Are there “dirty” USDT? We take a detailed look at the issue

In 2025, no one will be surprised that bitcoins or Ethereum can be “dirty.” AML practices have become tightly integrated into the crypto industry and are now followed by most digital asset users. But can USDT be “dirty”? We at GetBlock AML Research also asked ourselves this question and tried to figure it out.

The essence of the issue

Of course, at first glance, USDT may be “dirty.” That is, stablecoins can be used in illegal activities, and AML providers will place such coins and associated addresses in a special risk group.

HOWEVER, the issuer of USDT, Tether, has anticipated such situations. Therefore, the USDT smart contract provides for centralized management, i.e., the blocking of stablecoins at a specific address. If Tether receives confirmation that a specific address with stablecoins has been used in illegal transactions, the company can blacklist that address.

What happens if Tether blacklists an address with USDT:

• This will not affect the address itself in the blockchain, as the technology is decentralized;
• The owner of the address will be able to perform any transactions on the network (sending/receiving) funds in any other coins except USDT;
• USDT stored at the address will be completely blocked and cannot be sent/spent/exchanged.

Why is this necessary?

In this way, Tether has provided not only a blocking mechanism but also a burning mechanism. Blocked USDT that are on the blacklist are recognized as withdrawn from circulation (invalid). Therefore, Tether issues new coins to replace them.

According to Dune Analytics, as of December 22, 2025, more than $1,65 billion USDT had been blocked across 2654 addresses.

USDT blocking statistics.

How the blocking mechanism works

Adding illegal addresses to the blacklist is not a quick process. First, AML providers need to confirm the address’s connection to criminal activity. Then they need to transfer the data to Tether. Only after that will Tether make a decision about blocking. Several employees are needed to execute such a decision, as adding an address to the blacklist requires a multisig.

Due to all the organizational and bureaucratic costs, this process takes several days at best. Sometimes such decisions are delayed for weeks or months.

Criminal loophole: how to bypass the blocking of Tether’s USDT

Suddenly it turned out that transactions on the blockchain do not happen instantly. Tether had to make excuses for this

Читать дальше

Priority on volumes

As a rule, there is a positive correlation between the speed of blocking “dirty” USDT and the volume of stolen funds. In other words, the more money that has been stolen, the faster AML providers and Tether will try to prevent the laundering of these funds. For example, in the summer of 2025, Tether froze $1,6 million USDT that was used by terrorists in the Gaza Strip.

But there are exceptions. One of them was the most high-profile hack of 2025 — the compromise of the Bybit wallet for $1,5 billion. At that time, only 3% of the stolen funds were frozen; the rest were laundered within 10 days, and Tether was unable to prevent this. Professional hackers prefer to transfer funds from USDT and other similar stablecoins to ETH as quickly as possible to avoid having their assets blocked.

How to launder $1,5 billion worth of crypto in 5 easy steps. Lazarus Group case

Crypto exchange Bybit managed to block only $42,8 million. This is less than 3% of the total value of stolen assets

Читать дальше

Open question

After hackers quickly “dump” the stolen USDT, they remain “dirty,” but the question of blocking them no longer arises, as such coins end up with unsuspecting users or service providers. As a result, Tether finds itself in a difficult position: it is no longer possible to block such funds, but it is also impossible to cancel transactions on the blockchain. AML providers still do not have a single algorithm for action in such situations, so in each individual case, a decision is made on a case-by-case basis, based on various conditions.

Bridges for criminals

In 2025, cross-chain bridges began to be used on a massive scale to launder illegally obtained cryptocurrency.

A cross-chain bridge is used to transfer assets from one blockchain to another. The technology works as follows: in one blockchain (from which the assets are to be transferred), the funds are locked in a special smart contract and then used as collateral. In another blockchain (to which the assets are to be transferred), new coins are issued

When laundering funds stolen from Bybit, tens of millions of USDT were moved to cross-chain bridges and locked as collateral. In exchange for these coins, the hackers received completely clean assets on another network. But then, the “dirty” USDT that was used as collateral wasn’t locked and marked as “dangerous” by AML providers. There are a few reasons for this:

1. The assets were locked in a smart contract and weren’t available for any transactions.
2. The funds went to a service provider who was unaware of their illegal origin.

The main trend in cryptocurrency laundering in 2025: cross-chain transfers

Cybercriminals have significantly complicated the process of legalizing illegally obtained cryptocurrency in 2025

Читать дальше

Case study

Will my 100/1000 USDT be considered “dirty” if they were stolen by hackers or fraudsters?

Answer: Probably not. Even if you contact law enforcement, who will open a case and contact Tether, the process will take weeks or possibly months. During this time, the attackers will exchange the stolen USDT for other cryptocurrencies. And your USDT will end up with another user who is unaware of its origin.

This opens up opportunities for criminals to launder funds obtained illegally. Especially when it comes to relatively small amounts and ordinary individuals.