October 17, 2026

Case of the day. Tether froze two addresses that moved 1.69M USDT. The money had already left

On October 12 at 19:01 UTC Tether blacklisted three TRON addresses in one batch. Two of them are linked.

WHAT HAPPENED

• Address A (TVTG…Fu4t) received 706,252 USDT and sent out 671,584.
• Address B (TCeK…FAcs) received 986,029 USDT and sent out 1,006,366.
• A paid B directly (130,606 USDT) and through a pass-through address (447,327 → 300,000 into B).
• Before the freeze, B had already spread about 1M USDT across six recipients.

At the moment of the freeze, both addresses held crumbs. The bulk was already with the recipients.

WHO IS LISTED AND WHO ISN'T (checked 13.10, 05:00 UTC)

• A and B — blacklisted.
• The pass-through between them — not.
• All six recipients of B — not.
• The original senders — not.

A freeze hits the address, not the money. The funds that left an hour before 19:01 now sit with people whose history shows an incoming transfer from a Tether-blacklisted address. An exchange will see that on their first deposit.

A DETAIL YOU ONLY SEE ON-CHAIN

Address A received two transfers of 1 USDT from addresses whose last six characters match the pass-through (…4cAL1t). That's address poisoning: someone planted a look-alike trap on a high-volume wallet. While Tether was preparing the freeze, scammers were hunting the same money.

HONESTLY, ABOUT OUR OWN CHECK

Until 19:01 none of these addresses was on any list — and our check said "clean". Lists always lag. What was visible before the lists: fresh wallets, money passing straight through almost in full, round amounts. That is the "pass-through" signal, and it's what we now look at on the route map.

If you received USDT from TVTG…Fu4t or TCeK…FAcs — check your own address now, before an exchange does: https://t.me/amlconsensus_bot?start=en

All hashes and addresses of the case are on the TheftWatch page: https://api.amlconsensus.com/theftwatch/