Every major fiat-backed stablecoin ships with a kill switch. Tether and Circle can render the USDT or USDC in any wallet unspendable with a single contract call — no court order, no notice to the holder, no waiting period. It happens routinely: after exploits, after sanctions designations, after law-enforcement requests, sometimes within hours of the triggering event. For holders it is the least-understood risk in the asset class. For CASPs it is something more useful: a real-time risk signal that fires before any official list updates.
Here is how the freeze actually works at the contract level, how fast it moves in practice, what "frozen" does and doesn't mean, and what the realistic path back looks like.
The Kill Switch Built Into the Contract
Freezing is not an emergency procedure bolted on after the fact — it is a designed-in function of the token contracts:
- USDT exposes
addBlackList: once an address is blacklisted, it can no longer send USDT. A second function,destroyBlackFunds, lets the issuer burn the frozen balance outright — typically the prelude to reissuing recovered funds to law enforcement or verified victims. - USDC exposes
blacklist: a blacklisted address can neither send nor receive USDC. The check runs on both ends of every transfer.
The asymmetry is worth noting: a frozen USDT wallet can still receive tokens (which then also become unspendable), while a frozen USDC wallet is sealed in both directions. Even the function names differ — USDT's status check is isBlackListed, USDC's is isBlacklisted, a one-letter trap for anyone integrating both. The operational point: these are issuer-controlled, unilateral, and instant once the transaction confirms.
Bridged tokens are outside the kill switch
The blacklist lives in the issuer's native contract on each chain. Bridged or wrapped USDT/USDC — a representation minted by a bridge, not by the issuer — cannot be frozen by Tether or Circle directly. What the issuer can freeze is the native backing locked in the bridge contract on the home chain, which converts an address-level risk into a bridge-level one. For risk purposes: native and bridged versions of "the same" stablecoin have different freeze surfaces, and screening logic that treats them as identical is wrong.
How Fast It Happens in Practice
The freeze transaction itself takes one block. The variable is everything before it — the issuer's decision process. The observable pattern from public cases:
- Sanctions designations — when OFAC designated Tornado Cash in August 2022, Circle froze the USDC in the designated addresses within days. Issuers now track designation events as standing triggers.
- Exchange takedowns — when Garantex was hit by coordinated EU/US action in March 2025, Tether froze tens of millions of dollars of USDT connected to the exchange — a freeze that, by Garantex's own statement, forced it to halt operations.
- Exploits and theft — after major hacks, issuers routinely freeze identified destination addresses within hours to days of attribution, while the funds are still being laundered.
- Law-enforcement requests — Tether in particular has leaned into cooperation, working with agencies across dozens of jurisdictions and freezing billions of dollars cumulatively by its own count.
The caveat researchers keep documenting: the gap between a triggering event and the freeze transaction — even when it is only hours — is exactly the window professional launderers use. Funds that move before the blacklist transaction confirms are gone. That lag is also why the freeze event itself, once it lands on-chain, is such a high-value signal: it is the issuer telling the world, in public and machine-readable form, which addresses its compliance team just acted on.
What "Frozen" Actually Means
Three properties of a freeze that get misunderstood:
- It is per-chain and per-contract. An address blacklisted on Ethereum USDT is not blacklisted on TRON USDT, Solana USDC, or anywhere else — each native contract has its own list. Issuers usually sweep an actor's addresses across chains, but there is no technical link between the lists.
- It freezes the token, not the wallet. A wallet with frozen USDT can still move its ETH, its other tokens, everything else. The blacklist applies to one asset.
- It can end in destruction, not just detention. USDT's
destroyBlackFundsmeans a freeze is not necessarily a holding pattern — the balance can be burned and reissued elsewhere, which is how court-ordered recoveries of stolen funds are executed on-chain.
Getting Unfrozen: The Realistic Path
There is no on-chain appeal. The path back runs through the issuer's compliance team, and it looks like this:
- Contact the issuer's compliance channel — both Tether and Circle operate formal processes for freeze disputes
- Prove who you are and where the funds came from — full KYC plus source-of-funds documentation; an unhosted wallet with no transaction history context is a weak starting position
- Wait for the underlying matter to resolve — most freezes are tied to a law-enforcement request or a sanctions designation; the issuer will not release while that is open, which puts the realistic timeline at months, not days
- Accept the possible outcomes — release to the original holder (the innocent-bystander case — it happens, but it is the minority), burn-and-reissue to law enforcement or verified victims, or indefinite freeze
The structural irony: no court order is needed to freeze you, but in practice one is often needed to unfreeze you. Holders whose funds passed within a hop or two of a hack or a sanctioned cluster — even unknowingly — carry the burden of proving it.
Why CASPs Should Watch Freezes Like a List Feed
For a compliance team, the freeze event is not just the issuer's problem solved — it is intelligence. A freshly-blacklisted address is an address an issuer's compliance function, usually acting on law-enforcement or sanctions input, just classified as untouchable. That classification frequently precedes the corresponding entries on official lists — sometimes by days. A counterparty that gets frozen mid-relationship is a screening hit that no list-based check will surface yet.
How BA does it. BA monitors the blacklist events on the native USDT and USDC contracts across nine chains — seven EVM networks plus TRON and Solana — in real time, and treats freshly-frozen addresses as sanctions-equivalent risk flags from the moment the freeze transaction confirms. Screening and monitoring customers see the signal immediately, without waiting for the next official list update. For the regulatory side of stablecoins — reserves, redemption, EMT vs ART classification — see Stablecoin Regulation under MiCA; for where freeze signals fit in a screening programme, see Real-Time Sanctions Screening for CASPs.
Stablecoin Freeze: The Short Version
- Tether and Circle can freeze any address unilaterally, instantly, with one contract call
- USDT freezes block sending (and can end in
destroyBlackFunds); USDC freezes block both directions - Freezes are per-chain, per-contract, native-only — bridged tokens have a different freeze surface
- Triggers: sanctions designations, exchange takedowns, exploits, LE requests — hours to days from event to freeze
- Unfreezing runs through issuer compliance, takes months, and usually requires the underlying case to close
- For CASPs: treat on-chain freeze events as a real-time risk feed that fires before official lists update
Coming up in the "Tools for Compliance" series: #4 — KYT for Stablecoin Issuers, the other side of this story — the transaction-level workflow an issuer runs before its compliance team ever calls addBlackList.
Catch freeze events the moment they hit the chain — before the sanctions lists update
Screen wallets, monitor entities, and generate compliance reports with 1B+ labeled addresses and 305+ data sources.
See Screening Solutions