Tether freezes on TRON are visible before they happen

Every USDT freeze on TRON is first proposed on-chain in a 2-of-3 multisig wallet that owns the USDT contract, with the target address in plain view. Only a second signature executes it. FreezeCheck measured that gap for every freeze from November 2025 to November 2026 and what the targeted addresses did inside it.

4,199frozen addresses, every one matched to its multisig proposal

9.7 minmedian time from public proposal to freeze

1,257freezes (30%) with a window longer than an hour

167 hlongest window: almost seven days

$65.4MUSDT that left targeted addresses inside the window

$104MUSDT sent to addresses after they were already frozen

Histogram of the time between a freeze proposal in Tether's TRON multisig and the freeze: 145 under a minute, 1,718 in 1–5 minutes, 251 in 5–10, 433 in 10–30, 395 in 30–60 minutes, 683 in 1–3 hours, 236 in 3–6 hours, 303 in 6–24 hours, 35 over a day. — Time from the on-chain proposal to the freeze, per frozen address. Data: all 4,199 freezes with transaction hashes, CSV.

How a freeze happens on TRON

The USDT contract on TRON (TR7NHq…Lj6t) is owned by the multisig wallet TBPxhVAsuzoFnKyXtc1o2UySEydPHgATto, which needs 2 of its 3 owners to sign. To freeze an address, one owner calls submitTransaction with the call addBlackList(address) inside. That transaction is public at once and anyone can decode the target. A second owner then calls confirmTransaction, and only at that moment the USDT contract emits AddedBlackList and the address can no longer send USDT.

Key findings

The window is usually short, but often not. Half of all freezes executed within 9.7 minutes of the proposal. But 1,257 of 4,199 (30%) waited more than an hour, 338 more than six hours and 35 more than a day. The longest waited 167 hours.
Money moves inside the window. Of the 3,476 addresses that are still frozen, 219 sent out USDT after the proposal was public and before the freeze: 65.4 million USDT in total. In an interval of the same length right before the proposal the same addresses sent out 27.9 million, from 177 addresses. Outflows in the window were 2.3 times higher.
Long windows lose the most. For windows of an hour or more: 165 of 1,150 addresses moved 53.3 million USDT out in the window, against 23.6 million in the equal interval before.
The largest case. Address TT5KQgALEbsx6ynDX4x1H6HFFKDPa2Kn4c sent out 15.2 million USDT in a single transfer 5 minutes after its freeze was proposed and 64 minutes before it executed.
Where it went. 94.5% of the money that left in the window went to addresses with no exchange, service or scam label in our base of 71 million labels, typically fresh wallets. 3.2 million went to addresses that Tether froze later. Exchange deposit addresses received 0.13 million.
Money keeps arriving after the freeze. On TRON a frozen address can still receive USDT, it just cannot send it. In the year, 1,945 senders sent 104.2 million USDT to 982 addresses that were already frozen (3,033 transfers of at least 1 USDT); 280 of those transfers came within an hour of the freeze. 65 exchange addresses sent 3.7 million of it, services 4.3 million.

Also in the data

Tether unfroze 731 TRON addresses in the same period, a median 44 days after the freeze. 447 of them were unfrozen on a single day, May 14, 2026; they had been frozen between March 25 and April 2.
Tether destroyed the balances of frozen addresses 553 times, 318.6 million USDT in total (DestroyedBlackFunds).

Why it matters

For Tether and other issuers. A two-step freeze through a public multisig announces the target before the freeze takes effect. Whether a given transfer was a reaction to the proposal cannot be proven from the chain, but the higher outflow inside the window and the long tail of windows over an hour show the exposure.
For exchanges and payment services. Withdrawals to addresses already on the blacklist get stuck. Checking the blacklist before paying out avoids that.
For investigators. The proposal time is an earlier, public signal of a coming freeze. The CSV has every proposal and freeze transaction hash.

Method

Freezes. All AddedBlackList events of the USDT contract on TRON from November 4, 2025 to November 7, 2026 (4,221 events, 4,199 addresses), read through TronGrid.
Proposals. Submission, Confirmation and Execution events of the multisig. Each freeze transaction contains the multisig Execution event; its transaction id leads to the Submission event and its time. All 4,221 freezes matched, each with exactly 2 confirmations.
Transfers. Every USDT transfer to or from the 3,476 addresses that were still frozen on November 8, 2026, from 30 days before the first freeze to November 8, read from the full USDT stream through SQD Portal: 1.42 million transfers.
Baseline. For each address, USDT sent out in the window is compared with USDT sent out in an interval of the same length ending at the proposal.
Labels. Destinations and senders are matched against FreezeCheck's label base. Labels we derive from contact with frozen addresses are excluded, so the classification is not circular.

What to keep in mind

A transfer inside the window is not proof that its sender saw the proposal. Some addresses were simply active; the baseline shows how much would be expected.
723 addresses frozen during the year are no longer frozen and are not in the transfer analysis; the window times cover all of them.
Totals are dominated by a few large addresses. Per-address figures are in the CSV.

What we do with it

The bot knows every frozen address and warns before you pay one. Check any address before a deal: @freezecheck_bot address.

Check an address

For media and researchers

Data under CC BY 4.0: all freezes with proposal and freeze times, CSV, chart in English and Russian. Questions and full exports, including the transfer-level data: hello@freezecheck.org. More: press page, who Tether freezes and who it doesn't, address poisoning.

Practical guides: how to check a USDT wallet · check USDT for a freeze · all research.