Security analyst calls out exploit window in Tether's on-chain freeze process

Darcy, a blockchain asset-recovery investigator and co-founder of FlashRescue, has revealed that targeted money slipped out of a wallet while Tether was in the middle of freezing it.

So far in 2026, Circle has faced multiple rounds of criticism for freezing flagged or stolen funds too rarely. And now, Tether, which has long been praised for freezing funds, is receiving criticism for how cleanly the freezes it does run actually execute.

What is Tether being criticized for?

Darcy from FlashRescue, who posts on X (formerly Twitter) as @DarcyAri and works on joint investigations with partner firms, wrote on August 6, 2026, that during a recent case, the flagged funds at one address were allowed to be moved even as the freeze was being carried out by Tether. That delay reduced the total amount that they could freeze.

The stablecoin issuer has long been praised for its speed in freezing funds, especially compared to its main rival, Circle (USDC). However, this new criticism suggests that during the execution of Tether’s freezes, there is a significant time gap between proposal and finalization on the blockchain.

Circle’s problem has been inaction. CEO Jeremy Allaire told a press conference in Seoul that the USDC issuer will only freeze a wallet “at the direction of law enforcement or the courts.”

On-chain investigator ZachXBT has pointed to more than a dozen cases since 2022, including the roughly $280 million Drift Protocol exploit tied to North Korea, where Circle sat on its freeze power, and about $420 million in illicit funds got away.

Wisconsin prosecutors filed a criminal complaint against Circle after it said it could not comply with a warrant to recover a scam victim’s USDC.

Is there really a gap in Tether’s freeze execution? 

An analysis of 2,955 Tether freeze events on the Ethereum and TRON networks revealed the average time between a freeze proposal and its execution is 2 hours, 16 minutes, and 15 seconds.

The freeze mechanism is controlled by a multisignature wallet, which is the root cause of the delay.

The analysis found that at least 60 addresses completely emptied their holdings before the freeze could take effect, moving a total of $20.4 million in USDT. These transfers started, on average, just 14 minutes after the freeze proposal was submitted, with the main funds moved within 15 minutes.

Additionally, another 113 addresses managed to transfer a portion of their assets, totaling approximately $35.5 million, before the freeze was executed.

The clearest public example of this gap in Tether’s system lies in the company’s July action against Iran’s central bank. After OFAC sanctioned four TRON wallets that had taken in more than $165 million in stablecoins, Tether locked $131 million of it, but roughly $34 million was already gone by the time the block hit.

Granted, the amount that was lost is a small share of a large seizure, as Tether’s Iran-linked freezes now total about $475 million, including a separate $344 million lock in April, but a freeze mechanism with such a large gap can be manipulated by a sophisticated actor.

Tether has said that it coordinates “directly with investigators during active cases, rather than reacting after funds have been dispersed,” and reports working with more than 340 law enforcement agencies across 65 countries on over 2,300 cases, helping freeze more than $4.4 billion in assets.

In an August 4 post about the Gate exchange theft, Darcy said that recovering lost assets becomes close to hopeless once the stolen funds land in an address and blends with unrelated money, because Tether will rarely freeze a pool it cannot cleanly attribute.

The smartest crypto minds already read our newsletter. Want in? Join them.