A lag in Tether’s wallet blacklisting process allowed over $78 million in illicit funds to be moved before enforcement actions took effect, according to a new report from blockchain compliance company AMLBot.
Tether’s address blacklisting becomes effective only after a considerable delay from when the process is initiated on Ethereum and Tron, according the report published May 15.
“This delay originates from Tether’s multisignature contract setup on both Tron and Ethereum, transforming what should be an immediate compliance action into a window of opportunity for illicit actors,“ the report reads.
Tether’s blacklisting procedure is a multi-step process with a first transaction effectively warning of the upcoming blacklisting. First, a Tether administrator multisignature transaction submits a pending call to “addBlackList” on the USDT-TRC20 contract.
This results in a public “submission” of the target address as a blacklist candidate. This is followed by a second multisignature transaction confirming the submission, resulting in an “AddedBlackList” emission, making the blacklisting effective.
In one example shared with Cointelegraph, an onchain transaction submitting a Tron address as a blacklist candidate took place at 11:10:12 UTC. The second transaction that actually enforced the action did not occur until 11:54:51 UTC on the same day, a 44-minute delay.
In practice, this delay can be treated by owners of USDt about to be blacklisted as a notice to move their assets to avoid them being frozen. The report stated:
“This delay between a freeze request and its on-chain execution creates a critical attack window, allowing malicious actors to front-run enforcement and move or launder funds before the freeze takes effect.“
Example of USDt blacklisting transactions. Source: AMLBot
The report says that “for blockchain-savvy attackers, these delays are golden.” By tracking Tether’s calls in real time, a fraudster can be instantly alerted that their address is being targeted. When asked by Cointelegraph whether the delay is a technical limitation or just a delay in the actions of a multisignature wallet key holder, AMLBot researchers said that they cannot determine it without knowledge of Tether’s internal procedures.
In a statement to Cointelegraph, a Tether spokesperson explained that “while any delay in enforcement should be examined, the idea that this represents a systemic loophole is both misleading and lacking perspective.” According to the company, it collaborates with Law Enforcement to freeze addresses on a daily basis.” The statement continues:
“Tether operates on public blockchains, where all activity is visible — unlike fiat currencies that move in secret through traditional banks. This transparency allows Tether, in collaboration with over 255 law enforcement agencies across 55 countries, to track, trace, and freeze illicit funds faster than most realize.“
Tether representatives also cited one case when they were able to freeze 106,000 USDT tied to the ByBit hack, whereas Circle took much longer to freeze 115,000 USD Coin (USDC).The discrepancy was pointed out by pseudonymous sleuth ZachXBT in an X post answering the Circle CEO CEO Jeremy Allaire.
Tether’s spokesperson explained that “the delay cited in the report stems from our multi-signature governance model, designed to prevent unilateral freezes and protect the integrity of our system.” They admit that this introduces a delay, “but it’s a trade-off for responsible responsiveness to a $100+ billion ecosystem” and improvements are on the way:
“We are actively refining this process to work to eliminate any potential advantage for bad actors. If you think you can use Tether to move illicit funds, think again.“
AMLBot said its data shows that over $28.5 million in USDT was withdrawn during the delay between the two transactions on the Ethereum blockchain. This amount of freeze avoidance occurred between Nov. 28, 2017, and May 12, 2025. The average amount moved during the delay exceeded $365,000.
Similarly, $49.6 million was reportedly withdrawn during freeze delay windows on the Tron blockchain, resulting in a total on Ethereum and Tron of $78.1 million. Exploiting this delay on Tron is not particularly rare, according to AMLBot:
“170 out of 3,480 wallets (4.88%) on Tron blockchain exploited the lag before getting blacklisted. Each of these wallets made 2–3 transfers during the delay, withdrawing: Average: $291,970.“
A Tether spokesperson told Cointelegraph that “the $76 million referenced in this report should be put in context of the more than $2.7 billion in USD₮ that Tether has successfully frozen and blocked to date.” They added
Tether has previously promoted its ability to freeze assets as a compliance feature. In 2024, Tether, Tron, and analytics firm TRM Labs cooperated to freeze over $126 million in USDT linked to illicit activity.
Still, the AMLBot report raises questions about the effectiveness and speed of those enforcement actions.
Norman Tebbit, the former Tory minister who served in Margaret Thatcher’s government, has died at the age of 94.
Lord Tebbit died “peacefully at home” late on Monday night, his son William confirmed.
One of Mrs Thatcher’s most loyal cabinet ministers, he was a leading political voice throughout the turbulent 1980s.
He held the posts of employment secretary, trade secretary, Chancellor of the Duchy of Lancaster and Conservative party chairman before resigning as an MP in 1992 after his wife was left disabled by the Provisional IRA’s bombing of the Grand Hotel in Brighton.
He considered standing for the Conservative leadership after Mrs Thatcher’s resignation in 1990, but was committed to taking care of his wife.
Image: Margaret Thatcher and Norman Tebbit in 1987 after her election victory. Pic: PA
Tory leader Kemi Badenoch called him an “icon” in British politics and was “one of the leading exponents of the philosophy we now know as Thatcherism”.
“But to many of us it was the stoicism and courage he showed in the face of terrorism, which inspired us as he rebuilt his political career after suffering terrible injuries in the Brighton bomb, and cared selflessly for his wife Margaret, who was gravely disabled in the bombing,” she wrote on X.
“He never buckled under pressure and he never compromised. Our nation has lost one of its very best today and I speak for all the Conservative family and beyond in recognising Lord Tebbit’s enormous intellect and profound sense of duty to his country.
“May he rest in peace.”
Image: Lord Tebbit and his wife Margaret stand outside the Grand Hotel in Brighton. Pic: PA
Tory grandee David Davis told Sky News Lord Tebbit was a “great working class Tory, always ready to challenge establishment conventional wisdom for the bogus nonsense it often was”.
“He was one of Thatcher’s bravest and strongest lieutenants, and a great friend,” Sir David said.
“He had to deal with the agony that the IRA visited on him and his wife, and he did so with characteristic unflinching courage. He was a great man.”
Reform leader Nigel Farage said Lord Tebbit “gave me a lot of help in my early days as an MEP”.
He was “a great man. RIP,” he added.
Image: Lord Tebbit as employment secretary in 1983 with Mrs Thatcher. Pic: PA
Born to working-class parents in north London, he was made a life peer in 1992, where he sat until he retired in 2022.
Lord Tebbit was trade secretary when he was injured in the Provisional IRA’s bombing in Brighton during the Conservative Party conference in 1984.
Five people died in the attack and Lord Tebbit’s wife, Margaret, was left paralysed from the neck down. She died in 2020 at the age of 86.
Before entering politics, his first job, aged 16, was at the Financial Times where he had his first experience of trade unions and vowed to “break the power of the closed shop”.
He then trained as a pilot with the RAF – at one point narrowly escaping from the burning cockpit of a Meteor 8 jet – before becoming the MP for Epping in 1970 then for Chingford in 1974.
Image: Lord Tebbit during an EU debate in the House of Lords in 1997. Pic: PA
As a cabinet minister, he was responsible for legislation that weakened the powers of the trade unions and the closed shop, making him the political embodiment of the Thatcherite ideology that was in full swing.
His tough approach was put to the test when riots erupted in Brixton, south London, against the backdrop of high rates of unemployment and mistrust between the black community and the police.
He was frequently misquoted as having told the unemployed to “get on your bike”, and was often referred to as “Onyerbike” for some time afterwards.
What he actually said was he grew up in the ’30s with an unemployed father who did not riot, “he got on his bike and looked for work, and he kept looking till he found it”.
The first European state visit since Brexit starts today as President Emmanuel Macron arrives at Windsor Castle.
On this episode, Sky News’ Sam Coates and Politico’s Anne McElvoy look at what’s on the agenda beyond the pomp and ceremony. Will the government get its “one in, one out” migration deal over the line?
Plus, which one of our presenters needs to make a confession about the 2008 French state visit?