A new blockchain investigation has identified approximately $621 million in USDT–USDD conversion activity linked to subsequently frozen wallets, cryptocurrency hacks, or counterparties associated with Xinbi Guarantee, raising questions about how effectively stablecoin issuers can intercept suspicious funds once they move through decentralized liquidity infrastructure.
The findings, published by blockchain intelligence platform PublicAML on October 22, 2026, cover transactions involving USDD’s peg-stability module on the TRON network between January 1 and October 22.
Researchers identified $12.99 billion in USDT entering the module during that period, including approximately $8.43 billion that completed a round trip back into USDT within 48 hours. Of those rapid conversions, $621 million, or 7.4%, had at least one identified connection to potentially high-risk addresses.
Crucially, the findings do not establish that $621 million was stolen or laundered. The figure represents cumulative transaction volume associated with specific risk indicators, not newly discovered losses or assets confirmed to be criminal proceeds.
How Did $621 Million in USDD Transactions Become Linked to High-Risk Wallets?
PublicAML examined 67,788 USDT-to-USDD conversions involving 11,971 sending addresses and 73,265 redemptions back into USDT.
Total USDT entering the module reached approximately $12.985 billion, while redemptions totaled $13.094 billion. The difference reflects transactions measured within the reporting period rather than evidence that the module created additional USDT.
Researchers classified a transaction as a round trip when USDT was converted into USDD and subsequently redeemed within 48 hours by the same holder or through one intermediate wallet.
They identified approximately $8.425 billion in such activity, equivalent to roughly 64% of USDT redemptions during the year. The median holding period was 21.7 hours.
Within this activity, PublicAML identified three overlapping categories of potentially suspicious exposure:
- $462 million originated from wallets that Tether subsequently blacklisted, after the relevant funds had already moved.
- $221 million involved counterparties associated with Xinbi Guarantee.
- Approximately $270 million involved addresses identified in the researcher’s database as connected to cryptocurrency hacks.
These categories overlap. Their individual values cannot be added together to calculate total suspicious activity. The combined $621 million figure counts transactions with one or more identified risk connections only once.
The methodology examined sources of at least 100,000 USDT within the seven days preceding a conversion, alongside subsequent transaction activity. PublicAML said that threshold covered approximately 99% of the relevant volume, although its analysis followed no more than one intermediate wallet.
That limitation matters because shared wallets, exchanges and payment processors can create indirect connections between legitimate transactions and previously flagged funds.
How Does USDD Conversion Complicate Tether’s Ability to Freeze Funds?
The investigation centers on USDD’s peg-stability module, which enables users to exchange USDT for USDD and reverse the transaction at a one-to-one rate without a conversion fee.
When users deposit USDT, the system issues an equivalent quantity of USDD. During redemption, the USDD is burned and USDT is transferred from the module’s liquidity balance.
The distinction matters because Tether can blacklist addresses holding USDT, but its token-level controls do not extend directly to USDD.
If funds leave a wallet before it is blacklisted, freezing that original wallet cannot automatically reverse completed transfers. Converting USDT into USDD introduces another stage in the transaction trail before the holder potentially receives USDT again.
This mechanism became particularly relevant during the October 9 Ledger/CryptoBilis cryptocurrency theft, when investigators reported that suspected stolen USDT was converted through USDD after Tether began freezing associated addresses.
PublicAML also identified a September transaction sequence involving an address labeled as connected to a TRON private-key theft. Nearly 199,000 USDT moved to an unlabelled wallet, which subsequently participated in much larger USDD conversions and rapid redemptions.
However, shared-wallet activity prevents the entire subsequent transaction volume from automatically being attributed to the original theft.
What Do the Xinbi Connections Reveal About Stablecoin Enforcement?
The research identified approximately $221 million in round-trip activity involving counterparties connected to Xinbi Guarantee, a cryptocurrency-linked marketplace targeted by United States authorities.
On September 9, the U.S. Department of Justice announced enforcement action against Xinbi, including the restraint of more than $52 million in cryptocurrency linked to the marketplace and its network of vendors.
The Treasury Department simultaneously designated Xinbi as a significant transnational criminal organization. Authorities alleged that the marketplace facilitated services supporting cryptocurrency fraud and money laundering.
The PublicAML findings do not establish that every Xinbi-connected counterparty participated in criminal activity. They instead identify transaction relationships that may require additional investigation.
The findings also emerge as Tether, TRON and blockchain intelligence firms expand coordinated enforcement activity. Their T3 Financial Crime Unit reported in May that it had frozen more than $450 million in cryptocurrency associated with illicit activity since its establishment in 2024.
That enforcement record demonstrates the growing capabilities of issuer-controlled stablecoins, but the new research highlights an important limitation: intervention must occur while identifiable funds remain within reach of the issuer’s controls.
Why the Timing of Stablecoin Freezes Matters More Than the Transaction Volume
The most revealing number in this investigation may be $462 million, rather than the headline $621 million.
That is the amount associated with wallets Tether eventually blacklisted, but only after the relevant funds had moved elsewhere. It highlights a fundamental weakness in transaction-based enforcement: identifying a suspicious address and preventing its money from moving are two different things.
Tether’s blacklist functionality can be effective once a targeted address is identified. But blockchains operate continuously, and funds can travel through multiple wallets, assets and services before investigators finish establishing a connection to suspicious activity.
This problem extends beyond USDD. Earlier research into $6.4 billion in historical stablecoin freezes demonstrated how issuer intervention has become an important part of cryptocurrency enforcement, while leaving significant questions about attribution and transparency.
The USDD findings add another dimension. Moving value temporarily into a token that Tether cannot directly blacklist may create an enforcement gap even when the underlying transactions remain visible on-chain.
Still, the presence of such a gap does not prove that users exploited it deliberately. Some wallets were blacklisted only after their transactions occurred, and the investigation does not establish when their holders became associated with suspicious conduct.
That distinction is essential when evaluating whether a conversion represents attempted sanctions evasion, money laundering or ordinary financial activity.
Could the Findings Change How Exchanges Screen Stablecoin Deposits?
For exchanges, payment processors and blockchain analytics providers, the practical implication is that checking the latest wallet balance or blacklist status may no longer be sufficient.
A customer could receive USDT from a wallet with no current restrictions even though the assets previously moved through infrastructure associated with flagged addresses. A conventional screening system might miss that history unless it examines the earlier transaction path.
There is a commercial opportunity here for compliance technology providers. Monitoring the sequence of deposits, token conversions, redemptions and subsequent blacklist events could help identify exposure that ordinary address-based checks overlook.
But aggressive screening also carries risks.
PublicAML found that approximately half of the round-trip volume passed through decentralized exchange routers and other services, with much of the activity consistent with ordinary arbitrage and liquidity management.
Treating every USDD conversion as suspicious would therefore create false positives, potentially delaying withdrawals or restricting legitimate customers.
Similar concerns have already emerged around post-blacklist stablecoin transfers, where the technical ability to move tokens to restricted addresses complicates compliance monitoring and fund recovery.
The better approach would be to combine conversion patterns with stronger evidence, including transaction timing, known illicit sources, subsequent enforcement actions and identifiable beneficiary relationships.
There is also a broader question for the stablecoin industry. Dollar-backed tokens are increasingly promoted as infrastructure for global payments and settlement, yet their compliance controls differ materially depending on the issuing entity and the token being transferred.
Interoperability makes stablecoins more useful, but it can also make enforcement less straightforward when assets pass between systems governed by different rules.
The next important development will be whether investigators can establish direct connections between particular USDD conversions and confirmed criminal proceeds, rather than simply identifying exposure to risky counterparties.
For now, the investigation does not suggest that USDD’s stability mechanism is itself illicit or that ordinary users face a newly identified loss. It shows that stablecoin compliance increasingly depends on understanding the full journey of funds, not merely whether the wallet holding them has already been frozen.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574