A $120 million USDT transaction exposes regulatory loopholes in crypto: stablecoins can be frozen, but privacy coins are hard to trace.
TechFlow Selected TechFlow Selected
A $120 million USDT transaction exposes regulatory loopholes in crypto: stablecoins can be frozen, but privacy coins are hard to trace.
$72 million in USDT was permanently frozen by Tether, while criminals transferred $48 million using Monero.
Navigating Web3 tides with focused insightsBy Liam 'Akiba' Wright
Translated by Saoirse, Foresight News
Key Takeaways
- Following reports that a TRON-chain address received $120.2 million in USDT and began splitting and transferring funds, Tether froze approximately $72 million worth of USDT held in that address.
- The fund flow path carries significant industry reference value—it demonstrates how traceable stablecoin flows can rapidly disperse across exchanges, cross-chain bridges, and Monero (XMR), among other channels.
- Neither the wallet’s owner nor the original source of the funds has been identified; roughly $48 million was transferred out before the freeze took effect, leaving subsequent fund movements highly ambiguous.
Last week, a TRON-chain address received $120.2 million in USDT and began splitting and transferring those funds. After this flow was flagged as potentially linked to money laundering, Tether froze approximately $72 million worth of USDT held in the address. There is currently no publicly available evidence linking this wallet to any hacking incident.
The freeze applied only to assets still denominated in USDT—but the resulting fund flow exposed a critical, unresolved industry question: How much time do stablecoin issuers have to act before traceable tokens enter liquidity channels with extremely high on-chain traceability barriers?
Monero has emerged as a quintessential vehicle exposing this industry pain point. On-chain analyst ZachXBT reported that the same funding entity simultaneously placed large buy orders for Monero while also transferring funds to KuCoin deposit addresses, instant swap platforms, and various cross-chain channels. This massive buy order significantly pushed Monero’s price upward—from around $330 to a range between $420 and $438.
Market participants detected the anomaly not through Monero’s on-chain transaction data—which inherently conceals transaction details—but rather through the price volatility triggered by the large buy order. As a privacy-focused cryptocurrency, Monero intentionally obscures transaction metadata, meaning this money laundering activity could only be externally observed via market-level price deviations.
How the Fund Flow Path Was Traced and Identified
The earliest fully public on-chain tracing线索 originated from ZachXBT’s disclosure of the TRON-chain address; USDT blacklist monitoring tools concurrently added the address to their databases.
Records indicate that on June 11, the TRON address received $120.2 million in USDT, followed by multi-channel dispersal: over $12 million was sent to KuCoin deposit addresses; approximately $8 million flowed into various instant swap platforms; more than $8 million moved via the Near Intents cross-chain bridge from TRON to Bitcoin and Ethereum networks; and substantial purchases of Monero directly boosted XMR’s price.
Subsequently, the same monitoring platform blacklisted the associated TRON address, freezing 72,030,295.55 USDT held therein. Multiple media outlets reconstructed the full sequence: a large USDT inflow into a TRON address, subsequent fund splitting across multiple channels, Monero purchases driving up its price, and finally Tether freezing the remaining $72 million in USDT yet to be withdrawn.
To date, no reporting has confirmed the actual controller of the wallet, nor has the origin of the $120.2 million USDT been definitively established. Thus, this fund flow can only be classified as *suspected* money laundering—there is no verifiable link to known hackers, sanctioned entities, or exploits tied to on-chain vulnerabilities.
This chart clearly reconstructs how the $120.2 million USDT inflow into the TRON chain was split across multiple channels. Tether froze only the remaining $72.03 million in USDT, while roughly $48 million had already been withdrawn earlier—via exchanges, cross-chain bridges, and large Monero buy orders—pushing up XMR’s price. It highlights an industry contradiction: centralized stablecoins offer limited controllability over funds, while privacy coins present formidable regulatory and tracking challenges.
Timing was the core technical crux of this incident: issuers or on-chain monitoring systems can only execute address-level asset interception once they identify balances still eligible for freezing.
In this case, however, multiple fund transfer channels—including centralized exchange deposits, instant swaps, cross-chain bridge transfers, and Monero buy orders—had already completed prior to the address being blacklisted.
The difficulty of recovering assets varies drastically across different channels: exchange deposits allow for compliant joint investigations; cross-chain assets require multi-chain collaborative tracing; Monero transactions leave only market-level price fluctuation traces—investigators cannot access full transaction details.
The Scope of Tether’s Controllable Funds
USDT is a USD-pegged stablecoin issued by a centralized entity and deployed across multiple public blockchains—including TRON. Stablecoin issuers hold the authority to blacklist specific token addresses, thereby prohibiting USDT transfers from those addresses.
USDT’s official documentation explicitly states that issuer-controlled asset management constitutes a core risk factor—and simultaneously reflects USDT’s deep integration into the broader crypto infrastructure.
USDT is widely used for trading pair quotations, USD settlement, exchange liquidity, decentralized finance (DeFi) pools, daily payments, cross-border remittances, and on-chain transfers. Its ubiquity stems from massive circulation volume and abundant liquidity—but so too does its attendant risk: asset custody rests entirely with the issuer, who retains the power to freeze users’ tokens under certain circumstances.
In April this year, Tether issued a statement regarding another $344 million freeze event, affirming its authority to restrict asset transfers when wallet addresses are linked to sanctions evasion, criminal networks, or other illicit activities. The company also noted it collaborates with over 340 law enforcement agencies across 65 countries.
This compliance toolkit wields strong enforcement power—but also faces clear limitations: blacklisting only prevents outward USDT transfers from the designated address.
Once funds are converted into other cryptocurrencies, deposited onto exchanges, routed through cross-chain bridges, or funneled into privacy-focused networks where transaction information is obscured, issuers lose direct ability to recover corresponding assets.
In this case, the freeze intercepted only funds still held as USDT; the ~$48 million transferred out prior to freezing represents the most challenging portion for subsequent investigation.
Further investigative efforts must rely on cooperation from major exchanges, offline judicial proceedings, and residual tracing clues left along the fund conversion path.
Within this money laundering process, Monero served a fundamentally distinct role compared to ordinary volatile crypto assets. As one of the industry’s most well-known privacy coins, its underlying design severely constrains investigators’ ability to trace assets after conversion.
Monero’s official project documentation states that user privacy is a top-tier priority, achieved through technologies including Ring Confidential Transactions (RingCT), stealth addresses, and ring signatures. Market resources for XMR likewise emphasize that the asset prioritizes privacy—on-chain records do not disclose sender, recipient, or transaction amounts.
Of course, this does not imply all Monero transactions are illicit. Many ordinary users adopt privacy coins simply to prevent their balance, counterparties, and spending history from being freely observable on public ledgers.
Yet this incident exposes a clear risk: if suspicious funds can rapidly convert from traceable stablecoins into Monero, public on-chain tracing becomes exceedingly difficult—though large-scale conversion behavior itself remains detectable through market price movements.
The scale of these funds is notably significant relative to Monero’s market liquidity. CryptoSlate’s market data shows XMR’s daily trading volume stood at approximately $319 million on June 12.
If the full $48 million were transferred before the freeze, it would account for roughly 15% of that day’s total volume. However, this comparison serves only as a rough reference: first, the $48 million was distributed across multiple channels; second, trading volume data derives from real-time market aggregation and cannot precisely reconstruct each fund’s conversion path.
TRM Labs’ 2026 Crypto Crime Report notes increasing adoption of Monero on darknet markets—and a growing trend among illicit fund operators to accelerate cash-out speeds and employ multi-channel fund fragmentation. This fund flow pattern aligns closely with such criminal trends—though the true origin of the wallet’s funds remains unconfirmed.
CryptoSlate continues tracking competitive dynamics in the privacy coin sector, where Zcash competes with Monero for market share amid mounting regulatory pressure industry-wide.
Core Insight: Speed of Fund Movement Determines Control Success or Failure
Tether’s freeze action yielded two concrete outcomes: first, it successfully halted further outward dispersion of several million dollars in USDT; second, it starkly demonstrated that once laundered funds exit the issuer’s controllable base layer—i.e., stablecoin-native channels—the intervention window available to issuers is extremely narrow.
Stablecoin freezing mechanisms deliver maximum effectiveness only while funds remain in their native, blacklistable token form. Once funds disperse into exchanges, instant swap platforms, cross-chain bridges, or privacy coins, issuers lose direct control—and subsequent resolution depends entirely on judicial investigation, platform compliance cooperation, and market surveillance.
Earlier coverage of stablecoin freezes following security incidents like Drift and Rhea similarly highlighted this tension: from a user asset protection standpoint, emergency freezing effectively intercepts stolen assets—but this authority resides solely with the issuing entity, which independently determines both timing and execution method for freezing users’ digital dollars.
Monero’s fund movement path further magnifies regulatory challenges: even if issuers respond immediately, the liquidity of privacy assets severs subsequent on-chain tracing links.
Markets will continue watching several key developments: whether Tether publicly confirms this freeze and discloses the compliance basis for blacklisting the address; whether major exchanges and swap platforms can identify downstream deposit addresses; whether ZachXBT and other on-chain analysts update comprehensive fund-tracking trajectories; and whether Monero’s market liquidity can absorb the price impact generated by this large-scale conversion.
Stablecoin blacklist mechanisms govern only USDT assets not yet transferred out—while the sharp Monero price swing proves that substantial funds had already exited the issuer’s controllable domain.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@CryptoSlate
