2026 Large-Scale Stablecoin Freeze Situation Study: Feature Analysis, Risk Evolution, and Countermeasures
- Core Viewpoint: From March to April 2026, triggered by events such as the US-Iran conflict, large-scale centralized freezes of USDT and USDC occurred on the TRON and ETH chains, with illegal transactions accounting for 84% of stablecoin activity. Addresses associated with Chinese-language funds accounted for 56% of total frozen addresses, and their historical transaction volume constituted 91%, but directly frozen funds accounted for only 5%, revealing deep-seated fund chain risks.
- Key Elements:
- During March-April 2026, 1,397 new addresses holding USDT/USDC were frozen on the TRON and ETH chains, involving approximately $722 million in frozen funds and historical transaction volumes exceeding $25 billion.
- The peak freeze periods for Tether’s USDT spanned multiple time zones (e.g., Beijing time 12:00-13:00), reflecting its global compliance response; USDC freezes were concentrated around 16:00 Eastern Time, showcasing an institutional centralized risk control model.
- 779 frozen addresses (56%) were associated with Chinese-language funds, but the associated frozen funds accounted for only 19% (approximately $135 million), exhibiting a notable characteristic of “high proportion of addresses and transaction volume, low proportion of frozen funds.”
- Freeze actions are highly correlated with geopolitical events (e.g., US-Iran conflict), characterized by phased peaks and precise strikes against high-value fund chains. For example, Tether cooperated with OFAC to freeze 344 million USDT related to the Central Bank of Iran.
- The report recommends that the industry needs to build on-chain monitoring and behavioral analysis capabilities to identify abnormal transfer patterns and utilize professional KYT tools (such as Beosin KYT) for risk scoring and early warnings.
Original text from: Beosin
In recent years, the global regulatory landscape for Anti-Money Laundering (AML) and Counter-Terrorism Financing (CFT) concerning virtual assets has undergone profound changes. Regulatory agencies worldwide have significantly increased their focus on virtual assets, particularly stablecoins. The Financial Action Task Force (FATF) Special Report on Stablecoins and Unhosted Wallets, published in March 2026, clearly states that stablecoins accounted for 84% of all illicit virtual asset transaction volumes in 2025, being widely used for money laundering, terrorist financing, and proliferation financing of weapons of mass destruction.
Against this backdrop, the concentrated freezing operations of USDT and USDC on the TRON and ETH blockchains between March and April 2026 serve as a crucial window for observing the evolution of on-chain AML practices. Leveraging monitoring data from Beosin Stablecoin Monitor, this article analyzes dimensions including the scale of freezes, on-chain fund associations, and off-chain intelligence. It aims to accurately present the stablecoin freezing landscape, analyze potential fund link risks, and provide targeted blockchain AML response strategies.
I. Analysis of Stablecoin Freezing Characteristics
According to monitoring data, between March and April 2026, there was a significant increase in both the number of newly frozen addresses and the volume of funds for USDT and USDC on the TRON and ETH blockchains. A total of 1,397 addresses were frozen, directly freezing approximately $722 million, with the historical transaction volume of these frozen addresses exceeding $25 billion.
Looking at the daily distribution of frozen addresses, the number began to rise after the onset of the US-Iran conflict. A peak processing day occurred after March 21st, with over 600 addresses frozen in a single day.
In terms of changes in the scale of frozen funds, the amount of frozen funds showed a stepwise increasing trend. This directly corresponds to the incident in late April where Tether froze 344 million USDT linked to the Central Bank of Iran in cooperation with OFAC. This illustrates that on-chain freezes involve not only large-scale address blocking but also precise strikes against high-value fund chains.
Furthermore, the on-chain freeze data from March to April 2026 reveals clear temporal clustering patterns for stablecoin freezes, with USDC and USDT showing significant temporal divergence. This reflects the different control logics and user scenarios of the respective issuers. The peak freezing hours also indirectly indicate the varying attitudes of issuers towards regulatory responses in specific regions.
USDT freezing activities exhibit multiple significant peaks, occurring at 12:00-13:00, 16:00-17:00, and 21:00-22:00 (Beijing Time), corresponding to 8:00 GST (Dubai), 9:00 BST (UK), and 9:00 EDT (US Eastern Time), respectively. The frequency is lower from late night to midday Beijing Time, showcasing Tether's responsiveness to law enforcement in multiple countries and its global risk control situation.
USDC freezing activities are highly concentrated at 4:00 AM Beijing Time (4:00 PM US Eastern Time), with relatively few operations during other periods. This distribution pattern closely aligns with its processing model and user scenarios. The primary users of USDC are institutions, and suspicious address handling is executed centrally by the issuer, with batch compliance risk control and address review actions concentrated during US mainland business hours.
II. Fund Link Risk Assessment
Based on a comprehensive multi-dimensional assessment using Beosin KYT's database of over 5 billion address labels, on-chain transaction remarks (Simplified Chinese), address-related public sentiment, and Chinese tokens, the association between Chinese-related funds and frozen addresses can be categorized into three types:
- Directly Associated Addresses: Determined by matching the frozen address and its counterparties through on-chain labels, combined with conditions such as association with Chinese dark web/cybercrime shops, underground banks, risk alerts involving criminal cases, and on-chain transfers with Chinese remarks.
- Indirectly Associated Addresses: Determined by matching on-chain user behaviors, such as frozen addresses transferring Chinese tokens, using wallet applications commonly used by Chinese users, and having direct fund flows with guarantee platforms associated with Chinese users.
- Suspected Associated Addresses: Determined by conditions such as suspected multi-transaction RMB exchange scenarios (detected via on-chain transaction data analysis, where the historical USDT/USDC transactions of the frozen address include over 10 transactions involving multiples of RMB value) and indirect associations with transaction counterparties.
Analyzing the newly frozen USDT and USDC addresses and related transaction data on TRON and ETH blockchains from March to April 2026, we can observe the high-risk situation faced by Chinese-related fund chains:
1. Number of Frozen Addresses: Out of the 1,397 frozen addresses in the sample, a total of 779 addresses may be associated with Chinese-related funds (including direct/indirect/suspected), accounting for 56%. Among them, 220 are directly associated (16%), 523 are indirectly associated (37%), and 36 are suspected associated (3%).
2. Scale of Frozen Funds: The total frozen funds in the sample amount to approximately $722 million. Funds potentially associated with Chinese-related entities (direct/indirect/suspected) total approximately $135 million, accounting for 19%. This includes approximately $33.32 million directly associated (5%), $97.41 million indirectly associated (13%), and $4.1 million suspected associated (1%).
3. Historical Transaction Volume: The total historical volume passing through the frozen addresses in the sample exceeds $25.9 billion. The historical volume associated with Chinese-related entities (direct/indirect/suspected) totals approximately $23.6 billion, accounting for a significant 91%. Directly associated addresses account for $6.216 billion (24%), indirectly associated addresses account for $15.787 billion (60.6%), and suspected associated addresses account for $1.693 billion (6.5%).
The association of Chinese-related funds (direct/indirect/suspected) exhibits the characteristic of "high address proportion, low fund proportion, and extremely high transaction volume proportion." This indicates that while the directly frozen amount for these associated addresses is relatively limited, they act as fund transfer nodes carrying immense historical transaction volumes. Therefore, the potential risks within these related fund chains warrant close attention.
III. Blockchain AML Solutions
The above analysis of the concentrated stablecoin freezes details the on-chain AML situation regarding the number, amount, and temporal distribution of freezes, revealing the high-risk environment faced by Chinese-related fund chains in the blockchain ecosystem. Currently, blockchain compliance is advancing rapidly, placing higher demands on the risk control capabilities of Virtual Asset Service Providers (VASPs). Relevant compliance teams should:
1. Build on-chain monitoring capabilities to monitor newly frozen or soon-to-be-frozen high-risk addresses, as well as their associated address clusters and counterparties' on-chain and off-chain activities, formulating corresponding risk control plans and response strategies.
2. Build on-chain behavioral analysis capabilities to identify potential abnormal activities (e.g., large transfers to brand new addresses, fund dispersal across multiple addresses). Ensure that the team's main wallets and business wallets are unaffected and provide real-time alerts for suspicious addresses.
3. Enhance risk control capabilities using professional blockchain AML tools to address issues such as on-chain fund risk assessment, monitoring, and alerting. Beosin KYT, through its vast address label database, transaction pattern analysis, and cross-chain parsing capabilities, can accurately identify high-risk entities and provide risk scores for various addresses and transactions.
Looking ahead, blockchain AML technology will continue to evolve, and cooperation between stablecoin issuers and law enforcement agencies will become even closer. Beosin will continue to delve deeper into blockchain security and compliance technologies, expand its global partner ecosystem, and collaborate with regulatory and law enforcement agencies, industry organizations, and enterprises to jointly build a secure, compliant, and efficient virtual asset ecosystem.
