How FreezeCheck scores a USDT wallet, and how accurate it is

Every check ends in a score from 0 to 100 and one of four verdicts: 🟢 clean, 🟡 suspicious, 🔴 dangerous, ⚪ not enough data. This page explains where the points come from and how we measure whether they are right.

The score rests on three layers of evidence: who the address and its counterparties are (labels), where the money came from and went to (the trail), and how the wallet behaves (including a model trained on wallets Tether has frozen). In a blind test on October 2026 freezes that the model had never seen, 84% of the frozen wallets with a usable history had been marked 🟡 or 🔴. On a fixed sample of ordinary exchange customers, 4.0% got a false 🟡 or 🔴. Updated 8 November 2026.

What goes into the score

Facts: who an address is

Our database holds about 65 million labelled TRON addresses. Most of them are exchanges: hot wallets and the deposit addresses of their customers. The labels that mean "dirty" come from primary lists:

Tether's blacklist. Every address Tether has frozen in the USDT contract on TRON, 8,193 addresses, each with the date of the freeze.
Sanctions. OFAC (USA), the EU and UK lists, and Israel's NBCTF seizure orders.
Court records and scam reports. Addresses named in court judgments and US forfeiture cases, and reports from Chainabuse.

Our own maps

Public lists cover little of the dirt on TRON, so we scan the network ourselves. Each map follows one rule:

Exchange deposits. A deposit address receives money from outside and sweeps all of it to one hot wallet. That pattern finds deposits of named exchanges and of hundreds of exchanges without a public name.
Look-alike addresses (address poisoning). An address that copies the start and end of a real one and sends it a tiny or zero transfer. Over 2.17 million such addresses so far. See the research.
Drainers and look-alike factories. Wallets that empty victims' accounts, and wallets that activate look-alikes in bulk.
Counterparties of sanctioned addresses (sanctioned_flow). Wallets that traded with an OFAC or EU address at any point in its history. This is a hint, not a verdict, and carries fewer points.

The trail

Dirty money rarely arrives straight from a listed address, so the bot also follows the trail:

Direct links. Transfers between the wallet and a labelled address.
One hop. The wallet's 10 largest counterparties are checked: did they trade with a sanctioned, frozen, scam or mixer address?
Origin and destination. The bot follows incoming USDT backwards and outgoing USDT forwards, up to 5 hops, and splits the money by share: "72% from exchanges, 10% from scams, 18% unknown". A branch stops at a labelled address or a large unnamed service. Lookups per check are capped; the report says when the cap was hit.

Behaviour

Some risks show in how a wallet acts: its age, a one-off wallet with 1–2 transfers, transit (money leaves within an hour), many small payments from fresh wallets, and activation by a dirty address or by one that activated 50+ wallets.

The freeze model

The model answers one question: does this wallet look like the ones Tether later froze? It is a logistic regression over 58 features the check already collects: age, activity rhythm, how long money stays, where it came from, links to dirty and recently frozen addresses, who activated the wallet. Balance is not used.

The current version was trained on 5 November 2026 on 3,942 wallets: 1,570 frozen by Tether, 1,001 exchange deposits, 863 ordinary exchange customers and 508 neighbours of frozen wallets. Cross-validated ROC AUC is 0.959. It is not applied to wallets with fewer than 3 transfers, to exchange or service addresses, or to addresses already labelled dirty.

From signals to a verdict

Every wallet starts at 20 points. Signals add or subtract points. The total is clipped to 0–100: 0–34 is 🟢, 35–69 is 🟡, 70–100 is 🔴. Some signals also set a floor that the total cannot fall below.

Signal	Points
The address itself is sanctioned or frozen by Tether	100
The address itself is a look-alike, drainer, scam or mixer	at least 90
Direct transfers with a sanctioned / frozen / scam or mixer address	+60 / +50 / +45; the total is at least 75 (🔴)
Dirty money via a chain of intermediaries (incoming)	+10 to +50 by share; 40% or more sets a red floor
A counterparty traded with dirt (one hop)	+20 if the wallet moved 1,000+ USDT with it, otherwise +8
Wallet activated by a dirty address	+30
Wallet younger than a day / a week	+25 / +12
One-off wallet (1–2 transfers)	+10
Freeze model, probability 0.6+ / 0.8+	+20 / +35
Small payments from fresh wallets; activation farm; transit	+8; +8; +6
Transfers with exchanges (30%+ of volume)	−8 (−15)

Some rules keep the score from overreacting:

Dust is not a link. If an address only sent the wallet less than 10 USDT and got nothing back, it is ignored. That is how poisoning looks, and the victim should not turn red.
A drop in a busy wallet. If dirty counterparties make up under 2% of the volume and under 2% of the transfers of a wallet with 100+ transfers, their points are halved and there is no red floor. Sanctions are excluded from this rule, and so are transfers made on or after the day of a freeze.
Old links fade. A link that ended 180+ days before Tether froze the counterparty gives 10 points instead of 50, without a floor.
The model alone cannot make 🔴. Unless its probability is 0.97 or higher, the model can lift a wallet to 🟡 but not to 🔴.
Exchange addresses stay capped. A confirmed exchange address scores no more than 15, unless it is itself sanctioned, frozen, scam or a mixer.

When the verdict is ⚪

⚪ means we did not find dirt, but we also cannot say where most of the money came from. The bot gives ⚪ instead of 🟢 when the analysis is too incomplete: more than 85% of incoming money is from unknown sources, the lookup cap was hit, or a data source did not answer. A wallet with no transfers at all and no other risk signal also gets ⚪, not 🟡. A new wallet is not "clean"; it simply has no history yet.

Derived labels do not stick to exchanges

Big exchanges touch everything, including sanctioned and scam wallets. So labels we derive from neighbourhood or documents (court cases, our maps, "traded with a sanctioned address") are hidden on confirmed exchanges, exchangers and large services. Primary lists stay: a sanctioned or frozen exchange is still dirty.

How we measure accuracy

A blind test, split by time

Testing a model on the wallets it learned from proves nothing. So on 3 November 2026 we trained a separate copy of the model only on freezes up to 30 September and ran the bot on wallets Tether froze in October.

October 2026 freezes	Result
Frozen wallets in the test	120
Too little history to judge	38 (mostly fresh pass-through wallets)
Wallets with history	82
Marked 🟡 or 🔴 in advance	84%
Of them 🔴	20%
Missed (🟢)	10%
Same wallets, rules without the model	46%

Thin wallets with only 1–2 transfers are a separate case. The model does not apply to them, and the rules alone catch about 65%.

After this test we tuned several thresholds and the model's point bands on the same October freezes. With the new settings the bot catches 93% of them. That figure is an upper bound, not a blind result: the settings were chosen while looking at those wallets. The honest blind figure is 84%.

False alarms

We keep a fixed sample of 100 exchange deposit addresses and 100 ordinary exchange customers and rerun it after each rule change. The run on 6 November 2026 gave:

Group	🟡 or 🔴	🔴
Ordinary exchange customers	4.0%	0%
Exchange deposit addresses	4.7%	1.6%

The deposit test hides each deposit's own exchange label. In real checks that label caps a deposit at 15, so it shows 🟢.

The public prediction log

The bot also keeps a public log. Every day it checks wallets on its own: random customers of exchanges, neighbours of recent freezes, fresh addresses from our dirt maps, live wallets across the network, and recently checked addresses. It records the verdict, score, time and a hash of the input data. Once an hour it compares the log with new Tether freezes. A wallet frozen after it was logged counts as a hit, with the freeze transaction linked. A verdict recorded before the freeze cannot be changed afterwards. The summary is on the home page, including zero hits when there are none. The addresses the bot flagged 🔴 or 🟡 before Tether froze them are listed on What the bot showed before the freeze.

How labels are corrected

Every report has a complaint button. When a label turns out wrong, we remove it. Example, 5 November 2026: an outside list marked a contract as a drainer. It was a busy service with thousands of recipients a week, used by drainers and ordinary people alike, and the label gave a false 🔴 to several exchange customers in our sample. We removed it. Now we check whether an address is a busy hub before taking a scam label from an outside list. A deposit label is also removed during a check if the wallet pays addresses outside the exchange: then it is a personal wallet.

Change log

1 Nov 2026. One-hop link points lowered to 20/8 (from 35/15).
3 Nov 2026. Small payments from fresh wallets, activation farm and transit lowered to 8/8/6. Model bands changed to 0.6 → 20 and 0.8 → 35.
4 Nov 2026. ⚪ rule tightened: unknown destination of outgoing money no longer leads to ⚪.
5 Nov 2026. Freeze model retrained on 3,942 wallets (ROC AUC 0.959, up from 0.936).
6 Nov 2026. "Small direct link" rule for busy wallets.

FAQ

Is a green verdict a guarantee?

No. 🟢 means we found no links to dirt and no risky behaviour in the data we have. In the blind test 10% of wallets that Tether later froze were 🟢 beforehand. For large amounts, start with a small transfer.

Do you use Chainalysis or TRM?

We do not buy their scores. Our sources are public: official sanctions lists, TRM Labs' public sanctions data, Chainabuse reports and the Tether blacklist. The scoring engine, the network maps and the freeze model are our own.

How often is the data updated?

Lists and labels update daily. Network scans (look-alikes, drainers, exchange deposits) repeat every one to two weeks. The prediction log is compared with Tether freezes every hour.

My address got the wrong label. Can it be fixed?

Yes. Press the complaint button under the report in the bot, or write to hello@freezecheck.org with the address and the reason. Labels from our own maps are reviewed by hand. Labels from official lists such as OFAC or the Tether blacklist only change when the source changes.

Check a wallet for free