ZachXBT Traces $120 Million USDT Transfers as Tether Freezes Linked Funds
According to blockchain data shared by ZachXBT, a wallet on the Tron network received roughly 120.2 million USDT before rapidly dispersing funds through exchanges, instant-swap services and cross-chain infrastructure.
Summary:
- ZachXBT traced a $120.2 million USDT transaction trail across the Tron network.
- Tether froze roughly $72 million after blacklisting a wallet linked to the suspected exploit.
- The case highlights the growing role of stablecoin issuers in crypto enforcement.
- Tron remains the primary network for large-scale USDT activity and related investigations.
The movement attracted immediate attention from investigators after large portions of the funds flowed toward Monero, triggering a sharp rally in the privacy-focused cryptocurrency.
The episode offers a real-time look into how blockchain investigators, centralized exchanges and stablecoin issuers increasingly operate as a coordinated enforcement network capable of identifying, tracing and disrupting suspicious financial activity across public blockchains.
⚠️ZACHXBT EXPOSES A $120M USDT EXPLOIT TRAIL
Onchain investigator ZachXBT just flagged a wallet that received 120.2M USDT on Tron before transferring over $20M to KuCoin deposit addresses and instant exchanges.
It then created Monero orders that pushed $XMR from $330 to $420.… pic.twitter.com/Cr3NOgy6NS
— Coin Bureau (@coinbureau) June 12, 2026
Funds Move Across Exchanges and Privacy Networks
The wallet’s activity unfolded rapidly.
Investigators tracked more than $20 million moving toward KuCoin deposit addresses and instant exchange providers shortly after the initial inflow. Additional funds reportedly crossed into Bitcoin and Ethereum ecosystems through bridging infrastructure, creating multiple exit routes for the operator.
The most notable market impact emerged in Monero.
Large buy orders linked to the transaction trail pushed XMR sharply higher, with the token climbing from roughly $330 to as high as $420 within a short period. The surge represented one of Monero’s most significant short-term price moves in recent months and immediately raised concerns among analysts monitoring abnormal trading activity.
Privacy-focused assets such as Monero remain a preferred destination for actors seeking to obscure the final destination of funds because transaction details become significantly harder to trace compared with transparent blockchains such as Bitcoin, Ethereum or Tron.
However, the scale of the purchases appears to have generated enough market disruption to draw attention from investigators before the funds could be fully dispersed.
Tether’s Response Demonstrates Expanding Enforcement Powers
The most consequential development occurred when Tether blacklisted a Tron wallet directly linked to the transaction trail, freezing approximately $72 million USDT.
The action underscores how stablecoin issuers have become increasingly important participants in cryptocurrency compliance and law-enforcement efforts.
Unlike decentralized assets, USDT includes administrative controls that allow Tether to restrict transfers from designated addresses. Once blacklisted, tokens become effectively unusable and cannot be moved through normal blockchain transactions.
The freeze prevented a substantial portion of the funds from leaving the ecosystem and demonstrated the speed at which issuers can now respond when suspicious activity is identified.
READ MORE: Raydium Exploit Targets Dormant Liquidity Pools, Draining $1.3 Million
The incident also reflects Tether’s increasingly aggressive enforcement posture.
Industry reports indicate that more than $515 million in USDT has been frozen across Tron and Ethereum during the past month alone, with Tron accounting for the overwhelming majority of enforcement activity. Tether has previously disclosed cooperation with hundreds of law-enforcement agencies worldwide and reports that more than $4.4 billion in assets have been immobilized through enforcement actions to date.
In many cases, blacklisted funds are eventually removed from circulation through Tether’s “destroyBlackFunds” mechanism, permanently preventing access to the assets.
Why this matters
From an on-chain perspective, the speed at which this attacker moved to Monero ($XMR) suggests a sophisticated level of pre-planning – likely involving automated scripts to hedge against exchange monitoring. While Tether’s $72M freeze is a win, the successful off-ramping of $50M through decentralized bridges highlights the current ‘Achilles’ heel’ of stablecoin enforcement: cross-chain interoperability.
We anticipate that regulators will soon mandate that cross-chain bridge operators implement the same stringent KYC/AML protocols used by centralized exchanges to close this liquidity exit.
Tron Remains the Epicenter of Stablecoin Activity
The case once again highlights Tron’s dominant role within the global stablecoin economy.
Tron has become the largest settlement network for USDT transactions due to its low transaction costs and high throughput. The same characteristics that make the network attractive for legitimate transfers also make it a preferred route for high-volume illicit activity.
As a result, the majority of Tether’s enforcement actions now occur on Tron-based wallets.
Blockchain analysts note that public ledgers create a paradox for bad actors. While funds can move globally within seconds, every transfer leaves a permanent record that investigators can analyze in real time.
Independent researchers such as ZachXBT have become increasingly important in this environment. Their ability to identify suspicious transaction patterns often serves as the first step in a broader response involving exchanges, blockchain intelligence firms and asset issuers.
A New Era of Real-Time Crypto Enforcement
The incident illustrates how crypto enforcement has evolved from reactive investigations into near real-time intervention.
Several years ago, attackers could often move funds through multiple wallets before authorities identified suspicious activity.
Today, blockchain analytics platforms, exchange monitoring systems and issuer-level controls can significantly shorten that window.
The fact that approximately $50 million appears to have moved before the freeze also demonstrates the continuing challenges facing investigators. Once funds enter exchanges, mixers or privacy networks, recovery becomes substantially more difficult.
Even so, the freezing of $72 million represents one of the largest recent examples of issuer intervention successfully disrupting a suspected laundering operation.
For market participants, the event reinforces a broader reality emerging across digital assets: while blockchain transactions remain borderless and instantaneous, the growing involvement of centralized issuers and compliance infrastructure means illicit actors increasingly face a shrinking window in which to move funds undetected.
The outcome also highlights a defining feature of modern crypto markets. Public blockchains provide unprecedented transparency, while stablecoin issuers possess unprecedented control. Together, those forces are reshaping how suspicious activity is identified, monitored and ultimately stopped across the digital asset ecosystem.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Alexander Stefanov
Reporter at CoinsPress
Alex is Editor-in-Chief of Coinspress and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else. It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other. What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn? He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.
