Tainted USDT Multi-Hop Without Overclaim

“Tainted USDT” is a sentence about history, not a second token. Every USDT unit is fungible at the contract. There is no taint bit in the bytecode. The phrase means: this address’s funding path carries a realistic chance of issuer, venue, or counterparty review because of where the coins were before they arrived. FreezeRadar’s glossary already owns that definition: Tainted USDT. The method for walking hops is two-hop exposure analysis. This post is the desk language layer: what you may write in a ticket, what you must not write, and how hop distance, service boundaries, and confidence stop you from overclaiming.

Educational only. Not a legal conclusion. Not a guide to wash history or evade a freeze.

Direct answer

Say “this wallet has a one-hop, source-backed path to [label/list]” or “this wallet is two hops from [label], attribution confidence [x], path crossed [exchange/bridge/unknown].” Do not say “these USDT coins are tainted” as if serial numbers were dirty. Do not say “sanctioned” unless a primary sanctions list matches. Do not say “will be frozen.” Issuer freeze is a privileged contract call; venue hold is a private score. Multi-hop exposure can be material and still be weaker than a direct blacklist or a direct SDN address.

Why desks overclaim

Three pressures:

1. Clients want a villain. “The sender is a scammer” is easier than “one-hop high-risk label, hop-2 mixer, coverage truncated.”
2. Chat culture. Screenshots of red dashboards travel faster than coverage notes.
3. Fear of underclaiming. After one bad receive, teams start calling every two-hop path a freeze.

Underclaiming is also a failure. Issuers and exchanges do look upstream. FreezeRadar exists because first-hop-only screening is a blind spot. The job is proportion, not panic.

A language table for IR notes

You observed	Allowed sentence	Disallowed sentence
Official USDT isBlackListed true	“Issuer blacklist true on this contract at this time.”	“OFAC sanctioned this wallet” (unless the list match is real)
Direct SDN / official list address	“Direct sanctions address match on [list].”	“Therefore Tether will freeze tomorrow.”
One-hop mixer label, source + confidence	“Direct mixer interaction (MIXER_INTERACTION).”	“They laundered the funds, so we should mix them back.”
Two-hop sanctions path, intact hops	“Two-hop sanctions exposure; see finding and evidence.”	“This is a sanctioned person.”
Path through a reputable exchange deposit	“Attribution attenuates at a service boundary.”	“Exchange made it clean.”
Unknown counterparties, truncated window	“Coverage limited; confidence capped.”	“No history means no risk.”
Composite score HIGH	“Score [n], category HIGH, drivers […].”	“Illegal funds.”

Product truth: FreezeRadar findings carry rationale, evidence, confidence, and score impact. The catalog is public at patterns. Scoring math stays on methodology. This page does not re-explain weights.

Hop distance is not a washing machine

Hop distance is the number of transfers between a wallet and a risky address. One hop is direct. Two hops is the counterparty’s counterparty. Risk generally falls as hops increase, and not to zero, and not linearly. A three-hop path through a thin chain of fresh wallets can still be a review. A two-hop path that hits a large omnibus exchange can lose attribution.

FreezeRadar’s engine encodes that distinction in finding types (direct match, one-hop, two-hop, three-hop for sanctions; mixer interaction is direct / one-hop only). Standard scans add a budgeted targeted two-hop for selected roots. Deep scans walk further upstream for inbound freezeable provenance, with truncation disclosed. “We did not see it in the window” is not “it never happened.”

Standard guardrails (targeted two-hop) and deep guardrails (upstream provenance) are operational limits. They are not a forensic certificate of the entire chain history. If analysisCoverage or deepScanCoverage says truncated, write that in the ticket.

Service boundaries

If funds pass a labeled reputable exchange, FreezeRadar can record a service boundary and attenuate upstream confidence. That is not a moral bath. It means you should not narrate the pre-exchange world as if it were still a private chain of hops you fully own. It also does not mean the exchange will credit your later deposit. Venues rerun their own graphs.

Bridges are similar: they complicate tracing; they are not a delete key. Bridge exposure is a finding, not a cleansing ritual.

Attribution confidence

Attribution confidence is how sure the label is. Official list hits are not the same as a community tag. FreezeRadar scoring is supposed to use attribution that carries a source and a confidence. A name in a spreadsheet with no source should not become “Binance” or “mixer” in a client email.

If you cannot cite the source, you do not have an attribution. You have a hunch. Hunches can justify a Review bucket. They cannot justify a public accusation.

Freezeable stables change the stakes

On ETH as ETH, a messy graph is often a venue or reputation problem. On USDT/USDC it can become spendability: the issuer can blacklist the address you now hold. That is why mixer proximity and freezeable stables are discussed together on mixer detection. Multi-hop taint is the same idea without the mixer: upstream theft, scam, or sanctions paths can later coincide with an addBlackList you did not see coming.

Still: coincidence of a two-hop path and a later freeze does not prove your desk “caused” the freeze, and it does not prove the tokens were uniquely marked. It proves you needed records.

What FreezeRadar will and will not say for you

A scan can say:

• direct issuer blacklist match (critical freeze signal)
• direct sanctions match
• hop-coded exposures when labels exist
• coverage and confidence limits
• deep provenance heuristics for current balance shares on a deep scan, split official sanctions vs curated risk

A scan will not say:

• this customer is a criminal
• these specific coins are the stolen ones (fungibility)
• Tether or Circle will act on this score
• mixing will help (it will not; it worsens posture)

Deep provenance findings (DEEP_BALANCE_OFFICIAL_SANCTIONS_PROVENANCE vs DEEP_BALANCE_CURATED_RISK_PROVENANCE) must stay split. Curated high-risk is not an official sanctions flag. If you collapse them in a client memo, you overclaim.

Worked phrasing (copy and shorten)

Too hot: “Sender is sanctioned, funds are tainted, do not touch, Tether will burn this.”

Proportionate: “Sender address not on the issuer blacklist at 12:04 UTC. Scan [url]: no direct sanctions match. One-hop label HIGH_RISK_EXCHANGE (source X, confidence Y). Two-hop path toward a mixer-labeled cluster with hop decay; targeted two-hop reviewed N of M roots, truncated because [reason]. Recommendation under policy: Review, do not auto-block, do not auto-accept. Records attached.”

That paragraph is what an auditor can stand. The hot sentence is what a lawyer has to unsay.

Underclaiming: the other failure

Teams that only block direct blacklist true will accept one-hop mixer USDT all day and then act shocked at a venue hold. One-hop mixer on freezeable USDT is a high-severity behavioral finding (MIXER_INTERACTION, scoreImpact 78 in the public catalog). Two-hop sanctions is weaker than one-hop and still not “fine.” If your policy is “direct flags only,” write that as a policy choice, not as a claim that two hops are harmless.

Ban-wave weeks make the language worse

When freezes cluster, chat fills with “everything two hops out is dead.” That is not how the contract works and not how FreezeRadar scores. A ban-wave is a burst of privileged addBlackList (and sometimes destroy) calls. It is not a license to relabel every indirect path as a direct hit. Keep the same table. If you need cluster operations, that is a later desk playbook (how a USDT ban wave looks), not a change to hop semantics.

Evidence you should attach so the sentence stays honest

• Explorer URLs for the hops you actually reviewed
• Label source and captured date, not “someone said”
• Scan URL with analysisCoverage (tracked transfers, truncation reasons)
• Whether the path was inbound freezeable USDT or a different asset you are analogizing
• Timezone on every timestamp

If you cannot attach those, shorten the claim. A short accurate note beats a long reconstructed thriller.

Related FreezeRadar surfaces

• Glossary: tainted USDT · hop distance · provenance
• Academy: two-hop exposure · mixer detection
• Received frozen USDT desk IR
• Methodology · Patterns · Scan

Honest limits

Graphs are incomplete. Labels are late. Issuers do not publish their full heuristic. FreezeRadar’s Standard mode is a targeted two-hop, not a full crawl. Deep mode is budgeted upstream provenance, not a courtroom exhibit. Unknown attribution must not be converted into extra risk points. If you need a legal determination, that is counsel and primary lists, not a blog.

Key takeaway

Tainted USDT is provenance language. Keep hop, source, confidence, and coverage in the sentence. Do not stain the token, do not upgrade a label into a sanctions listing, and do not promise a freeze. Screen before you take the coins (OTC pre-settle checklist), then write notes a future you can defend.