Stolen USDT: Can Tether Freeze It and Return Your Money?

Tether can freeze stolen USDT in some cases. Court records show how recovery works, why it can fail, and what evidence victims need to save.

Can Tether freeze USDT in a private wallet?

Yes. The thief does not have to leave the USDT on an exchange. Tether can restrict its tokens at selected addresses, including self-custody wallets. In November 2023, it announced a freeze of about $225 million in USDT held in external wallets following an investigation with OKX and U.S. authorities.

The restriction is built into the token's rules. On Ethereum and Tron, a blacklisted address cannot send the affected USDT, even if its owner still has the wallet's private key. The balance can remain visible. That does not mean it can still be spent.

But Tether's ability to stop a transfer does not decide who owns the money or who should receive it. Those questions can require a separate legal process.

What happens between a freeze and a refund?

These terms describe different results. In the U.S. cases discussed here, a seizure or forfeiture announcement should not be read as confirmation that victims have been paid.

Status	What it means	What it does not prove
Frozen	The affected USDT cannot leave the blacklisted address.	That your ownership claim has been accepted.
Seized	Authorities have taken control of assets through a legal process.	That the assets are ready for payment to you.
Forfeited	A legal process has transferred ownership of the assets to the government.	That every victim will receive their full loss.
Returned	Money has actually been distributed to an approved recipient.	That every other victim in the case has also been paid.

The $225 million case shows the gap. Its court complaint says the U.S. Secret Service requested a freeze around November 20, 2023. The civil forfeiture complaint was filed on June 18, 2025, about 19 months later. Those dates measure the gap between the freeze request and the filing, not the time every victim waited for payment.

How can Tether recover USDT without the thief's private key?

One method is called burn and reissue. The issuer destroys the restricted tokens and creates replacements at an authorized destination. It does not need to guess the thief's password or reverse the original blockchain transaction.

OpenZeppelin's 2018 audit documented a Tether contract function called destroyBlackFunds, along with controls for issuing tokens. This is a built-in issuer power, not a tool that an ordinary wallet owner can use. The 2025 forfeiture complaint describes tokens being burned and reissued following seizure.

A pension fraud case shows how the process can work

Law firm Edmonds Marshall McMahon reports helping recover nearly $900,000 for a woman who had converted $1 million of pension funds into crypto and sent it to a romance scammer in November 2023. The firm was contacted six months later.

According to its account, investigators traced funds to two addresses. Tether required a law-enforcement request in that case. After U.S. authorities became involved and seizure warrants were obtained, Tether destroyed the restricted tokens and issued replacements into a government-controlled wallet for the victim's benefit.

This is the law firm's reported outcome, not an independently reviewed payout record. It does show why a delayed report should not automatically be abandoned. Whether reachable assets remain matters more than a recovery company's invented deadline.

Why finding a suspicious wallet is not enough

A suspicious address is not proof that it received your money. A claim needs evidence connecting your loss to the assets.

One victim's 37,566 USDT payment needed exchange records

The $225 million complaint describes victim G.B. sending about 37,566 USDT. The funds moved within minutes, passed through intermediary addresses and mixed with other money. Investigators needed OKX records to connect exchange deposits and withdrawals.

They traced approximately 4,466 USDT from G.B.'s payment into one final destination. That was one traced portion, not a statement of her total recovery or repayment.

An English court rejected a claim with unreliable tracing

In September 2024, England's High Court rejected D'Aloia's claim against Bitkub. His tracing expert had not reliably shown that his USDT reached the exchange wallet in question.

The judge accepted that the recipient was linked to fraudulent activity, but could not connect it to the fraud against D'Aloia.

Ask a paid tracer for each transaction, the amount linked to your payment, any assumptions about mixed funds and any gaps requiring exchange records. The judgment shows why those details matter.

What can limit a freeze?

The token may not be the one you think it is. Start with the network and token contract, not the name displayed in a wallet. Tether publishes official contract details for its supported protocols. Do not assume a wrapped or bridged token has the same issuer controls without checking its implementation.

The money may have changed form. Suppose a thief swaps USDT for ETH. Tether's USDT controls cannot freeze the ETH now held by the thief. Investigators would need to assess where the assets went and what other recovery route is available. Freezing an empty USDT balance would not capture that ETH.

A quiet wallet may not be frozen. Check the address's blacklist status on the correct network and record when it was checked. An unchanged balance is not proof. Blacklist actions are publicly verifiable, and incoming USDT may still arrive at a frozen address. Do not send a test payment.

Your report is not a seizure order. A private recovery firm cannot issue one. The FBI explains that exchanges restrict accounts under their own procedures or in response to legal process. Technical ability, evidence and legal authority are separate parts of a recovery effort.

What to do after your USDT is stolen

1. Stop exposing more money

If your recovery phrase or private key was exposed, stop using the affected wallet. A replacement needs a new recovery phrase, not another account under the compromised one. If new deposits disappear automatically, do not add more ETH or TRX to test the wallet or pay fees. A sweeper bot may steal those deposits too.

2. File a report before you have the whole trail

Report the theft to your local police or cybercrime authority. In the U.S., also report it to the FBI's Internet Crime Complaint Center, known as IC3. The FBI specifically advises reporting even when transaction details are incomplete. Keep the report and any reference number.

A victim's report can start a much larger investigation. In February 2026, prosecutors in North Carolina announced a seizure of more than $61 million in Tether linked to alleged investment fraud. The investigation began with a victim contacting Homeland Security Investigations. Agents followed funds through several wallets, some of which still held substantial balances. The announcement described a seizure, not completed repayments.

3. Use the right Tether contact route

Tether's token-recovery page mainly covers mistaken deposits. It directs thefts, hacks, scams and law-enforcement matters to its Information Requests team. Find that route through Tether's official site, and ask the investigator handling your case to coordinate any request to preserve funds.

The minimum amount and fees on the mistaken-deposit page are not a published stolen-USDT recovery service. Do not treat them as a promise of recovery, a theft-reporting threshold or a fee you must pay to freeze a thief's wallet.

4. Notify an exchange when the evidence points to it

Send its official support team the relevant transaction details and case reference. Request escalation to its fraud or compliance staff. Describe an exchange label as a lead unless you have confirmation. Do not present a guess about who controls an address as an established fact. A report alone does not require the exchange to reimburse you.

Evidence checklist: build a file someone else can verify

Use one folder, a short timeline and a transaction list. The items below combine FBI reporting guidance, Tether's transaction-document requirements and the ownership records requested in the $225 million case.

• The exact asset: Network, token contract and token amount. Keep the token quantity separate from its estimated dollar value.
• Each loss transaction: Full transaction hash, sending address, receiving address, date and time with time zone. Save these as copyable text, not only screenshots.
• Your connection to the funds: Exchange purchase and withdrawal records, bank statements and records tying you to the sending wallet. A balance screenshot alone does not establish your loss.
• How the theft happened: Original messages, emails, website addresses, payment instructions and relevant screenshots. Say whether you sent the money after being deceived or discovered an unauthorized transfer.
• What happened afterward: Later transaction hashes, receiving addresses, dated balance checks, any freeze-status confirmation, and the source of each address label.
• Reports and money already returned: Police references, support tickets and any refunds or reimbursements. Do not count returned funds as still missing.

For an exchange withdrawal, retain the exchange record as well as the blockchain transaction. Your account record helps connect you to that payment, even when the sending blockchain address belongs to the exchange. The case-specific FBI intake process explicitly requests exchange records and proof of wallet ownership at the formal petition stage.

Never include a recovery phrase or private key in an evidence pack. Keep sensitive documents private and share them through independently verified channels. Anyone with the recovery phrase can control the wallet.

What to do when the stolen USDT moves again

Consider a simple example: 8,000 USDT leaves your wallet for Address A. Two days later, A sends 6,000 USDT to Address B. Watching only A now misses later activity at B. A freeze of A would not reach the 6,000 USDT already moved elsewhere.

Address watchlists can notify you about incoming and outgoing transfers. Check that the chosen service covers the correct network and USDT transfer type. As new destinations are verified, add them to the watchlist rather than assuming the service follows the trail automatically.

A useful update to an investigator could look like this:

Movement update for case [reference]
Original loss: 8,000 USDT on [network].
Original transaction: [full hash].
New movement: Address A sent 6,000 USDT to Address B.
Time: [date and time, UTC].
New transaction: [full hash].
Address B balance at [time]: [verified amount].
Freeze status: [confirmed status and source, or not checked].
Ownership of Address B: [confirmed evidence, or unknown].

This is a hypothetical reporting format, not a completed tracing report. If an address holds mixed funds, do not assume every later outgoing transfer contains your money.

A transfer notification records activity. It does not stop the transfer, identify the owner or submit a freeze request. Also check whether your service monitors blacklist changes separately: a transfer alert and a change in freeze status are different events.

How much could you actually get back?

A seizure total is not an individual payout

In a Connecticut case, a victim lost about $234,000 in crypto after following a fake Ledger security letter in September 2025. Investigators later seized approximately $600,000 in Tether. A court entered a forfeiture decree on March 31, 2026.

That does not mean the victim was paid $600,000. The official announcement explained that forfeiture comes before the government's work to return assets to victims.

You may need a separate application

The FBI's intake form for the $225 million case first checks whether a reported address matches the investigation. It says a formal petition then needs supporting evidence. Being matched to a case is not the same as having an approved repayment claim.

Follow the deadline and filing instructions in the official notice. A police report, a support ticket and a petition for return of forfeited assets are different submissions. U.S. petition instructions require evidence of your interest and a signed statement under penalty of perjury. A lawyer is optional for that petition process, but advice can be useful when ownership or deadlines are disputed.

Actual losses and available funds matter

Under U.S. federal remission rules, victims must show a specific, documented financial loss. Payments already received matter. Lost interest and expenses incurred trying to recover the money are excluded. These are rules for this U.S. process, not a worldwide formula.

For example, suppose you paid $20,000 into a scam and received $2,000 back. Your net cash loss is $18,000, not the $80,000 balance the fake trading site displayed. The rule values lost property at the date of loss, so the assets and facts still matter.

Another hypothetical: eligible victims have $1 million in recognized losses, but only $200,000 is available. A proportional distribution would cover 20% of each accepted claim. A $10,000 claim would receive $2,000. The regulation generally uses proportional payments when funds are insufficient, but priorities can change the result. Allowed government costs and valid third-party claims can also reduce the available amount.

Do not pay an impersonator to release your recovery

The U.S. Department of Justice says there is no payment required to participate in its remission process. A demand for an official participation fee is fraudulent. That is different from choosing to pay an independently verified lawyer for legal work.

The FBI warns about recovery companies that demand upfront payments, provide weak or false reports, then ask for more money. Some claim connections to law enforcement. Private firms cannot issue seizure orders, regardless of how convincing their paperwork looks.

Before spending more, ask what has actually happened: Were funds identified, frozen, seized, forfeited or paid out? Ask for the evidence behind that answer and verify the contact through the organization it claims to represent.

Report with the evidence you have, preserve your records and update the trail when funds move. These steps give investigators something usable. No case described here establishes a recovery success rate or guarantees the same outcome for another victim.

The legal examples are specific to their jurisdictions. For a live claim or court notice, seek advice from a lawyer qualified where the case is being handled.