A flagged deposit joins your existing balance
An address shows up in a blacklist search, and a transfer from it is already in your wallet. The ERC-20 and TRC-20 token standards behind USDT both keep a single balance per address. A transfer adds straight into that balance, so the deposit is never held apart from funds you already had. Your wallet has no setting that cordons off one deposit. What you can decide is whether to move any of the balance while you find out where the transfer came from.
Four checks before you decide what to do with it
Work through these in order. Each one rules out a different way the deposit could be riskier than it looks.
- Confirm the contract. Genuine USDT exists on one contract per network: TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t on TRON and 0xdAC17F958D2ee523a2206206994597C13D831ec7 on Ethereum. A token with the same name sitting on a different contract is not Tether's USDT, no matter what the sender called it.
- Pull up the transfer on an explorer. Search the sending address or the transaction hash on Tronscan for a TRON transfer or Etherscan for an Ethereum one, and you get the sender, the recipient, the contract, the amount and the time of the transfer in one view. Write down the sender address exactly as it appears.
- Run the sender through our wallet checker. It reads the address's own transaction history and shows its exposure, meaning how closely that history links it to wallets already flagged as risky. If it shows no exposure, nothing in the sender's past points to trouble, and you can go on to document the deposit. If it shows any exposure, hold the funds and go straight to the next step.
- Document the deposit and hold it. Save the transaction hash and a screenshot of the explorer page showing the sender address before anything changes, and do not move the deposit while you wait. If the funds sit on an exchange or with a custodian, tell them what arrived and when: a compliance team can act faster on a deposit you report than on one it has to find for itself.
What our freeze record shows about addresses like this one
Here, "blacklisted" means Tether's own contract has blocked the address from moving tokens after an on-chain freeze proposal. That is a separate event from any hold your exchange places on your account. At TrustSniffer we watch those proposals before they execute, and since 2026-07-14 we have flagged 1,067 wallets as freeze targets. Of the 1,066 flagged wallets with a known outcome, 1,061 were frozen, a 99.5% hit rate. Together they held $436.3 million when the freeze landed. Once a proposal names an address, the record shows that a freeze follows.
Freezes land fast. On TRON, 969 of those freezes landed a median 5 minutes after we flagged them. On Ethereum, 88 cases took 33 minutes on average. Across both networks the typical gap is 6 minutes, and one freeze in ten took 3.2 hours or longer. Pending proposals are published without the address or the exact amount until the freeze executes, so whoever holds the funds only learns of a freeze after it lands. That is why the checks above happen after the deposit arrives.
A freeze on one network can reach a linked address on another
One key or seed phrase can generate an address on TRON and another on Ethereum, and both belong to the same owner. In the freeze record described above, four wallets were frozen only because the matching address on the other network, made from the same key, had just been frozen. We had no separate signal for any of the four. This matters to you only if one of your own addresses is ever frozen. If it is, check every address made from the same key or seed, on each network you use, as well as the chain where this deposit landed.
What a clear result settles, and what it leaves open
If the contract matches Tether's real one and the wallet checker shows no exposure for the sender, you have ruled out two known problems: a lookalike token and a sender with a visible trail behind it. You can also see whether the sender appears in the live USDT freeze tracker, which lists every wallet we flagged before the issuer froze it.
If the sender does carry exposure, or the results are mixed, hold the funds and ask your exchange or wallet provider how they want to handle the deposit. Holding costs you nothing. If you forward the deposit before you know where it came from, you can't take that step back.
Related reads: if the deposit was a small one from a stranger, received random USDT from an unknown address covers dusting and address poisoning. If an exchange has already put a hold on your account, exchange froze account after a USDT deposit lists what to send support. If you are the one who sent funds to a frozen address, see USDT sent to a frozen address.
