Case Study on Stablecoin Freezes: Alerting the Industry to Terrorist Financing Threats

Restricting specific blockchain addresses from interacting with particular stablecoins is a common enforcement cooperation mechanism used by stablecoin issuers. Over the past several years, Tether and Circle have established mature communication and collaboration channels with law enforcement agencies worldwide, creating strong deterrence against criminal entities and individuals who maliciously exploit cryptocurrencies.

According to Bitrace monitoring data, the number of on-chain addresses frozen in 2025 reached a record high of 3,958, exceeding the combined total of the previous four years (3,199). This article aims to analyze specific freeze cases to warn the industry about the evolving threat landscape of illicit funds.

Analysis of the First USDT Blacklisting Case of 2026

On January 1, 2026, USDT issuer Tether conducted on-chain blacklist (“Add Blacklist”) actions against six Tron and Ethereum addresses. Tracing the funds of one address in particular—TKWBiXWm8fNMBxBLaEXnQM1TPDbCLbZC7i—reveals that this enforcement action was related to cooperation with Israel’s National Bureau for Counter Terror Financing (NBCTF).

Its primary funding sources include multiple blockchain addresses that had previously been blacklisted. According to the NBCTF official website, four of these addresses appear on the Seizures of Cryptocurrency list under ASO 41/25, ASO 50/25, and ASO 51/25, and were frozen by Tether between August 4 and September 30, 2025.

More detailed administrative seizure orders indicate that all of these addresses are linked to terrorist financing activities.

War-Induced Sanctions and a Wave of Freezes

The military conflict between Israel and surrounding regions has entered its third year, and related enforcement actions have already extended into the blockchain domain.

Bitrace monitoring data shows that between 2021 and 2025, the Israeli government sanctioned a total of 1,687 blockchain addresses or exchange accounts. Nearly all administrative orders occurred during the 2023–2025 wartime period, with sanctioned targets primarily consisting of terrorist entities or their financing channels.

Further observation of certain stablecoin addresses indicates that the actual freezing of addresses generally occurred earlier than the public announcement of sanctions, suggesting that Tether had already intervened in law enforcement cooperation at an earlier stage.

Clearly, real-world regional conflicts are increasingly merging with on-chain financial warfare.

Staying Alert to Terrorist Financing Risks

During past investigations, we observed that crypto-based terrorist financing is often associated with cross-chain bridges, centralized exchanges, and crypto payment platforms. Large volumes of illicit funds are transferred and stored through these infrastructure channels, posing significant compliance risks to industry participants.

Using these sanctioned addresses as an example, further upstream fund analysis reveals a substantial number of small transfers originating from centralized exchanges, which are later aggregated and then transferred in batches to specific addresses and exchange accounts.

For exchange risk-control and compliance teams, it is critical to closely monitor users contaminated by such funds, in order to prevent legal investigations against the platform and mitigate potential compliance challenges arising from fund contamination.

Bitrace Intelligence

Bitrace is a Hong Kong–based regulatory technology company that has long cooperated with law enforcement and regulatory authorities across major jurisdictions worldwide in investigating cryptocurrency-related cases and incidents. Bitrace continuously monitors how illegal industries—including online gambling, money laundering, fraud, and other gray or black-market activities—exploit crypto infrastructure.

With a comprehensive threat intelligence database and rapid response capabilities, Bitrace helps clients effectively detect, anticipate, identify, and counter illicit fund threats, thereby avoiding potential legal and compliance risks.

Contact us:

Website: www.bitrace.io

Email: bd@bitrace.io

Twitter: @Bitrace_team

LinkedIn：@bitrace tech