A P2P seller receives USDT, sees the balance in the wallet and releases fiat to the buyer. The sender's address is not frozen and the transfer went through – everything seems fine. The problem surfaces a few days later, when the seller moves the coins to an exchange and the deposit gets stuck in review with a note about suspicious origin. The money has not been stolen or blocked for good, but the seller cannot use it until they prove where it came from.
This can be avoided by checking the coins before releasing fiat or goods. To do that, the sender's address or the incoming transaction hash is pasted into an AML screening service, for example the USDT check on KYTme. It matches the address history against blockchain analytics databases and shows where the coins came from: exchanges, scam schemes, sanctioned services or mixers. You do not need to connect a wallet – a public address is enough, and the check takes less than a minute. Below we explain why this happens, why a sanctions label is dangerous, how an exchange hold differs from a Tether freeze and how to use real reports to tell coins you can work with from coins you should not take.
Why «the address is not frozen» does not mean «the coins are clean»
USDT itself is never dirty or clean – its history is. Blockchain analytics companies have spent years labelling addresses: this one belongs to an exchange, this one to a scam project, this one to a darknet market, this one is under sanctions. When coins arrive at a new wallet, analytics looks at which labelled addresses they passed through before and carries that trace over to the new owner.
Indirect exposure is the reason why «I got it from an honest person» guarantees nothing. Intermediate wallets do not erase the trace: if your counterparty received coins from a scam cluster two transfers ago, analytics will see that link in your report too. The more transfers and the smaller the share of such funds, the weaker the link, but it never drops to zero.
Traces carry different weight. Sanctions are the heaviest – more on them below. Darknet markets, scams, theft, ransomware, mixers and illegal services are also considered severe categories. Gambling is an elevated but not prohibited risk. And «exchange» or «P2P exchange» in a report means nothing bad on its own: almost every wallet's history passes through exchanges.
What adds complexity is that USDT lives on several networks, and on each it has its own history and its own blacklist. A clean status for an address on Ethereum says nothing about the same address on BNB Chain. That is why, before a deal, it is worth agreeing on the network and checking the address format: TRON addresses start with T, Ethereum and BNB Chain addresses with 0x. A transfer on the wrong network can cost you all the coins.
Most of the time we are talking about TRON. Transfers there are cheaper, and most of the P2P market runs on this network – and fraudsters along with it. According to BlockSec, TRON accounted for 84.2% of the addresses Tether blacklisted in 2025. Freezes on Ethereum are rarer but larger: the average balance of a frozen address there was about $613,000, against $243,000 on TRON. Across the market, stablecoins make up 84% of illicit on-chain volume, by Chainalysis' estimate.
Sometimes a dirty trace appears without you doing anything at all. After the United Kingdom sanctioned the HTX exchange, unsolicited transfers of 3–12 USDT started arriving from its wallets at other people's addresses, including Coinbase and Binance deposit addresses. The recipients were sent into reviews, and one Coinbase user, according to NullTX, had their account frozen after receiving 7.5 USDT.
HTX is crazily transferring out small amounts, effectively polluting other people's addresses, – wrote the user 0xZiye on X.
The conclusion is simple: before depositing to an exchange, check not only your counterparty but also your own address. We looked at how TRON fills up with such small transfers in our piece on spam on the TRON network.
Where dirty crypto comes from and how it reaches ordinary peopleSep 22, 2026Read more
How exchanges see the history of your USDT
All of this history matters at the moment the coins arrive at an exchange. Major platforms check every deposit automatically: a transaction monitoring system runs the sender's address and the transfer itself through blockchain analytics and assigns a risk score. If the score is above the internal threshold, the deposit is not credited but goes to a compliance officer for manual review.
What KYT is in crypto and how transaction monitoring worksAug 25, 2026Read more
Exchanges do not publish their thresholds, and each has its own. Platforms use different analytics vendors and different models, so the same deposit may pass without questions on one exchange and end up in review on another. You cannot know in advance where the line is. But you can see in advance what the exchange will see – the history of the coins. That is why it makes sense to check USDT before you accept it, not after the deposit has already been held.
Sanctions labels: direct match and indirect exposure
Of all the traces in a coin's history, a sanctions trace is the most dangerous, because behind it stands not an analyst's assessment but the law. If an address is linked to an entity on a sanctions list, such as the SDN list of the US regulator OFAC, exchanges, banks and payment services are required to act on it. But a sanctions label in a report comes in two kinds, and the difference between them is fundamental.
A direct match is a hard stop for most exchanges and banks. The report shows the name of the entity and the sanctions category, and funds sent to such an address can be frozen. You should not accept money from such an address or send money to it.
Indirect exposure is a reason to look closer, not an automatic ban. Two things matter here: what share of the funds at the address came from the sanctioned entity, and how many transfers separate the address from the source. A small share far down the chain and a large sum straight from a sanctioned exchange are completely different situations, even though the label in the report is called the same.
The sanctions label is visible in the standard KYTme AML report: providers label the addresses of sanctioned entities and show such a label among dangerous sources. They start with the OFAC SDN list, but their coverage of other sanctions regimes differs, so a disputed address is worth rechecking with another provider. We explained how to read a sanctions label in more detail in our article on the OFAC label in a wallet report.
What this looks like in a report is easy to see on the address TBEqQGTxXRWXXeqe7ZwmSB6hc5MMMMMMMM on TRON, which belongs to the guarantee marketplace Xinbi Guarantee. We checked it with two providers, and both returned 100% risk – the highest level. Crystal Intelligence attributes all of the address's funds to sanctions and names the entity directly: Sanctions (Xinbi Guarantee). BitOK sees the same address from another angle – as an address on Tether's blacklist. This neatly connects two topics of this article: a sanctions label and a Tether freeze often end up on the same address.
Exchange hold and Tether freeze: two different stories
When a deposit gets stuck in review, people say «my USDT was frozen». But that word covers two different events, and mixing them up is dangerous: which one happened determines both the chance of getting the money back and what you need to do.
An exchange hold is a restriction at the account level – the very outcome of the check on the coins' history. In notifications it appears as Abnormal Asset Origin, suspicious origin or risk control. The coins remain yours, and the issue is usually resolved once you bring documents proving the source of funds.
A Tether freeze works differently. It is a flag in the USDT smart contract itself, and an address with that flag cannot send USDT through any wallet or exchange. Incoming transfers to it go through, but the coins cannot be moved on. Only Tether makes the decision: at the request of law enforcement, based on sanctions lists or as a result of its own monitoring. Such freezes are rarely lifted. According to BlockSec, in 2025 Tether blacklisted 4,163 addresses holding $1.26 billion and unfroze only 3.6% of them.
Since these are different mechanisms, the checks are different too, and one does not replace the other. An AML check looks at the origin of the coins – which is what the exchange cares about. The blacklist answers another question: whether a specific address can move USDT at all.
The two freezes are also connected – through sanctions. When OFAC adds an address to its list, Tether, according to Bitquery, has blocked it within a week in most cases since 2024, and most often on the same day. So a direct match with a sanctions list almost always means the address is already frozen or soon will be.
Bitcoin promised no one could stop a payment. Stablecoin issuers froze $6.4 billionOct 19, 2026Read more
In practice, the blacklist matters most before sending. You simply cannot be paid from a blocked address – the transfer will not go through. But if you send USDT to such an address yourself, the recipient will not be able to use it.
What happens to those who accept dirty USDT
Exchanges do not explain how they make decisions, but user reviews show what it leads to. A Bybit user writes that the exchange isolated 12,500 USDT in their account with a suspicious origin note and has held it for more than three weeks. A 3,000 USDT deposit made after a transfer from HTX has been in review for more than 100 days, and another, of 4,188 USDT, for more than 152 days. Small amounts are no protection either: a user from Nigeria had a deposit of just 126 USDT blocked because the coins came from the P2P platform NoOnes.
Similar rules apply on other platforms. OKX officially warned that deposits from high-risk sources, such as Telegram guarantee groups, are reviewed for 15 days or more, with account functions restricted during that time. We explained why the exchange took this step in a separate article.
That said, an exchange hold is not a final verdict. On Bybit, about $11,000 was unblocked in 9 days after the user sent documents. KuCoin lifted a restriction on an account holding over $200,000 after 5 weeks, and an OKX user in Turkey regained access to 7,062 USDT after 3 days. The difference between these stories usually comes down to how quickly the person could explain where the money came from. That is easiest if the coins were checked before the deal.
How to check USDT before a deal
The check starts with a simple question: which address will the coins come from? If your counterparty pays from an external wallet, ask for the address in advance and check it before the deal. On P2P platforms, the sender's address often becomes visible only after the transfer – then the logic is different, and you need to check the incoming transfer itself. We will come back to this below.
The address goes into the check form on KYTme. The network is usually detected automatically, but for 0x… addresses the service asks you to choose it manually: such an address exists on both Ethereum and BNB Chain, and its history on each network is different. Choose the network on which the USDT will arrive.
A KYTme check is run with one of three providers – Crystal Intelligence, BitOK or VALEGA Chain Analytics: the provider is chosen before each check, and each has its own label database. If the result looks disputable, you can recheck the address with another provider. At the top of every report are the overall risk level, the report date, the date of the last incoming transfer and the balance. Below, the sources of funds are split into three groups: trusted, suspicious and dangerous. An indirect mark next to a category means the link is indirect, through intermediate addresses.
The easiest way to show what this looks like is with two extremes. The first is a Binance hot wallet on Ethereum. Both providers recognize it as an exchange and attribute 100% of the funds to Binance: BitOK shows 0% risk, Crystal 10%. You can safely work with such an address.
The second extreme is the address TDvuPFDKvhHxz4LuoiwU7V8YpNssMA5c4S on TRON. According to investigator ZachXBT, about $3M in fraud proceeds was laundered through it, and the money went to the Huione marketplace. BitOK rates the risk at 74% – the high level – and Crystal at 57%. Both attribute almost half of the address's funds to dangerous sources: BitOK to funds linked to enforcement action (48.32%), Crystal to an illegal service (52%).
We checked this address with the two providers separately, and both reached the same conclusion: money from this address should be turned down. Each provider has its own labelling, so two matching reports give a more confident picture than a single source. More on KYTme's providers is on a separate page.
Now for the case when the address is not known in advance. An address check shows the history of the whole wallet, while a transaction hash (TxID) check shows the risk of the specific transfer that reached you. For P2P this is often the most important step: these are the very coins you will later take to an exchange. The hash can be found in the P2P order details or in a blockchain explorer. In the KYTme explorer, every transaction has a Check AML Risk button: once you choose a provider, it runs a check of that transfer.
For example, a transfer of 2.9 million USDT from the same address in the Huione story was flagged as risky by both providers: BitOK at 90%, high risk, and Crystal at 57%. Had such a transfer arrived as payment for your P2P order, the check would have told you not to release the counter-payment.
That leaves the last case – when you are the one sending USDT. Then it is worth checking the recipient's address. If the report shows a sanctions label or a link to frozen funds, the coins you send may get stuck with the recipient or end up frozen. It is best to do this right before sending: an address's history changes, and a label can appear at any moment.
Check an address for free
Visit siteHow to read the result and when to walk away from a deal
The first thing to look at in a report is the overall risk level. KYTme shows the scale right in the report: up to 30% is low risk, 31–69% medium, 70% and above high. But the percentage is only half the answer. The other half is which categories produced it. 40% «exchange» in a wallet's history is normal. A direct match with a sanctions list, however, is a stop at any overall percentage.
The medium zone needs special attention: these are the deposits on which exchanges most often request proof of source of funds. What decides it here is the risk category. If it is a scam, an illegal service or a direct match with a sanctions list, that is a refusal at any percentage. With indirect sanctions exposure, look at the share of such funds and at how many transfers separate you from the source. If, on the other hand, the coins came from a major licensed exchange, the wallet has a long ordinary history and the overall risk is low with every provider, you can usually work with such a counterparty.
We covered how the risk scale works and where the percentages come from in a separate article, and what a sanctions label means in our article on the OFAC label in a wallet report.
Low, medium, high: how AML risk scoring of crypto wallets worksJul 22, 2026Read more
A quarantine wallet and a report as evidence
If you accept USDT regularly, it is worth adding two habits to the check. The first is a quarantine wallet. Coins from unfamiliar senders are better received at a separate address rather than straight at an exchange deposit address. Check the incoming transfer first and only then move the coins on. If they turn out to be dirty, the problem stays on the separate wallet and does not touch your account.
The second habit is keeping the report. An AML report dated before the deal, together with the P2P order number, the chat and the transaction hash, shows that you checked the counterparty in advance. A KYTme report includes the provider, the date and time of the check, the address and the overall risk, and the report itself can be downloaded as a PDF. If the exchange later asks about the source of funds, such a document noticeably speeds up the review. If you check addresses often, it is more convenient to do it right in the messenger via the KYTme Telegram bot.
If dirty USDT has already arrived
If the check shows risk after the coins have arrived, the main thing is not to make it worse. The first urge is to quickly send the coins on or scatter them across several wallets. That is a mistake: analytics sees the whole chain, and trying to «blur» the history only makes the picture worse. For the same reason, do not send new funds to the same exchange from the same wallet.
Next, you need to understand which freeze you are dealing with. If the coins cannot be moved through any wallet or exchange, it is a Tether freeze. If the coins are on an exchange and it is asking for documents on the source of funds, it is an exchange hold.
An exchange hold is usually resolvable. Open one ticket and respond quickly. Attach proof of purchase, statements, transaction history, proof of wallet ownership, invoices or contracts if this was payment for work, and an AML report made before the deal if you have one.
With Tether, the chances are noticeably lower. Gather everything that explains the origin of the coins – who sent them and why, dates, amounts, the chat – and write to Tether. If a counterparty paid you from an address that was later blocked, file a police report with the transaction hash.
Frequently asked questions about checking USDT
No. The blacklist shows only one thing: whether the address can send USDT. Exchanges block deposits based on the coins' history, and that is visible only in an AML report.
