The Role and Challenges of Stablecoins in Illicit Fund Tracking

In recent years, the rapid development of stablecoins has drawn the attention of regulatory agencies to establish mechanisms for freezing illegal funds. Mainstream stablecoins like USDT and USDC have already developed this technical capability and have played a role in combating money laundering and illegal financial activities in several real cases.

This article analyzes from two perspectives:

1. The system reviews the freezing actions of the USDT blacklist addresses.
2. Exploring the potential link between frozen funds and terrorist financing

1. USDT Blacklist Address Analysis

Through on-chain event monitoring, we identified and tracked the blacklist addresses of a certain stablecoin issuer. The analysis method has been validated through the smart contract source code.

1.1 Core Findings

Based on the data from the Ethereum and TRON blockchains, we found:

• Since January 1, 2016, a total of 5,188 addresses have been blacklisted, involving frozen funds of over $2.9 billion.

• From June 13 to June 30, 2025, 151 addresses were blacklisted, with 90.07% coming from the Tron chain, and a frozen amount of $86.34 million.

• Frozen amount distribution: The top ten addresses have frozen a total of $5.345 million, accounting for 61.91% of the total. The average frozen amount is $571,800, while the median is only $40,000.

• Lifecycle fund distribution: These addresses have cumulatively received $808 million, with $721 million withdrawn before being blacklisted, leaving only $86.34 million actually frozen. 17% of the addresses have no outbound transaction records.

• Newly created addresses are more likely to be blacklisted: 41% of blacklisted addresses were created less than 30 days ago, and only 3% have been used for more than 2 years.

• Most addresses achieve "escape before freezing": about 54% of addresses had transferred out over 90% of their funds before being blacklisted.

• The new address has a higher money laundering efficiency: the new address performs outstandingly in terms of being blacklisted frequency and transfer efficiency.

1.2 Capital Flow Tracking

Conducted a fund flow analysis on the 151 USDT addresses blacklisted from June 13 to 30, and found the main sources and directions of funds:

Source of funds:

• Internal pollution (91 addresses): from other blacklisted addresses
• Phishing tags (37 addresses): Upstream address marked as "spoofing phishing"
• Exchange hot wallet (34 addresses): Hot wallets from certain exchanges
• Single main distributor (35 addresses): The same blacklisted address repeatedly acts as upstream.
• Cross-chain bridge entry (2 addresses): part of the funds come from the cross-chain bridge

Funds Allocation:

• Flowing to other blacklisted addresses (54)
• Flowing to centralized exchanges (41)
• Flow to cross-chain bridges (12)

It is worth noting that certain exchanges appear on both the inflow and outflow sides, highlighting their core position in the capital chain. It is recommended that major cryptocurrency trading platforms strengthen real-time monitoring and risk interception mechanisms.

2. Terror Financing Analysis

We analyzed the administrative seizure order issued by the Israeli National Bureau of Counter Terrorism Financing to assess the use of USDT in terrorist financing.

2.1 Core Findings

• Release timing: There is a lag in law enforcement response during periods of geopolitical tension.

• Target Organization: Since the outbreak of the conflict on October 7, 2024, a total of 8 seizure orders have been issued, 4 of which specifically mention certain organizations, and the latest one mentions a particular country for the first time.

• The address and assets involved in the seizure order:

  • 76 USDT (Tron) addresses
  • 16 BTC addresses
  • 2 Ethereum addresses
  • 641 accounts on a certain exchange
  • 8 accounts on a certain exchange

On-chain tracking of 76 USDT (Tron) addresses revealed two behavioral patterns:

1. Proactive freezing: 17 related addresses were added to the blacklist an average of 28 days before the seizure order was issued.

2. Quick response: The remaining addresses are frozen within an average of 2.1 days after the announcement of the seizure order.

This suggests that there may be close, even proactive, cooperation mechanisms between stablecoin issuers and law enforcement agencies in some countries.

3. Summary and Challenges Faced by AML/CFT

Although stablecoins provide technical means for controllability in transactions, AML/CFT still faces the following challenges in practice:

3.1 Core Challenges

• Reactive Law Enforcement vs Proactive Prevention: Currently, most law enforcement actions still rely on post-event handling.
• Regulatory blind spots of exchanges: Centralized exchanges, as the hub for inflows and outflows of funds, often lack adequate monitoring.
• Cross-chain money laundering is becoming increasingly complex: The use of multi-chain ecosystems and cross-chain bridges has increased the difficulty of regulatory tracking.

3.2 Suggestion

It is recommended that stablecoin issuers, exchanges, and regulatory authorities:

• Strengthen on-chain intelligence sharing
• Investment real-time behavior analysis technology
• Establish a cross-chain compliance framework

Only under a timely, collaborative, and technically mature AML/CFT system can the legitimacy and security of the stablecoin ecosystem be truly guaranteed.