Stablecoins and Illicit Funds: On-chain Tracking and Regulatory Challenges

Introduction

In recent years, the application scope of stablecoins has been continuously expanding, while regulatory agencies have also increasingly focused on establishing mechanisms to freeze illegal funds. Mainstream stablecoins such as USDT and USDC have the technical capability to do this and have played a role in combating money laundering and other illegal financial activities in actual cases.

Our research found that stablecoins are not only involved in money laundering but also frequently appear in the financing activities of terrorist organizations. This article will analyze from two perspectives:

1. The system reviews the freezing status of USDT blacklisted addresses;

2. Discuss the relationship between frozen funds and terrorist financing.

1. USDT Blacklist Address Analysis

We monitored on-chain events to identify and track blacklisted addresses for a well-known stablecoin. The analysis method has been validated through the smart contract source code of the stablecoin. The core logic is as follows:

• Event Recognition: The contract maintains the blacklist status through two events:

  • Add blacklist address
  • Remove blacklisted address

• Dataset Construction: Record the following fields for each blacklisted address:

  • The address itself
  • Time added to the blacklist
  • If the address is removed from the blacklist, the record of the removal time will be kept.

1.1 Core Findings

Based on the data on-chain of Ethereum and TRON, we have identified the following trends:

Since January 1, 2016, a total of 5,188 addresses have been blacklisted, involving frozen funds of over $2.9 billion.

Between June 13 and June 30, 2025, a total of 151 addresses were blacklisted, of which 90.07% were from the Tron chain, with a frozen amount reaching $86.34 million. The distribution of blacklisting events over time: June 15, 20, and 25 were peak days for blacklisting, with June 20 seeing as many as 63 addresses blacklisted in a single day.

• Frozen Amount Distribution: The top ten addresses by amount have frozen a total of $5.345 million, accounting for 61.91% of the total frozen amount. The average frozen amount is $571,800, but the median is only $40,000, indicating that a small number of large addresses have inflated the overall average, while the vast majority of addresses have a relatively small frozen amount.

• Lifecycle fund distribution: These addresses have cumulatively received $808 million, of which $721 million was transferred out before being blacklisted, leaving only $86.34 million actually frozen. This indicates that most of the funds were successfully transferred before regulatory intervention. Additionally, 17% of the addresses have no outgoing transaction records, possibly serving as temporary storage or fund aggregation points, which warrant further attention.

• Newly created addresses are more likely to be blacklisted: 41% of blacklisted addresses were created within the last 30 days, 27% have been active for 91-365 days, and only 3% have been in use for over 2 years, indicating that new addresses are more likely to be used for illegal activities.

• Most addresses implement "escape before freeze": about 54% of addresses transferred out over 90% of their funds before being blacklisted, and another 10% had a balance of 0 at the time of freezing, indicating that enforcement actions can mostly only freeze the residual value of funds.

• New address money laundering efficiency is higher: Through the FlowRatio vs. DaysActive scatter plot, we found that new addresses perform outstandingly in terms of quantity, blacklisting frequency, and transfer efficiency, achieving the highest money laundering success rate.

1.2 Fund Flow Tracking

Using an on-chain tracking tool, we further analyzed the fund flows of 151 USDT addresses that were blacklisted between June 13 and 30, identifying the main sources and directions of the funds.

1.2.1 Source of Funds Analysis

• Internal contamination (91 addresses ): The funds of these addresses come from other blacklisted addresses, indicating a highly interconnected money laundering network.

• Fishing Tag (37 addresses ): Many upstream addresses are labeled as "Fake Phishing", which may be a deceptive label to conceal illegal sources.

• Exchange hot wallet (34 addresses ): The source of funds includes hot wallets from multiple mainstream exchanges and may be related to stolen accounts or "mule accounts."

• Single main distributor ( 35 addresses ): The same blacklisted address may be used multiple times as an upstream, possibly functioning as an aggregator or mixer for fund distribution.

• Cross-chain bridge entry ( 2 addresses ): The funding part comes from the cross-chain bridge, indicating the existence of cross-chain money laundering operations.

1.2.2 Fund Flow Analysis

• Flowing to other blacklisted addresses (54 ): There is an "internal loop chain" structure between blacklisted addresses.

• Flowing to centralized exchanges (41 ): These addresses transfer funds to the recharge addresses of several mainstream CEXs, achieving "getting off the bus".

• Flowing to cross-chain bridge (12: indicates that some funds are attempting to escape a specific ecosystem and continue on-chain money laundering.

It is worth noting that certain exchanges appear simultaneously at both the inflow ) hot wallet ( and outflow ) deposit address (, further highlighting their core position in the capital chain. The current exchanges' insufficient execution of AML/CFT and delayed asset freezing may allow criminals to complete asset transfers before regulatory intervention.

We recommend that major cryptocurrency exchanges, as the core channel for funds, strengthen real-time monitoring and risk interception mechanisms to prevent problems before they occur.

![Exploring Money Laundering and Terrorism Financing of Digital Stablecoins: On-chain Tracking of USDT Blacklist])https://img-cdn.gateio.im/webp-social/moments-6b991437dedd4f9c8fc123c381259233.webp(

2. Terrorist Financing Analysis

In order to further understand the use of USDT in terrorist financing, we analyzed the administrative seizure order issued by a country's counter-terrorism financing bureau. Although the single data source we used makes it difficult to restore the full picture, we use it as a representative sample for a conservative analysis and estimation of USDT's involvement in terrorist transactions.

) 2.1 Core Findings

• Release time: After the escalation of conflicts in a certain region on June 13, 2025, only one new seizure order ### was added on June 26, (. The previous document was dated June 8, indicating a lag in law enforcement response during periods of geopolitical tension.

• Target organization: Since the outbreak of the conflict on October 7, 2024, the agency has issued a total of 8 seizure orders, of which 4 specifically mention certain organizations, and the latest one mentions a certain country for the first time.

• The addresses and assets involved in the seizure order:

  • 76 USDT ) Tron ( address
  • 16 BTC addresses
  • 2 Ethereum addresses
  • 641 accounts of a certain exchange
  • 8 other exchange accounts

Our on-chain tracking of 76 USDT) Tron( addresses reveals two behavioral patterns of the stablecoin issuer in response to these official instructions:

1. Proactive freezing: 17 related addresses were blacklisted an average of 28 days in advance before the seizure order was issued, with some being blacklisted as early as 45 days in advance.

2. Quick response: For the remaining addresses, the average completion of the freeze was only 2.1 days after the announcement of the seizure order, demonstrating good law enforcement cooperation capabilities.

These signs indicate a close, even proactive cooperation mechanism between stablecoin issuers and law enforcement agencies in some countries.

![Exploring Money Laundering and Terrorist Financing of Digital Stablecoins: On-chain Tracking of USDT Blacklist])https://img-cdn.gateio.im/webp-social/moments-0eb14c1be150bdab7bd57f44bbcc16f1.webp(

3. Summary and Challenges Faced by AML/CFT

Our research shows that while stablecoins like USDT provide technical means for transaction controllability, in practice, AML/CFT still faces the following challenges:

) 3.1 Core Challenges

• Reactive law enforcement vs proactive prevention: Currently, most law enforcement actions still rely on post-event handling, leaving room for criminals to transfer assets.

• Regulatory blind spots of exchanges: Centralized exchanges, as gateways for inflows and outflows of funds, often lack sufficient monitoring, making it difficult to timely identify abnormal behavior.

• Cross-chain money laundering is becoming increasingly complex: the use of multi-chain ecosystems and cross-chain bridges makes fund transfers more covert, significantly increasing the difficulty of regulatory tracking.

3.2 Suggested

We recommend stablecoin issuers, exchanges, and regulatory agencies:

• Strengthen on-chain intelligence sharing;
• Investment real-time behavior analysis technology;
• Establish an on-chain compliance framework.

Only under a timely, collaborative, and technologically mature AML/CFT system can the legitimacy and security of the stablecoin ecosystem be truly guaranteed.

![A Preliminary Exploration of Money Laundering and Terrorist Financing with Digital Stablecoins: On-Chain Tracking of the USDT Blacklist]###https://img-cdn.gateio.im/webp-social/moments-5d800b1ecf4e47e2dbea7149c7146b97.webp(

4. Industry Efforts

Some organizations in the industry are committed to promoting the security and compliance of the cryptocurrency sector, focusing on providing practical and operational on-chain solutions for AML and CFT. This mainly includes two types of products:

) 4.1 Compliance Tools

Designed for exchanges, regulatory agencies, payment projects, and DEX, supports:

• Multi-chain Address Risk Rating
• Real-time trading monitoring
• Blacklist Recognition and Alert

Help users meet increasingly stringent compliance requirements.

4.2 on-chain tracking platform

The visual on-chain tracking platform has been adopted by multiple regulatory and law enforcement agencies worldwide. It supports:

• Visual Fund Tracking
• Multi-chain Address Profile
• Complex Path Restoration and Analysis

These tools collectively embody the mission of the industry to safeguard the order and security of decentralized financial systems.

![Exploring Money Laundering and Terrorist Financing of Digital Stablecoins: On-Chain Tracking of USDT Blacklists]###https://img-cdn.gateio.im/webp-social/moments-ead6b417dc0065a068fabca94d96176b.webp(