People discover their address is frozen and assume a government has taken the money. On most chains the truth is stranger: the tokens are still there, fully visible, and completely immovable.
When Tether freezes a USDT address, no tokens move anywhere. There is no wallet emptied into a government account, no transaction sweeping the funds away. What happens is a single function call on the token contract that flips a flag, and from that moment the contract refuses every transfer out of that address. The balance still shows in explorers. The address can even receive more USDT. It just cannot send a single token until someone with the issuer’s authority calls the unfreeze function.
Understanding that distinction matters, because it changes what you should do next, what you can honestly tell an exchange or a lawyer, and how long the process can reasonably take.
Freezing is a feature of the token contract, not of the blockchain
USDT is a centrally issued token. The contract includes an admin role that can add addresses to a blacklist, and the transfer functions check that blacklist before moving anything. On Ethereum and Tron, the two chains where most frozen USDT sits, this is enforced at the contract level with no exceptions and no override by miners or validators. A block producer cannot process a transfer from a blacklisted address even if one is somehow submitted.
This is also why moving it to another wallet first does not work, and why nobody can move the funds for you. The freeze attaches to the address, and the contract is the only thing that could move the tokens. Any service claiming it can extract frozen USDT for an upfront fee is lying to you, full stop. The only paths off a blacklist run through the issuer or a legal order compelling the issuer.
Who actually freezes addresses
Blacklist additions come from a small number of sources:
- Law enforcement requests, where Tether is served process connected to an investigation. These are the majority of large-value freezes, and Tether publishes quarterly reports showing the volume of cooperation requests it handles.
- Sanctions compliance, where an address is attributed to a sanctioned entity or jurisdiction and blocking is a legal requirement rather than a judgment call.
- Exchange-initiated reports, where a platform’s fraud team traces stolen deposits to an address and asks the issuer to freeze ahead of a formal claim.
- Issuer risk operations, addresses tied to counterfeit-token scams, phishing drainers or contract exploits.
The practical consequence: a freeze usually means someone, somewhere, has already built a file that touches your address. It may be thin, it may be mistaken, but it exists, which is why the response that works is documentation, not improvisation. The evidence anatomy piece covers exactly what goes into a release application.
Why the funds stay visible the whole time
A frozen balance still appears in every explorer, still counts in the address’s net worth on tracking sites, and still responds to balance queries. This produces a specific and very common trap: victims of a scam see the scammer’s frozen address holding their money, assume it is safe, and stop pushing. A freeze preserves funds, but it does not return them. Returning them needs either an unfreeze directed to a restitution address or a burn-and-mint, where the frozen tokens are destroyed and equivalent fresh tokens are issued to verified victims. Both are issuer actions taken on legal instruction, and both take weeks to months, not days.
The honest timeline: from a complete, well-documented application supported by a police report or court order, expect response times measured in weeks, and expect requests for supplementary documents at least once. Anything promising release in 48 hours for a fee is a recovery scam targeting people who are already victims.
What freezing does NOT do
- It does not convert the tokens to any government’s custody. Seizure, in the legal sense, is a separate step that may follow a freeze or may never happen.
- It does not freeze other assets at the same address. ETH, TRX or NFTs in the same wallet remain fully movable unless separately restrained.
- It does not notify you. There is no email from the contract. Most people learn of a freeze when a transfer reverts or an exchange flags their deposit history.
- It does not expire. Blacklist entries do not time out. Without action, a frozen address stays frozen indefinitely.
That last point is why doing nothing is the worst available strategy. Files go stale, exchanges purge transaction logs, and the counterparty you may need to identify becomes harder to trace every month. If your funds are the proceeds of legitimate activity, the case for acting quickly is not urgency theatre, it is evidence decay.
The one question that decides your path
Before anything else, work out which side of the freeze you are on, because the paths are completely different:
- You received funds that were later frozen. Your issue is proving source. Where did the USDT come from, what did you sell or settle for it, and what documents show it? The unexpected-deposit trace guide covers building that trail.
- Your funds were taken and moved to an address that is now frozen. Your issue is recognition as a victim, which means a police report referencing the frozen address and a claim filed with the issuer through counsel or the exchange that reported it.
- You are being investigated. Nothing you do on-chain helps. Get a lawyer with digital-asset experience before you communicate with anyone, and read the blacklist release process overview only so you understand the vocabulary.
In all three cases the mechanism is the same, a flag on a contract that only the issuer can lift, and in all three cases the currency that moves the process is verified documentation, not on-chain cleverness. The chain is where the freeze lives. The unfreeze lives in paperwork.