By Tether blacklisted dozens of addresses on the TRON blockchain on October 28, 2026, restricting transfers involving wallets that collectively held approximately $27 million in USDT when monitoring alerts were generated.
According to blockchain monitoring data attributed to TrustSniffer, at least 33 addresses were affected. A more detailed review identified 35 TRON addresses, including 10 that held no USDT when flagged.
The largest affected wallet contained approximately $7.8 million, while seven addresses accounted for roughly $25.7 million of the reported total. The restrictions were concentrated within a short period, with 25 addresses blacklisted in a single batch shortly after 14:16 UTC.
Tether has not publicly disclosed why the addresses were targeted, whether the restrictions followed a law enforcement request or whether the wallets were connected to a particular investigation.
The $27 million figure reflects balances observed when the addresses were flagged and does not necessarily represent the precise amount immobilized when the restrictions took effect.
Seven Wallets Account for Most Affected Funds
TrustSniffer’s monitoring records indicate that 25 TRON addresses were flagged at approximately 14:16 UTC and blacklisted around 14:17 UTC. The interval between the initial requests and execution was approximately 63 to 66 seconds.
Among the largest affected addresses, one held $7.8 million, another held $3.85 million, and a third contained approximately $3.15 million. Two additional wallets each held roughly $3 million, while the remaining two major balances were approximately $2.5 million and $2.3 million.
Together, these seven addresses represented about 95% of the combined USDT balances. Additional restrictions were recorded in smaller batches throughout the day. The coordinated timing suggests that multiple addresses were processed together, but does not establish common ownership or involvement in the same alleged activity.
USDT on TRON operates as a TRC-20 token, with Tether retaining administrative controls that allow addresses to be added to a blacklist. Once restricted, an address generally cannot transfer its USDT until the issuer removes the restriction.
However, blacklisting does not automatically transfer ownership of the tokens, destroy them or return funds to potential victims. The assets remain visible on the blockchain even when transfers are disabled.
Stablecoin Restrictions Highlight Centralized Issuer Authority
The October 28 action follows several significant USDT blacklisting incidents involving TRON. Earlier in October, Tether restricted approximately $2.2 million in USDT linked through blockchain analysis to a $15.99 million outflow from wallets associated with Indian cryptocurrency exchange CoinDCX.
Other recent restrictions have involved addresses connected to cryptocurrency protocols and investigations into suspected illicit financial activity. However, no public evidence establishes a connection between those incidents and the latest group of blacklisted wallets. Tether has previously cooperated with law enforcement authorities and expanded its voluntary wallet-freezing policy in December 2023 to address sanctions-related risks.
The company can implement restrictions directly through its token contracts, including when USDT is held in self-custodied wallets rather than centralized exchanges. This capability distinguishes centrally issued stablecoins from native cryptocurrencies whose transfers are not subject to comparable issuer-level controls.
For authorities investigating suspected financial crimes, blacklist functions can help prevent further movement of identified assets. For legitimate users and financial institutions, the same mechanisms introduce dependence on issuer decisions, compliance procedures and the availability of remedies for disputed restrictions.
Importantly, a blacklist entry alone does not establish that a wallet owner committed wrongdoing. The incident also illustrates the limits of interpreting blockchain monitoring data without accompanying investigative disclosures. Although the affected addresses and their recorded balances are publicly observable, the underlying reasons for the restrictions remain unknown.
Further statements from Tether or relevant authorities would be needed to determine whether the action relates to sanctions enforcement, suspected fraud, stolen assets or another compliance matter.