USDT/USDC Blacklist vs AML Risk Score: Who Can Actually Freeze Crypto?

On 23 April 2026, $344 million in USDT stopped moving. Tether blacklisted two addresses on Tron after several U.S. authorities passed it information about activity tied to unlawful conduct, in coordination with OFAC and other law enforcement agencies. The company said this kind of action has become a routine part of its response to lawful requests.

(Source: Tether, "Tether Supports Freeze of More Than $344 Million in USD₮ in Coordination with OFAC and U.S. Law Enforcement," 23 April 2026 — https://tether.io/news/tether-supports-freeze-of-more-than-344-million-in-usdt-in-coordination-with-ofac-and-u-s-law-enforcement/)

Now consider what did not happen. No blockchain analytics tool froze those funds. No risk score reached into a smart contract. Analytics may well have flagged those addresses long before April, and other addresses with similar exposure profiles are still perfectly transferable today. The freeze happened because a specific actor — the token issuer — held an administrative capability over its own contract and received information through a legal channel that prompted it to use that capability.

That gap is the subject of this article, and it causes more confusion than almost anything else in crypto compliance. Someone screens a wallet, sees High Risk, and asks the obvious next question: can the analytics provider, an exchange, or somebody else now freeze this wallet?

Not because of the score itself. A risk score is information. For an actual restriction to happen, a separate actor must have one of three things: custody or control over the funds or the account, administrative control over the token contract, or a legal obligation or order that an actor with the relevant control can implement.

So a wallet receives a High Risk result and nothing changes on-chain. Separately, and for reasons that may or may not correlate with that score, an exchange might decide to hold an incoming deposit, a stablecoin issuer might blacklist the address, a regulated institution might have sanctions-blocking obligations toward it, or a court process might require a custodian to restrict assets. Four different mechanisms, four different actors, one word covering all of them.

The principle underneath: the system that identifies risk is usually not the system that controls the funds.

An AML Risk Score Cannot Freeze a Crypto Wallet

Start with what screening actually does. Wallet screening and transaction screening evaluate data that is already public or already held — transaction history, exposure to source and destination clusters, connections to known entities, sanctions-related links, exposure to stolen funds, contact with scam, mixer or darknet categories, and behavioural patterns across a wallet's activity.

The output of that analysis is a risk level, a category, an alert, or some other compliance signal. Useful things. But producing them gives the analytics provider none of the following: a private key, custody of any asset, control over an exchange account, administrative rights on a smart contract, or any legal ownership interest in the funds being assessed. Screening is a read operation on a public ledger combined with an attribution database. It has no write path to the blockchain at all.

Therefore High Risk ≠ Frozen. Those are statements about two entirely different systems, and this holds even at the sharper end of the risk spectrum. A screening result showing a direct sanctions-related connection is still analytical information until a legal or compliance actor determines what obligations actually apply to a specific transaction, a specific counterparty and a specific business. The tool describes; it does not compel. This is the practical consequence of the point made in why a crypto wallet risk score is a signal rather than a legal verdict.

For a business, a score is an input into decisions that the business then makes. It can trigger manual review, a request for additional information, a pause in internal processing, escalation to a compliance officer, or rejection of a transaction under an existing policy. Every one of those actions is taken by the business, using the score, under its own policy and legal obligations — not by the score itself.

For an individual the practical use is narrower but real: you can check a crypto wallet or transaction for AML risk before deciding whether to accept a payment or send funds to a counterparty, which is a decision you control. What you cannot do is use that result to restrict somebody else's assets, and nobody can use it to restrict yours.

"Frozen Crypto" Can Mean Several Different Things

People use one word for at least six distinct events. Separating them is most of the work.

1. AML Risk Flag

• Who Acts: an analytics system or a compliance team reading its output.
• What is actually restricted: nothing automatically.
• Is the wallet itself frozen? No.

2. Exchange Deposit Hold

• Who acts: the exchange or custodian.
• What is actually restricted: access to a deposit or to account functionality inside the platform's own systems.
• Is the wallet itself frozen? Usually not — the on-chain transaction has already confirmed, and the sending address is unaffected.

3. Exchange Withdrawal Restriction

• Who acts: the exchange or custodian.
• What is actually restricted: the custodial account balance or the ability to withdraw from it.
• Is the wallet itself frozen? No external wallet is frozen by this action.

4. USDT or USDC Issuer Blacklist

• Who acts: the stablecoin issuer.
• What is actually restricted: transfers of that issuer's token at the affected address, on the supported contract.
• Is the wallet itself frozen? No — this is a token-specific restriction.

5. Sanctions Blocking

• Who acts: a regulated person or entity holding the property in its possession or control.
• What is actually restricted: sanctioned property, as required by applicable law.
• Is the wallet itself frozen? It depends entirely on who controls the asset.

6. Court or law-Enforcement Order

• Who acts: an issuer, custodian or other controlled party implementing the order.
• What is actually restricted: the assets specified by valid legal process.
• Is the wallet itself frozen? It depends on what technical mechanism the implementing party actually has.

The phrase "my wallet was frozen" is therefore imprecise in most of the situations where people use it. Take the common case. An exchange restricts an account holding BTC, ETH and USDT. What it has restricted is the custodial account and the balances recorded inside its own ledger. It has not disabled the customer's external Bitcoin or Ethereum address, and it could not do so if it wanted to. An exchange can restrict what it holds; the customer's separate self-custody address keeps working exactly as before. That distinction is why it helps to understand why an exchange can hold a crypto deposit after AML screening as an internal custody decision rather than a blockchain event.

Now run it the other way. A USDC issuer blacklist can prevent USDC from moving at a specific on-chain address without touching anything else held at that address. The result is a wallet that might contain USDC that cannot be transferred because of an issuer blocklist, alongside ETH that the private-key holder can still move normally. Same address, two different answers. One caution on all of this: token contracts differ across chains and versions, and issuers deploy on many networks. Nothing here should be read as an absolute claim about every deployment of every token.

Why USDT and USDC Can Be Frozen Differently From BTC or ETH

USDT and USDC are issuer-managed stablecoins, and that changes what is technically possible. On supported blockchain deployments, the issuer-controlled smart contract can include administrative functions that allow specific addresses to be restricted from transferring the issuer's token.

This is not hidden. Circle's USDC terms state that it reserves the right to block certain addresses and freeze associated USDC that it determines may be associated with illegal activity, and that it may also be required to freeze USDC if it receives a legal order from a valid government authority requiring it to do so.

(Source: Circle, USDC Terms — https://www.circle.com/legal/usdc-terms)

Tether operates the equivalent capability and reports on its use publicly, as the April 2026 action described at the top of this article shows. The point is not to compare the two issuers or to rank them by centralisation — the freeze data, the Tether-versus-Circle comparison and the burn and reissue patterns are covered in depth in how USDT and USDC stablecoin blacklists work in practice. The point is structural: an issuer can restrict the token it issued.

What that capability does not extend to is everything else. An issuer blacklist gives Tether or Circle no control over BTC held in the same wallet, no control over ETH held in the same wallet, no control over unrelated ERC-20 or TRC-20 tokens sitting at the same address, and no access to the private keys themselves. The restriction is scoped to the contract the issuer administers.

For a native crypto asset, there is no equivalent. Bitcoin has no central issuer with a blacklist function, and no party can call an administrative method to stop a BTC address from transacting. That does not make BTC immune from restriction, though — it relocates where restriction can happen. Bitcoin held at an exchange, a custodian or another regulated intermediary can be restricted by that intermediary, because the intermediary controls the keys. The asset type determines which layer the restriction can occur at, not whether restriction is possible at all.

There is a related trap worth naming. Because issuers can freeze, some businesses treat that capability as a safety net and skip screening on incoming stablecoin payments. Those two things solve different problems. Screening answers whether you should interact with these funds at all, before you accept them. An issuer freeze answers whether a specific token can still move from or to a restricted address, usually long after the fact and never on your schedule. This is the reasoning behind why issuer freezes do not replace screening before accepting USDT.

Sanctions and Court Orders Are Legal Triggers, Not Risk Scores

Sanctions are where the confusion gets expensive, because a sanctions match looks superficially like a high risk score inside the same compliance software. OFAC can and does list digital currency addresses associated with blocked persons, publishing them as identifiers on the SDN List. But listing an address does not rewrite blockchain state and does not remotely take possession of anyone's private key. The legal effect runs through people, not through the protocol: U.S. persons must block property and interests in property of blocked persons when that property is within their possession or control, and blocking means denying access to the property and prohibiting dealings in it.

(Source: OFAC, Sanctions Compliance Guidance for the Virtual Currency Industry — https://ofac.treasury.gov/media/913571/download)

That structure produces different technical outcomes depending on where the funds happen to sit:

• held at an exchange or custodian — the custodian can block the account and the assets it controls, because it holds them;
• held as an issuer-controlled stablecoin — the issuer may have the technical capability to restrict transfers of its token at that address;
• held in non-custodial native crypto — legal restrictions bind regulated persons who interact with the property, but there is no central switch that disables the blockchain address itself.

The distinction to carry out of this is that a sanctions designation creates a legal compliance obligation on identifiable parties, while an AML score is an analytical signal for a decision that remains yours. They can appear in the same dashboard and require completely different responses, which is the reason how sanctions screening differs from an AML risk assessment is worth treating as a separate discipline rather than a stricter tier of the same one.

Court orders and law enforcement processes follow the same logic. The order creates authority or obligation; another actor implements it using whatever control that actor has. A judge cannot modify a smart contract. A judge can order a party that administers a smart contract to use the functions it already has.

U.S. law now says this out loud for payment stablecoins. The GENIUS Act defines a "lawful order" as a final and valid order issued under federal law by a court of competent jurisdiction or an authorised federal agency that requires a person to seize, freeze, burn or prevent the transfer of payment stablecoins they issued, and that specifies the stablecoins or accounts subject to blocking with reasonable particularity. A permitted payment stablecoin issuer may only issue if it has the technological capability to comply with such an order, and will comply.

(Source: GENIUS Act, Public Law 119-27, §2(16) and §4(a)(5) — https://www.congress.gov/bill/119th-congress/senate-bill/1582/text)

Two caveats attach to that. Most of the GENIUS regime is not yet generally effective — implementing rules were still in proposal form through 2026, with January 18, 2027 the expected effective date — so this is a statutory illustration of the legal architecture rather than a description of obligations already binding today. And the statute does not mean every stablecoin freeze happens only after a court order; issuers act on their own terms of service in other circumstances too.

What the statute does illustrate cleanly is the three-layer separation: risk analysis identifies, lawful authority orders, and the issuer or custodian technically implements.

The March 2026 USDC episode is a compact real-world version of that sequence. A sealed civil proceeding in a New York court led Circle to use its USDC blocklisting capability against a set of specified addresses — several of which turned out to be operational business hot wallets rather than the accounts of any obvious wrongdoer, disrupting unrelated platforms and, in one case, a bridge contract. The order came from a court; the technical action came from the issuer; the collateral effects landed on parties who had no involvement in the case. The specifics of how a court-related USDC blacklist affected operating crypto wallets are worth reading for anyone who assumes freezes are always precisely targeted.

What Happens When a Wallet Is Flagged but Not Frozen

Set against all of this, it is worth being clear about the ordinary case: most AML flags never become issuer blacklists, and never come close. The usual path is short. A risk signal goes to a business, the business reviews it, and the business makes a compliance decision. Depending on context, that ends with a user seeing a Medium or High Risk result and choosing not to transact, a merchant declining a payment, an exchange placing a deposit under review, a compliance team requesting source-of-funds information, a business escalating a possible sanctions match internally, a transaction being declined under policy — or, very often, nothing further happening at all once the review closes.

Only in some cases does the process reach the next layer, where a legal, sanctions or investigative trigger leads a custodian or an issuer to act. That escalation is the exception, not the default continuation of a flag. The distinction matters because a user who sees High Risk frequently assumes their crypto is already frozen. It usually is not. All of the following are ordinary, coexisting situations:

• a wallet with a High Risk score whose tokens remain fully movable;
• a wallet with a clean historical score that later becomes subject to a new legal or issuer restriction;
• an exchange account under hold while the customer's external wallet keeps functioning normally.

Which is why risk status, legal status, custody status and token transferability are four separate questions. Answering one tells you very little about the other three.

Practically, that translates into different responses depending on which situation you are actually in. Before sending or accepting funds, screening is the tool that supports your own risk decision, and it works best before the transaction rather than after. If an exchange has already restricted a deposit, the route runs through that platform's compliance process, and knowing what to do when a crypto deposit is already under AML review is more useful than re-screening the address. If an issuer has actually blacklisted a stablecoin address, no AML report or clean score removes that blacklist — the issuer applied it and only the issuer can lift it. And if a sanctions designation or legal order applies, the relevant legal process determines what can happen next.

One thing this article will not offer is a method for moving assets ahead of a restriction or working around a blacklist. Those are not compliance strategies.

Ask Who Controls the Asset, Not Who Flagged the Risk

When somebody says their crypto was frozen because of AML, the useful first question is narrower than it sounds: what exactly was frozen, and by whom?

Five actors, five different capabilities:

• an AML analytics provider identifies risk and produces a signal;
• an exchange or custodian can restrict accounts, deposits and assets under its own control;
• a stablecoin issuer may be able to restrict transfers of its own token through issuer-controlled contract mechanisms;
• a sanctions authority, court or law enforcement agency creates legal obligations or orders that relevant actors may need to implement;
• the blockchain itself records transactions according to protocol and does not interpret AML scores at all.

A risk score can influence a freeze decision. It is not the freeze mechanism. To understand whether crypto can actually be moved, ask who controls the relevant asset or account, what legal obligation applies to that party, and what technical mechanism is available to them.

FAQ