses) | 1,688,184 |
| All 32 | 27,285,760 |
At the other end, 14 addresses hold between about 6,000 and 394,000 USDT, one holds 267 USDT and ten hold less than one USDT, eight of them exactly zero. Why empty addresses were put on the list has not been explained either.
One caveat on these numbers: they are balances read a day after the freeze. A blacklisted address can still receive USDT, and four of the 32 did. The transfer history on TronGrid shows 564,855 USDT reaching them after their blacklisting, including 215,000 USDT at 15:19 UTC on 28 October and 200,000 USDT at 08:00 UTC on 29 October. Take those out and the 32 held about 26.7 million USDT at the moment they were frozen.
Criptovaluta’s figure of about $27 million is also a combined balance of the addresses. The outlet says the exact amount frozen has not been confirmed.
What a blacklist does to a USDT address on Tron
USDT is not a neutral token. Tether, which issues it, keeps administrative controls written into the contract. The Tron version, named TetherToken, includes four functions that matter here: addBlackList, removeBlackList, isBlackListed and destroyBlackFunds. Once an address is on the list, it can no longer send its USDT. It can still receive more, as four of these addresses did. The balance stays visible on the chain, but it is stuck.
The freeze touches only USDT. TRX, the network’s own coin, and other tokens held at the same addresses are outside Tether’s contract and are not affected by it. The other two functions are the exits: removeBlackList releases an address, and destroyBlackFunds lets Tether wipe the balance of a blacklisted address entirely, which leaves its own event on the chain.
Neither exit has been used on these 32 so far. We found no DestroyedBlackFunds event on the Tron USDT contract between 13:00 UTC on 28 October and our check on 29 October. The log shows one RemovedBlackList event at 14:07:18 UTC on 28 October, in the middle of the batch, but it concerns a different address, not one of the 32. Tether does use the wipe function: the same log shows 20 DestroyedBlackFunds events on Tron between 14 and 23 October, nine of them on 21 October. For newcomers, the difference between a token like this one and a coin nobody controls is set out in our beginner’s guide to stablecoins.
No requester and no reason given
Tether had published nothing on the freeze when we checked its news page on 29 October. The latest items there are a mining software announcement on 24 October, investments in Peso on 21 October and in Tenstorrent on 20 October, and, on 28 October, the launch of the FASE Foundation, a group set up with partners including Chainalysis, Kraken’s parent Payward and the Solana Foundation, with the UN Office on Drugs and Crime (UNODC) as strategic partner, to fight scams and support trafficking survivors. No source links that launch to the blacklistings of the same afternoon, and we do not either.
Criptovaluta wrote that the action was probably started at the request of the competent authorities. That is the outlet’s reading, not a stated fact, and it gives no source for it. The same article says the reasons are unknown and that the near-simultaneous timing does not show the wallets belong to one person or one investigation. Wu Blockchain’s original post on X could not be opened by Coindaro, so we know its content only through that report.
Who can ask Tether to freeze USDT
Tether freezes addresses on its own initiative and at the request of authorities, and it has built a channel for the second. The T3 Financial Crime Unit, set up in August 2024 by Tether, TRON and the analytics firm TRM Labs, said it had frozen more than $100 million by January 2025, according to TRM Labs. By 14 May 2026 the figure was more than $450 million across 23 jurisdictions, The Block reported, adding that in account-takeover and violent-crime emergencies the unit had frozen funds within 24 hours of requests from authorities. Whether T3 played any part on 28 October has not been said.
US sanctions are the other route. On 23 April 2026 Tether froze more than $344 million in USDT on two Tron addresses, about $213 million and $131 million, after they were flagged by US authorities, and said the action was coordinated with OFAC and US law enforcement, according to The Block. CEO Paolo Ardoino said in the company’s statement that “USDT is not a safe haven for illicit activity.” In April the company spoke and named the agency. This time it has said nothing.
How fast Tether acts on such cases is itself disputed. On 19 October, Ardoino wrote on X that Tether freezes wallets on average four weeks before an official sanctions designation, while US Senate staff described 34 Hezbollah-linked wallets that waited about nine months, as we reported in our story on Tether’s answer to the Senate report. The company’s freeze record, reserves and regulators are covered on our Tether project page.
A large batch, but not an unusual day on the blacklist
Tether blacklists Tron addresses almost every day. The same TronGrid log shows 140 AddedBlackList events on the Tron USDT contract over the 13 days from 15 to 27 October, about 11 a day, with no event at all on 17 and 25 October, 34 on 15 October and 17 to 19 on three other days. On 14 October there were 65, of which 60 came after 15:26 UTC. Later on 28 October, between 17:01:06 and 17:01:12 UTC, four more addresses were added; at 17:49 UTC on 29 October they held about 75, 9, 0 and 0 USDT.
What stands out on 28 October is the money per address. Security firm BlockSec counted 3,506 Tron addresses blacklisted by Tether in 2025, with $853.08 million frozen, an average of $243,319 each. Leaving out the deposits that came after the freeze, the 32 addresses of 28 October held about $835,000 each on average, more than three times that figure. The comparison has limits: it sets one batch against a full year, and seven large balances carry the average, since the median address holds about 38,500 USDT. The largest of them, at 7.8 million USDT, is about half the biggest single Tron freeze BlockSec recorded for all of 2025, $15.21 million on 7 February.
Across both chains, BlockSec counted 4,163 addresses and $1.26 billion in 2025. The running total is larger: Tether and Circle have frozen about $4.5 billion in stablecoins since mid-2020, about $2.3 billion of it in 2026, according to stables.rip data cited by Criptovaluta.
What the freeze means for people who hold USDT
Tron is where most of Tether’s freezes happen, 3,506 of the 4,163 addresses in BlockSec’s 2025 count, and where about half of all USDT circulates; the network settled about $2.2 trillion in stablecoins in the third quarter, as detailed in our report on TRON’s stablecoin volumes. A blacklist works at the level of an address. Anyone can check whether a given Tron address is flagged by reading the contract’s isBlackListed function, which block explorers such as Tronscan let anyone read from the contract page.
Holders on an exchange do not own an address on the USDT contract in their own name: the exchange holds the tokens in its wallets and owes the customer a balance. Holders who keep USDT in their own wallet are directly exposed to the issuer’s controls, as are holders of USDC, whose issuer Circle keeps a similar blacklist.
In Europe, USDT is not authorised under MiCA, and its place on regulated platforms is shrinking: Coinbase converts EEA retail USDT balances on 30 October, as covered in our report on USDC overtaking USDT in euro trading. That shift is about licensing, not freezes, and no European regulator has commented on the 28 October blacklistings.
What is still unknown, and what to watch
Most of what matters here is missing. We do not know who asked for the freeze, on what grounds, who controls the 32 addresses, whether T3 was involved, or which 33rd address the press count includes. Balances at the exact moment of each blacklisting have not been published either.
On the chain, two events would change the picture: DestroyedBlackFunds, which would mean Tether is wiping the balances, and RemovedBlackList, which would release an address. Off the chain, the first statement from Tether, an authority or the holders themselves will be the first account of why $27.3 million stopped moving on Wednesday afternoon.