A Tron address reportedly received 120.2 million USDT last week and began routing funds before Tether reportedly froze about $72 million in USDT after the flow was flagged as suspected laundering, with no specific hack publicly tied to the wallet.
The freeze appears to have frozen funds that were still held in USDT. It did not answer the larger operational question raised by the flow: how much time stablecoin issuers have before traceable tokens move into liquidity where public tracing becomes harder.
That question became visible through Monero. Reports attributed to on-chain investigator ZachXBT said the same entity created large XMR orders while also sending funds toward KuCoin deposit addresses, instant exchanges, and cross-chain routes.
The buying was large enough to push XMR from roughly $330 to a reported range of $420-$438.
The visibility came from buy pressure that moved the price rather than from follow-on Monero transaction data. A privacy coin designed to hide transaction details became the place where the attempted routing was easiest to spot.
How the route became visible
The public trail begins with the Tron address reported by ZachXBT and mirrored by a USDT ban-list monitor.
The posts said the address received 120.2 million USDT on Tron. They also said it sent more than $12 million to KuCoin deposit addresses, moved about $8 million to instant exchanges, bridged more than $8 million from Tron to Bitcoin and Ethereum through Near Intents, and created Monero orders that pushed XMR higher.
The same monitoring page later listed a related Tron address as blacklisted, with 72,030,295.55 USDT frozen. Separate reports described the same core sequence: a large USDT balance arrived on Tron, funds were split across routes, Monero buying lifted XMR, and Tether froze roughly $72 million that had not yet moved.
The reports do not identify the wallet’s owner. The original source of the 120.2 million USDT is also unresolved. That means the flow should be treated as a suspected laundering pattern, not as a confirmed attribution to a known hacker, sanctions actor, or exploit.
| Reported point | Reported detail | Key caveat |
|---|---|---|
| USDT received | 120.2 million USDT reached a Tron address on June 11. | The actor and original source of funds remain unknown. |
| USDT frozen | About 72 million USDT was reportedly frozen after a related address was blacklisted. | Tether has not publicly confirmed this specific freeze. |
| Funds moved first | Roughly $48 million appears to have moved before the freeze, based on the reported received and frozen amounts. | The exact split across XMR, exchange deposits, swaps, and bridge routes is still unclear. |
| XMR impact | Reports place the XMR move from about $330 to between $420 and $438. | The peak differs by source and should not be treated as a single settled print. |
That order of operations is the key technical detail. Address-level freeze power applies only after an issuer or monitoring system identifies a token balance that can still be blocked.
In the reported flow, several routes were already in motion before the blacklist entry appeared: centralized-exchange deposit addresses, instant-exchange paths, bridge movement, and XMR orders.
Each route creates a different recovery problem. Exchange deposits can trigger a compliance request, bridge paths require cross-chain tracing, and XMR orders can leave investigators with market impact rather than full transaction visibility.
What Tether could still stop
USDT is a dollar stablecoin issued by a centralized company across multiple blockchains, including Tron. A stablecoin issuer can blacklist specific token addresses and prevent tokens at those addresses from being transferred.
USDT’s market profile identifies issuer controls as a central risk and shows how deeply the token is embedded in crypto plumbing.
USDT is used for trading pairs, dollar settlement, exchange liquidity, DeFi liquidity, payments, remittances, and on-chain transfers. Its usefulness comes from broad distribution and deep liquidity, while its control risk comes from reliance on an issuer that can freeze tokens in some circumstances.
In an April statement about a separate $344 million freeze, Tether said it can restrict assets when wallets are tied to sanctions evasion, criminal networks, or other illicit activity. The company also said it works with more than 340 law enforcement agencies across 65 countries.
That gives the compliance tool its force, and also defines its limit. A blacklist can prevent USDT from being sent to a known address.
It cannot directly pull back value that has already been swapped into another asset, sent to a venue, bridged through another route, or pushed into a privacy system where public transaction details are obscured.
In this case, the freeze appears to have caught the portion still within the controllable USDT layer. The roughly $48 million reported to have moved first is the harder part of the story.
The next stage depends on venue cooperation, off-chain investigation, and whatever traceability remains after the conversion route.
Monero plays a different role from a standard volatile asset in this story. It is one of crypto’s best-known privacy coins, and its design changes what investigators can see after a conversion.
The Monero project says the network prioritizes privacy and uses technologies such as RingCT, stealth addresses, and ring signatures. XMR’s market profile describes it as a privacy-focused asset whose design obscures sender, recipient, and amount data on-chain.
That does not make all Monero activity illicit. Privacy coins are also used by people who do not want balances, counterparties, or spending patterns exposed on public ledgers.
The point in this case is more specific: if suspect funds move quickly enough from transparent stablecoin rails into XMR, public tracing becomes much harder, while the conversion itself can still leave a market footprint.
That footprint was large relative to visible liquidity. CryptoSlate’s Monero market data showed about $319 million in 24-hour XMR volume on June 12.
If roughly $48 million moved before the freeze, that amount would equal about 15% of that daily volume. The comparison is not a precise execution map because the $48 million was reportedly split across several routes, and CryptoSlate’s volume figure was based on live market data.
The pattern also fits a broader crime trend without proving this wallet’s origin. TRM Labs’ 2026 crypto crime report described rising support for Monero-only darknet markets and, in separate sections, faster cash-out and fragmentation behavior among illicit actors.
CryptoSlate has also tracked renewed pressure on privacy coins, driven by Zcash’s challenge to Monero.
The next signal is speed
Tether’s reported freeze did two things at once. It likely stopped a large amount of USDT from moving further, and it showed how little time an issuer may have before a laundering route leaves the part of the stack the issuer can control.
Stablecoin freezes work best while value is still in a token that can be blacklisted. Once funds are split across exchanges, instant swap services, bridges, and privacy coins, the response shifts from direct token control to investigation, exchange cooperation, and market surveillance.
Recent coverage of stablecoin freezes following the Drift and Rhea incidents framed the same tension from a user-protection angle: emergency intervention can stop the theft of funds, but it also concentrates power in the hands of issuers, who can decide when and how to block digital dollars.
The Monero routing adds a second layer. Even when an issuer can act quickly, privacy liquidity can make the next hop difficult to follow.
The next signals are practical. Tether could confirm the specific freeze or explain the basis for blacklisting. Exchanges and swap services could identify downstream deposits. ZachXBT or other investigators could update the trail.
XMR liquidity could show whether the conversion pressure has been absorbed.
Stablecoin blacklist power stopped what remained in USDT. The price impact in XMR showed what may already have left that control layer.