Can Tether freeze stolen USDT? How issuer freezes work, and how to read one

· 4 min read · KadenaTrace

Most crypto cannot be stopped once it moves. Stablecoins are the exception. USDT and USDC are tokens run by a company, and the token contract lets that company block an address so its balance can no longer move. This guide explains how that works, how to read a freeze on the chain without trusting anyone's word for it, and what a freeze does and does not mean. The example is real: on October 29, 2026 at 21:09 UTC, Tether froze $312.7M in USDT on TRON, at an address that public reports tie to the Binance hack.

How an issuer freeze works

USDT exists on many chains (TRON, Ethereum and others), each as a smart contract that Tether controls. The contract keeps a blocklist. When Tether adds an address to it:

  • the address can no longer send USDT;
  • the USDT already there stays there, but is stuck;
  • on some versions of the contract, Tether can later destroy the frozen balance and reissue it, which is how stolen USDT has been returned to victims in the past.

Only the issuer can do this, and only for its own token. A freeze of USDT does nothing to the ETH, TRX or BTC at the same address. Circle can do the same for USDC.

How to read a freeze yourself

A freeze is a transaction like any other, sent by the issuer to its own contract. On TRON, open the USDT contract's transactions on Tronscan and look for a call that adds an address to the blocklist; on Ethereum, the contract emits an event when an address is added. The transaction shows the address and the time; the address's USDT balance at that moment is what was frozen.

KadenaTrace reads these freezes from the contracts directly and lists them on Live with the transaction link, so you do not have to scan for them. The $312.7M freeze on TRON is one of them: the page links the Tronscan transaction, and the frozen balance is the address's USDT balance at the block.

On the same evening, Tether froze two more large balances: $175M on Ethereum and $66M on TRON. KadenaTrace records those too, from the contracts, but the issuer did not publish a reason and KadenaTrace does not guess one.

What a freeze proves, and what it does not

A freeze proves one thing: the issuer stopped that balance from moving, at that time. It does not prove:

  • that the address belongs to a thief. Issuers freeze at the request of law enforcement, after a theft, or for sanctions, and they rarely say which.
  • that anyone will get the money back. Returning frozen funds takes a legal process.
  • that the rest of the stolen funds are frozen. In the Binance hack, the attacker's wallets on TRON moved mostly TRX, which no issuer can freeze. The TRON side is recorded as case KT-18, where the trace follows the funds into more than 500 wallets.

This is why KadenaTrace says "frozen" only for freezes read from an issuer's contract, and never for an exchange account. An exchange may hold an account after a report, but that never appears on chain. See exchange deposits and freezes.

If your USDT was stolen

  1. Trace it. Paste the drained address into Trace and see where the USDT went.
  2. Report the receiving address to Tether, through its support channel for law enforcement and victims, with the transaction hashes and a police report number. Tether acts on law-enforcement requests; a victim's report with hashes helps the police make one.
  3. Move fast. A thief who knows the USDT can be frozen swaps it for something that cannot be, often within minutes. That is the pattern on TRON: USDT out, swapped, then spread.
  4. Register the case so the funds are watched: Report a theft.

If your own address was frozen

If you did nothing wrong, contact the issuer through its official support. Freezes do not happen at random; ask what triggered it. Do not pay anyone who offers to "unfreeze" USDT for a fee.

The records this guide follows

Tether's $312.7M freeze on TRON, read from the USDT contract on October 29, 2026 and cited by MistTrack; the address is listed as frozen in KadenaTrace's Binance incident. Figures are as recorded on October 31, 2026; the pages have the current state.

More guides