Few things stall a stablecoin recovery case faster than a badly prepared evidence file. The holder knows their USDT was frozen, knows roughly when, and then sends a law firm three screenshots and a transaction hash typed by hand. What an issuer like Tether, or an exchange compliance desk, actually needs is narrower and more specific than most people expect. This is the practical list, based on matters we have run through partner counsel across multiple jurisdictions.
The wallet facts, stated precisely
Start with the frozen address written out in full, in text, not as an image. Copy-paste it from your wallet software rather than retyping it. A single wrong character at the start or end of a Tron or Ethereum address invalidates everything downstream. State the network explicitly: USDT exists as distinct assets on Tron (TRC-20), Ethereum (ERC-20), BNB Chain, Polygon, Arbitrum, Solana and others, and issuers track each chain separately. A freeze on one network does not exist on the others, so “my USDT is frozen” is an incomplete sentence to a compliance officer.
Then the transaction hashes. Every inbound transaction to the frozen balance should be listed with its hash, the sending address, the amount, and the date in UTC. For Tron matters, include the block number. If the balance accumulated over dozens of small receipts, such as exchange withdrawals or customer payments, summarize them in a table and attach the raw list. OTC and P2P sellers often cannot reconstruct this quickly, which is exactly why it should be prepared before the matter opens, not after.
Proof of ownership, done the way issuers accept
An issuer will not discuss a balance with someone who merely claims to own it. The standard is a signed message from the frozen address. In most wallets this is a “sign message” function that produces a cryptographic signature verifiable against the address. Sign a fixed phrase, for example your case reference and the date, and record the signature string. If the wallet type cannot sign messages, a documented test transaction pattern agreed with counsel can sometimes substitute, but that is decided case by case.
Alongside the signature, include KYC-grade identity material: passport or national ID copy, proof of address under three months old, and, for corporate wallets, the incorporation certificate and the signature authority of whoever signs the mandate. Businesses freezing a treasury wallet should read our earlier piece on building the release file before assembling this.
The freeze evidence itself
You need to show the freeze exists and, if possible, where it came from. On Tron, a frozen or blacklisted address shows the restriction directly in block explorers such as Tronscan, which list the issuer-level status of an address. Screenshot those pages with the URL bar visible and note the capture date, because issuers do update statuses and you want the record pinned in time. On Ethereum, issuer blacklists are visible as events from the USDT contract, so record the contract interaction that touched your address.
If an exchange told you about the freeze, keep the correspondence verbatim, including case numbers. If you received something that looks like a freeze notice, verify it before acting: as we covered in our guide to real enforcement mail versus impersonation, plenty of “your funds have been frozen” emails are the prelude to a recovery scam, not a real enforcement action. A genuine issuer or law-enforcement freeze rarely arrives with an urgent request to send funds somewhere.
The narrative timeline, in one page
Write a chronological account of how the balance was acquired and why the freeze is mistaken or overbroad: where the funds came from, what you sold or were paid for, which exchanges you withdrew through, and anything that plausibly explains a tainted incoming transfer. One page, plain language, dated. Enforcement freezes often originate from one contaminated inbound transaction years earlier; a clear acquisition history is what lets counsel argue the rest of the balance is clean. For the distinction between a targeted freeze and a chain-level blacklist, see freeze versus blacklist, because the two carry very different recovery prospects.
Putting the file together
Assemble it as one folder with a one-page index: identity, ownership proof, wallet facts, transaction list, freeze evidence, narrative, and correspondence. Name files plainly, such as 04-transaction-list-tron.csv, so nobody at the issuer or exchange has to guess. Convert screenshots to a single dated PDF and keep the originals. If counsel engages forensic analysts, the raw transaction exports you prepared are what they will build on, and having them ready compresses the timeline by weeks.
One more thing worth deciding early: whether the matter runs through the issuer directly, the exchange where funds sit, or a court application through local counsel. The same evidence file serves all three routes, but the covering letter differs. That decision depends on where the freeze originated and how much is at stake, which is a conversation for a qualified adviser, not a template.
What not to send
Do not send private keys or seed phrases to anyone, including us. A recovery matter never requires them. Do not send unredacted bank statements covering unrelated accounts. Do not pay “release fees” to anyone who contacted you first. And do not open parallel negotiations with the issuer, the exchange and an anonymous intermediary all at once; contradictory filings make the eventual release slower, not faster.
If your USDT or USDC is frozen and you are assembling a matter, the intake starts with exactly these items, and you can begin from the case notes on this blog. Prepare the file once, properly, and counsel can move on day one instead of week three.