If you've lost crypto to a fake investment platform, a pig butchering scheme, or a withdrawal-fee demand, there's a good chance USDT was involved somewhere along the path. Two separate 2026 industry reports put stablecoins at roughly 84% of illicit crypto activity, by two different measures. Here's why.

The number, from two directions

Chainalysis's 2026 report found stablecoins made up 84% of all illicit transaction volume across every category it tracked in 2025. TRM Labs' separate 2026 report found almost the identical figure, 84%, specifically for fraud inflows, up from around 70% the year before (Decrypt, TRM Labs coverage; The Block, Chainalysis coverage). Two firms, measuring different things, arrived at the same share. That consistency is worth taking seriously.

A steady, predictable balance is exactly what makes a stablecoin useful to a fraudulent platform.
A steady, predictable balance is exactly what makes a stablecoin useful to a fraudulent platform.

Not every stablecoin is used the same way

USDT (Tether) is the stablecoin that shows up most consistently in the fraud cases our investigators work, and it's also the one most consistently cited across the industry reports behind this piece. It isn't the only one in circulation; TRM Labs' 2026 report separately noted a sharp rise in the use of A7A5, a ruble-pegged stablecoin, which transacted more than $72 billion over 2025, mostly in a sanctions-evasion context rather than individual fraud. That's a useful reminder that "stablecoin" isn't a single, uniform category: different stablecoins, with different issuers, different freeze capabilities and different regulatory treatment, tend to cluster around different kinds of illicit activity, which is part of why this piece focuses specifically on USDT's role in fraud rather than stablecoins as a whole.

Why a steady value matters to a fraudulent platform

A stablecoin is designed to hold roughly the same value over time, typically pegged to the US dollar. For a fraudulent investment platform, that steadiness is useful: a balance denominated in a volatile asset like bitcoin could swing in ways that look suspicious or inconsistent with the story being told, whereas a stablecoin balance stays predictable, which keeps the fiction of a real, growing investment intact for longer.

Why liquidity matters to the people moving stolen funds

Beyond keeping a victim-facing balance believable, stablecoins are widely supported across almost every exchange and many DEXs, which makes them easy to move quickly between platforms and across chains. For an operator collecting deposits from many victims and needing to consolidate and launder proceeds efficiently, that liquidity matters as much as the price stability does.

Why bitcoin and ether still appear, just differently

Stablecoins dominating fraud inflows doesn't mean bitcoin and ether are absent from these cases; they typically appear earlier or later in a trace rather than at the point of collection. A fraudulent platform's victim-facing balance and fee demands are usually denominated in USDT specifically, for the reasons above, but proceeds are often swapped into ETH during laundering, the same pattern Elliptic described in the Bybit theft, precisely because ETH carries no issuer that can blacklist an address the way a stablecoin's issuer can. Bitcoin shows up less consistently in the fraud cases our investigators work than in the state-sponsored theft cases, where it remains a significant store of stolen value alongside ETH. Which asset appears at which stage of a trace is itself a signal worth documenting, not just a detail to note in passing.

One important difference from bitcoin: issuers can freeze funds

Unlike bitcoin, where no central party can block a transaction, major stablecoin issuers including Tether can blacklist specific addresses, which stops the tokens held there from being moved any further. This capability has featured directly in several real freezes tied to fraud investigations: Tether froze more than $1.567 billion in USDT connected to the October 2026 Binance breach, and separately helped US authorities freeze funds in multiple pig butchering cases, including a 2025 civil forfeiture complaint covering roughly $225 million. Pig butchering by the numbers covers that case and a related one in more detail.

How a freeze actually works

Freezing isn't instant and it isn't automatic. It typically follows a sequence: an investigator or law enforcement identifies the specific address or addresses holding funds tied to a reported fraud, documents the trace connecting those addresses to the reported loss, and submits a request to the stablecoin issuer or the exchange holding the funds. The issuer or exchange then reviews the request before acting. Tether's freeze of more than $1.567 billion tied to the Binance breach, and its earlier freezes tied to pig butchering cases including the roughly $225 million 2025 forfeiture, both followed this pattern: documented tracing first, a freeze request second, action third. None of it happens the moment funds move; it depends on the trace being built and the request being made before the funds move again.

The limits of freezing

It's worth being precise about what a freeze can and can't do. A freeze stops specific tokens at a specific address from moving further; it doesn't undo the original transfer or automatically return anything to the person who lost it. Funds that move through a mixer, a bridge, or a swap into a different asset before a freeze request is made are generally no longer reachable by that specific freeze, which is exactly why speed, and a documented trace completed quickly, matters as much as the freezing capability itself. A freeze is also only ever decided by the issuer or exchange holding the funds, based on a request from law enforcement or through their own compliance process; it isn't something a tracing investigation can compel on its own.

Still traceable the same way

None of this changes the basic mechanics of a trace. Most stablecoins, including USDT, run on public blockchains like Ethereum and Tron, so every transfer is recorded permanently and publicly, the same as a bitcoin or ether transaction. How tracing works applies to a stablecoin hop exactly as it does to any other: an investigator follows the transaction hash, confirms the amount and timing, and continues from there.

What this looks like in a documented trace

In practice, a stablecoin-heavy trace reads much like any other, just with more of its hops denominated in USDT than in bitcoin or ether. An evidence report covering such a case will typically show an initial deposit in USDT, one or more hops through intermediate wallets, possibly a swap into another asset for part of the journey, and a final deposit to an exchange, each step carrying its own transaction hash, timestamp and amount. The presence of a stablecoin doesn't change the structure of the report; it changes which specific tools, issuer freeze requests alongside exchange freeze requests, are available at each step.

A shift toward less-regulated platforms

TRM Labs' 2026 report noted an uneven trend worth flagging: stablecoin flows to sanctioned entities and jurisdictions fell by nearly 30% on exchanges that run know-your-customer checks, but rose by more than 200% on decentralised services and exchanges without those checks. That pattern, activity moving toward platforms with the least oversight rather than disappearing, is consistent with what blockchain basics describes about why regulated exchanges matter: they're the point in a trace where a freeze request can actually be acted on.

What this means for different audiences

For individuals, the practical takeaway is that reporting quickly matters more with stablecoins than with some other assets, specifically because a freeze request only works before the funds move again, not after. The sooner a trace is documented, the more of the path is still reachable.

For exchanges, the freeze mechanism only works as well as the monitoring that identifies a flagged address in the first place; screening incoming stablecoin deposits against shared fraud intelligence, not waiting for a formal freeze request to arrive, closes part of that gap.

For banks, the shift toward decentralised, non-KYC platforms that TRM Labs reported is a reminder that a customer's crypto activity moving away from regulated exchanges isn't neutral; it often tracks with exactly the kind of fraud and sanctions-evasion activity covered here.

Key takeaways

  • Stablecoins, mainly USDT, made up roughly 84% of illicit crypto volume industry-wide in 2025, by two separate measures.
  • Price stability keeps a fraudulent platform's displayed balance credible; liquidity makes proceeds easy to move and consolidate.
  • Stablecoin issuers can freeze specific addresses, a capability used in several real fraud-related freezes, but only before funds move onward again.
  • Stablecoin transactions are recorded on the same kind of public ledger as any other crypto asset and are traced the same way.

Further reading