← Back to Delta Incident Archive

VERIFIED SECURITY INCIDENT · DCI-2026-055

TRON USDT issuer blacklists nine addresses in the first batch

One executor completed nine USDT blacklist calls in approximately 132 seconds. All nine targets remained blacklisted at review time, with a combined balance of 1,148,884.816047 USDT; this is a restricted-address balance, not a theft loss, judicial seizure, or recovery.

Incident date2026-07-23 Attack typeIssuer freeze SeverityHigh Involved chainsTRON

Incident overview

The TRON version of USDT supports issuer-controlled blacklisting. The same executor, TRLi4KskHxfACnxKzLrf2wNHauWUQpwziN, made a rapid sequence of blacklist calls. On-chain events prove that the control actions were executed, but public materials do not identify the requester, case, target owners, or source of funds.

Incident sequence

  1. Between 19:25:48 and 19:28:00 Beijing time on July 23, 2026, the same executor submitted nine blacklist calls.
  2. All nine transactions succeeded and emitted AddedBlackList events.
  3. At approximately 13:42 on July 24, isBlackListed(address) returned true for all nine targets.
  4. No corresponding Tether, law-enforcement, or project statement was found, so no judicial, scam-group, or hacker attribution is made.

Fund flow

A blacklist action does not automatically move USDT. Balances remain recorded at the target addresses while ordinary transfer capability is restricted by the token contract. No corresponding DestroyedBlackFunds event was identified, so the assets are not described as destroyed, confiscated, transferred into custody, or returned.

Amount basis

The reviewed balanceOf total across the nine addresses was 1,148,884.816047 USDT. Three publicly monitored addresses accounted for 1,145,218.960414 USDT. This value is not counted as a reported loss; it is recorded separately as an issuer-contract restricted balance.

Addresses and transactions

  1. `TUrrWotgLSKfjskqyBqiVhjzwT4rGBsBGp` — Tx `877f2c5beabaa35937f35185c908ea945880316773a88dd2a402d36e500f48db`; executed at 19:25:48 Beijing time; reviewed balance 703,503.516818 USDT; successful receipt and blacklist status true.
  2. `TTg69pBos1NubduHEpWGfCX2AazYrcvRbn` — Tx `86079f00aae889d4a3bf7231403816f4d5aaaa147a86d714ab28e88b28a0947c`; executed at 19:25:51 Beijing time; reviewed balance 411.764705 USDT; successful receipt and blacklist status true.
  3. `THfcmYTUWMqrMpJgF5vJg1XuSKkjrmRr6X` — Tx `bb635481edcd2fb912a9fadeb7aa7db783543949de6e11faf701aed9742f6f55`; executed at 19:25:51 Beijing time; reviewed balance 6.610611 USDT; successful receipt and blacklist status true.
  4. `TNpXxdcPnC74FvQeoP7DMJq1SsfTQdCX7D` — Tx `18d48143ecc87d57c3a9989fb8521b298243b2c24d1ae5b5bd4a8cf5abb840a6`; executed at 19:25:54 Beijing time; reviewed balance 0 USDT; successful receipt and blacklist status true.
  5. `TAT8fmMQnxfnLDP1RfWNq67j3sF6Tc5Rn8` — Tx `f953c2a104e034d0f2024795982a02a525336dcac74dab413b93b81038551c79`; executed at 19:25:57 Beijing time; reviewed balance 0 USDT; successful receipt and blacklist status true.
  6. `TAQYMKjxYcrtufnezNyZHboWrpLAoLXqKb` — Tx `a6aaa31c805fb721357bccd5140baf85569bb9525a854f2581428bba35347bd1`; executed at 19:26:00 Beijing time; reviewed balance 310,995.950504 USDT; successful receipt and blacklist status true.
  7. `TVPnwjRpChRSwGw4uAGegv7Zio4VUityMy` — Tx `ce72ed734a39845c7eb647671d1073bba145b7077b44e574fea7c25fa5c9c6b1`; executed at 19:26:03 Beijing time; reviewed balance 0.014959 USDT; successful receipt and blacklist status true.
  8. `TCDbAA1gaMCN6LFLKRhRjrxBqwCDYEQxPq` — Tx `e796deea050159beeb60b5be03070c3072ae4cd816c4a6bbc0707247de2851fc`; executed at 19:27:36 Beijing time; reviewed balance 130,719.493092 USDT; successful receipt and blacklist status true.
  9. `TJXdX2idmi8w3saDySsr3MqmKpW8zuftAg` — Tx `cacf5685bea1f46e297b289ab8333066e3461ae22113cf753d5b9fb69adff837`; executed at 19:28:00 Beijing time; reviewed balance 3,247.465358 USDT; successful receipt and blacklist status true.

Evidence boundary

The chain evidence establishes only that the issuer blacklist actions occurred. It does not establish that the nine addresses belong to one case, hackers, stolen funds, judicial seizure targets, or recovered assets.

Current status

All nine targets remained blacklisted at review time and the balances remained at the original addresses. The requester, legal basis, owners, and later disposition were not public; recoveredUsd remains 0.