In April 2026, Tether announced that it had supported a freeze of more than $344 million in USDT across two addresses, in coordination with the U.S. Treasury's sanctions office and U.S. law enforcement — and, in the same statement, that it had frozen more than $4.4 billion to date across more than 2,300 cases, working with more than 340 law-enforcement agencies in 65 countries. A few years ago a stablecoin freeze was a news event. It is now a routine instrument, used at scale. This article is about what that instrument does inside a theft case — how a freeze on stolen funds comes to exist, what it changes for the victim, what it means for the person whose address the funds landed on, and which clock starts when. How stablecoin freezes work as a compliance and risk topic is covered by the AML product AMLOfficer; here we stay on the investigation.
What a freeze is, in one paragraph
A stablecoin is a token issued by a company under a contract that the company controls. That contract has a function which places an address on a blacklist; from that moment, the contract refuses any transfer out of the address. The tokens are not moved or taken — they are immobilised where they sit. The same contract lets the issuer destroy the immobilised tokens and issue the same amount elsewhere: frozen tokens may, in appropriate cases and subject to the issuer's procedures and applicable legal requirements, be burned and reissued as part of a recovery process. Every step is a public transaction on the chain: the freeze, the burn, the reissue. This is the property that separates a stablecoin from bitcoin, which has no issuer-level blacklist mechanism — a stolen bitcoin can be followed but not stopped in place.
How a freeze on stolen funds comes to exist
Seen from inside a case, a freeze is the end of a short chain of work, and each link has to be in place for the next one to happen.
The hashes on day one. A theft is reported with the transaction hashes and the addresses involved. Nothing else is needed to start — a human reads the case, not a form.
The trace. The stolen funds are followed across the chains they crossed — Ethereum, Bitcoin, Tron, BSC, Polygon, Solana — to the addresses where they sit now and the services they are heading for. Speed matters here for one reason: the funds have to still be where the trace says they are.
The flag. Within four hours of intake in our process, the stolen transactions are flagged to the screening providers that exchanges and issuers read, so the funds arrive anywhere with their history attached.
The request. Where the trace reaches a stablecoin balance, depending on the case and jurisdiction, a freeze request may be submitted to the issuer through law-enforcement or other accepted legal or compliance channels, supported by investigation materials — in our cases, our investigation report. We have no private channel into any issuer. What we can say is the observed response time in our own cases: typically 24 to 62 hours. If the funds reach a centralised exchange, a separate freeze and recovery process applies.
The police report. A police report or other formal law-enforcement documentation may support a longer-term or more formal freeze, depending on the issuer, exchange and jurisdiction.
The whole sequence, stage by stage, is on the recovery process page. The timings for the freeze stage are published per venue on our figures page. They describe the stage, not a service level, and a freeze is not a return. In our own case register (as of 9 September 2026, not independently audited), the freeze was already in place inside 48 hours in 42% of cases — a share of past cases, not a freeze rate and not a 48-hour service level.
What the freeze changes for the victim
Before this instrument existed, a stolen balance that reached a self-custody wallet was, in practice, gone: traceable, perhaps, but unstoppable. Now, if the stolen asset is a stablecoin or is swapped into one along the way, there is a party who can stop it and a procedure to ask them. A case that once ended at "we know where it went" now continues to "and it is frozen there" — and, where a freeze is obtained, the case proceeds into the applicable legal, law-enforcement or issuer recovery process.
That contains the most important distinction on this site. Frozen means stopped. A return, where one happens, comes later and on a different clock. For a stablecoin frozen by its issuer, the steps in our cases have been the issuer's response to the freeze request, then legal review, then — where a recovery through the issuer goes ahead — a first payout twelve to twenty months in, with full repayment in quarterly instalments to around two years. These figures describe our past cases, not a promise about any one case. The firms that quote the first clock as if it were the second are the reason victims are defrauded twice, and the verification checklist we publish exists to catch them. Where it applies, the burn-and-reissue path — lock, victim compliance, emission agreement, payout — is set out on the Tether emission page.
What it means for the address the funds landed on
The flag travels with the funds, not with the intent. So a freeze often lands not on the thief but on the address where the stolen funds became reachable: an OTC desk that filled a large order, a merchant paid by a customer, a payroll wallet, a trader on the other side of a P2P deal. The issuer does not know whether that address belongs to a launderer or a shopkeeper. It has stopped the funds and is waiting to find out.
What decides that question is documents, and one of them is a trace in the opposite direction: where the funds were before they reached the recipient, how many hops separate the recipient from the theft, and what the recipient checked before accepting them. A recipient who screened the incoming address at the time — screening as a service is what AMLOfficer, which was founded by StarCompliance, offers; AMLOfficer's AML check is the tool for it — and can show a real trade with an identified counterparty is in a far stronger position when the issuer or the authority reviews the case. One who cannot is in a weak one, and the difference was inside the recipient's control before the funds ever arrived. Where an authority requested the freeze, any release may depend on further instructions or legal process involving that authority, and the work typically moves to its jurisdiction: legal work, carried out in our cases by partner law firms. We do not practise law.
The objection, taken seriously
Here is the uncomfortable version. A private company decides, on its own assessment or on a request it is not obliged to publish, that a balance belonging to someone will not move. There is no hearing before the freeze; the owner is not told the basis; the company that froze the funds also adjudicates the request to unfreeze them. Judge, jury and executioner, in the phrase that is usually used.
Most of that is true, and three parts of it are less true than they sound. The freeze is not a confiscation: it is a hold, the tokens remain on the address, and confiscation happens later and elsewhere — in a court, through the same process as any other seizure. The freeze is not invisible: it is a public transaction, which is more than can be said for a bank's decision to hold a wire. And the decisions are, increasingly, not the issuer's alone: the freezes the issuers report are, in their own account, the product of cooperation with law-enforcement and sanctions authorities, and the release of those funds may depend on the requesting authority or a court.
What remains true, and is the fair criticism: the innocent recipient carries the cost. Someone who accepted funds in good faith, one hop away from a theft, can be frozen for months while a case they are not party to runs its course. That is a design gap, and the industry has not closed it. Our own answer is procedural rather than political: the recipient who screened, documented and can show the trade gives the issuer or the authority something to release on; the one who cannot gives them nothing.
What we take from it
We are a blockchain investigation and recovery firm; freezes are how our cases turn. That is a disclosure, not a neutral position, and it should be read as one. What we can say from the inside is that the mechanism works when it is fed properly — hashes on day one, a trace that reaches a party who can act, a request submitted through an accepted channel, with formal documentation behind it — and that it fails when it is fed late or fed nothing. How we approach a case from the first hour is on the recovery process page; the limits of what any firm can promise are on the verification page.
If the funds are traceable and the loss is significant, send us the transaction hashes: the assessment is free, and we aim to respond within two business hours, including when the answer is that there is nothing to pursue. Write through the contact page or message @StarCompliance on Telegram.
Questions we are asked about freezes in a theft case
My stolen USDT has been frozen. Is it coming back?
It is stopped, which is the stage after which the case becomes winnable — but a return is a separate event. Where the issuer's recovery process applies, it may end in a burn and reissue under an emission agreement, and in our cases the first payout has come twelve to twenty months in. Nobody can promise it, and anyone who does is quoting the freeze clock as if it were the return clock.
Can you get Tether to freeze the thief's address?
Not by ourselves. Depending on the case and jurisdiction, a freeze request may be submitted through law-enforcement or other accepted legal or compliance channels; what we provide is the investigation report — the trace and the transaction evidence that make it actionable. In our cases the issuer's response has typically arrived within 24 to 62 hours. We cannot compel it and we have no private channel; the procedure is the channel.
The funds were frozen on my address, but I bought them from a client. What now?
Then you are the recipient in someone else's case. What decides your position is who paid you, for what, what you checked at the time, and a trace showing where the funds were before they reached you. If an authority asked for the freeze, the outcome may depend on that authority and on legal process in its jurisdiction — work to do with counsel.
Why do freezes keep increasing?
Because every component is still growing: the number of agencies that know to ask and the speed of the tracing that supports a request. Recipient freezes are a real risk for businesses accepting stablecoins — which is why screening before a deposit, not after a freeze, is the control that matters.
Does a freeze mean the thief has been identified?
No. A freeze stops funds at an address; identifying who controls that address is separate investigative work, and often the frozen address belongs to an exchange account or a recipient rather than the thief. The freeze buys time for that work, it does not replace it.
Can an exchange freeze work the same way as an issuer freeze?
Not exactly. Both can restrict access to assets, but the technical mechanism, decision-maker, legal basis and recovery process are different. An issuer blacklists the address in the token's contract; an exchange holds a balance in an account it operates.
