TL;DR: On May 4, 2026, between 14:11:06 and 14:12:18 UTC, Tether’s multisig submitted 19
addBlackListproposals targeting Tron addresses tied to the collapsed DSJ Exchange / BG Wealth Sharing Ponzi — and executed all of them in a single transaction batch. Total frozen: $38,430,800.62. Average freeze gap: 70 seconds. Escapes during the gap: zero. The batch is the largest single-block USDT freeze on Tron we have on record — 4.4× larger than the previous biggest batch. ZachXBT, who coordinated the takedown with Tether, Binance, OKX, and U.S. law enforcement, says the wider scheme moved over $150M, with $92M laundered cross-chain in the week before the freeze. Total recovered so far: ~$41.5M, or about 28%.
At 14:11:06 UTC on May 4, 2026, the Tron USDT multisig started submitting addBlackList proposals targeting wallets controlled by a Ponzi that called itself DSJ Exchange. There were 19 of them. Three seconds later, all 19 sat on-chain, and 72 seconds after the first proposal landed, every one had executed. The batch locked $38.4 million across 19 addresses in a single transaction.
In the entire history of Tron USDT blacklisting, no other coordinated batch comes close. The next biggest — eight addresses, $8.72 million, on March 31, 2026 — is less than a quarter of the volume. We confirmed the result with two separate analysis pipelines (Python with psycopg2 and Go with pgx/v5), which returned identical numbers.
The targets had a name: DSJ Exchange, also written as DSJEX, the trading-platform front for a Ponzi called BG Wealth Sharing. According to on-chain detective ZachXBT, who disclosed the takedown on May 5, the operation had moved over $150 million through deposits since 2025, and had quietly bled $92 million through cross-chain bridges and DEX aggregators in the seven days before the freeze.
This wasn’t a routine blacklist. It was a coordinated lockdown — Tether’s multisig signers acting alongside Binance security, OKX, and U.S. law enforcement, all working off ZachXBT’s investigation. On the Tron side, when the moment came, every proposal landed at once.
The Block-Level Lockdown
Most Tron USDT freezes happen one address at a time. A multisig signer submits an addBlackList proposal, other signers confirm, and once the threshold (currently 2-of-N) is met, the freeze executes. On Tron, where multisig latency is short, the typical gap is about 60 to 80 seconds. That gap — what we call the freeze gap — is the window we previously analyzed and found exploited 449 times for over $215 million in escaped funds.
May 4 was different in scale and synchronization, though not in length: the gap was a normal 70 seconds. Here are all 19 addresses in the main batch, frozen at 14:12:18 UTC:
Total: $38,430,800.62 across 19 addresses, all executed in the same transaction batch at 2026-05-04 14:12:18 UTC.
What the Distribution Tells Us
Figure 1 plots the 19 main-batch addresses by frozen amount. The $38.4 million wasn’t evenly spread: one address — TAQa4FZweNjbxq69adEhPnFQeKZqkN1pJa — held $9.43 million by itself, about a quarter of the total.
A look at the recent inflow into that wallet shows the consolidation pattern you’d expect when an operator is stitching together small deposits into a single spend wallet before pushing them out: between 07:19 and 07:54 on May 2, four transfers totaling $2.4 million arrived from a single feeder address, TKPTe5J5NzXyscatzqVmjrjWPy4av3mjfr.
The remaining 18 addresses fell into two clean tiers:
- 11 wallets in the $2M tier — ten at exactly $2,000,000.00, one at $2,000,010.54
- 7 wallets in the $1M tier — five at exactly $1,000,000.00, plus $1,000,010 and $1,000,008.08
That kind of round-number layering — $1M, $2M, $1M, $2M — is the signature of a manual operator funding hot wallets in fixed lots, rather than a smart-contract distribution or an automated sweep. Someone was topping up wallets by hand, probably ahead of a payout that never came.
The three odd amounts ($2,000,010.54, $1,000,010.00, $1,000,008.08) look like “deposit-plus-yield-credit” top-offs, where the wallet got funded with a round amount and then later picked up a small fee or interest accrual. Inside a Ponzi, those micro-adjustments usually point to an internal accounting layer that mimics yield — books moving rather than a real product. The amounts are too round for legitimate trading P&L; they’re rationing.
Why Zero Escapes
We covered the freeze-gap problem in detail back in February. Across 8,310 executed Tron and Ethereum freezes, 449 — or 5.4% — saw at least one outgoing transfer between proposal submission and execution. Total escaped: $215.5 million. The 2025 figure alone was $141.7 million.
So the natural question for May 4: how many of the 19 addresses ran for the door during their 70-second freeze gap? We ran the same query through our Python and Go pipelines against the on-chain dataset; both returned the same answer: zero. No transfers from any of the 19 wallets during the 69-to-72-second window when each proposal was on-chain but not yet executed.
Statistically, that’s not what we’d expect. A 5.4% historical escape rate predicts roughly one of the 19 to bolt; the Tron-specific 6.2% rate from 2025 predicts slightly more. Neither happened. When 19 addresses get hit at once, the operator has to choose which to drain in 70 seconds, and the DSJ operator chose none.
Choosing all wasn’t really an option anyway. Rescuing $38.4 million in 70 seconds would mean broadcasting 19 separate transfers, signing each one, and getting them confirmed inside the freeze window. Tron block time is about 3 seconds, which leaves a 23-block budget — doable for one or two transfers, not for 19. Even with pre-signed transactions and a hot signer, you’d be racing your own nonce ordering, gas estimates, and contract reverts at that volume.
The DSJ operator didn’t try. There were no partial drains, no pending broadcasts in the relevant blocks, nothing that looks like a panicked button-press. In our $215M analysis, successful escapes typically happened 12 to 24 seconds after proposal submission — well inside the gap. Operators who escape are operators who are watching live; the DSJ operator wasn’t.
Figure 2 lays out the timeline from 14:11:06 to 14:12:18, with the gap shaded. Every wallet sat untouched through the entire window.
One thing the chain can’t tell us: whether the operator knew the freeze was coming and decided not to fight, or whether the batch genuinely caught them flat. The trace shows only that nothing tried to leave.
Behind the Numbers: What DSJ Was
The addBlackList proposals don’t tell you why a wallet is being frozen. The why came from ZachXBT’s disclosure, confirmed by parallel warnings from regulators across at least five jurisdictions.
DSJ Exchange — DSJEX — was the front-end. BG Wealth Sharing was the recruitment layer. Together, they ran what BehindMLM categorizes as a “click-a-button” Ponzi: users were told to deposit USDT, then paste “trading signals” sent over WhatsApp, BonChat, and Telegram into a fake trading platform that displayed fabricated gains.
The pitch was 1.3% to 2.6% daily returns — numbers that compound to doubling your money in roughly 60 days, which should have been a tell. Recruiting ran on multi-tier referral commissions. Credibility came from a fictional CEO named “Stephen Beard” (no such person exists). Evasion came from rotating domains: bg877.com, bg661.com, dsjex.net, dsj89.com, dsjex123.com, and at least a half-dozen variants.
Regulators saw it well before the chain action. Alberta’s Securities Commission issued a warning on February 17, 2026. Utah’s Department of Commerce followed on March 10. Washington State’s DFI warned on April 10. Tonga’s reserve bank issued its own alert about the diaspora-targeted variant — DSJ was actively recruiting Tongan, New Zealand, and Australian victims. Nauru’s Financial Intelligence Unit did the same, noting that the BG Wealth app contained malware that exfiltrated user data alongside the financial harm.
None of those warnings froze a dollar.
That gap deserves some weight. Five jurisdictions, the earliest more than two months before the freeze, all telling the public these wallets were tied to a scam — and none of them had the unilateral authority to lock the funds. Stablecoin freezing sits outside the regulatory perimeter most consumer-protection bodies operate inside, so the agencies could warn but couldn’t act on-chain.
Then on May 2, the operators did what every collapsing Ponzi does: they invented a reason to demand more money. According to IFW Global’s scam summary, participants were told the project was about to IPO and that they’d need to pay a 12% “tax” before withdrawals could resume. Withdrawals were already disabled. The 12% was the exit-pump — squeezing the last yield out of victims who still wanted to believe the trade was real. Tether locked the wallets two days later.
The Money That Already Left
The $38.4 million figure is smaller than it looks. ZachXBT’s investigation tracked roughly $92 million moving through the network between April 27 and May 3, the seven-day window between Washington’s warning and the freeze. Most of it went out the door before any address in the May 4 batch was tagged.
The reported routing path:
- Cross-chain bridges, including Bridgers, Butter Network, and USDT0, to push value off Tron and onto chains where Tether can’t unilaterally freeze
- USDD wrap-and-unwrap loops to obscure the trail through a stablecoin Tether doesn’t issue
- Final landings at exchange deposit addresses and OTC-cluster wallets
Each is a different kind of obstacle for recovery. Bridges add a finality lag plus a destination chain where the recovery toolset is different. USDD is a Tron-native algorithmic stablecoin; wrapping into it and back out smears the trail without leaving Tron’s native infrastructure. And once the funds reach exchanges or OTC desks, recovery becomes a legal-process problem rather than an on-chain one.
The total recovered so far, per ZachXBT, is about $41.5 million. The Tron USDT freeze just walked through accounts for $38.4 million; the remaining ~$3.1 million came from coordinated action by Binance, OKX, and other platforms holding fiat ramps tied to the operation. Against the $150M+ ZachXBT cites for total deposit volume, that’s a recovery rate of roughly 28%.
Not a great number for victims, but not a surprising one. By the time a Ponzi visibly collapses, most of what’s coming out has already come out — usually weeks or months earlier, in the slow drip of operator skim. The freeze that lands at the end isn’t really a recovery; it’s a containment. The $92M isn’t coming back. What the freeze does is stop the next $38.4M from joining it.
The plausible upside in cases like this lies upstream: faster regulator-to-issuer pipelines, pre-tagged wallet clusters that can be batch-frozen ahead of public collapse. None of that existed for DSJ. The freeze landed only after collapse, which capped what could be saved.
Why This Freeze Was Faster Than Most
The 70-second average gap on May 4 is fast, but not record-fast for Tron. We’ve seen Tron multisig batches execute in under 3 seconds when signers were already aligned — a 23-address batch on March 11, 2026 averaged 2.7 seconds. What made May 4 unusual wasn’t the gap. It was the simultaneity.
To see why simultaneity matters more than gap length, look at how a Ponzi operator typically reacts to a single freeze:
- They monitor the multisig contract for incoming
addBlackListproposals (this is something many operators automate — the contract is public). - When a proposal targeting their wallet lands, they have ~70 seconds to broadcast a transfer out before execution.
- If they’re prepared — pre-signed transactions ready, automation watching the mempool — they make it.
That’s what we see across the 449 historical escapes. Most operators run scripts that auto-drain on proposal detection, and the escape rate climbs when those scripts are well-tuned. It’s particularly high — 6.2% on Tron in 2025 — for operators running active drain bots.
The failure mode of those bots is the interesting part. They’re built to handle one address at a time. When 19 proposals arrive in a 3-second window, all targeting wallets controlled by the same operator, the drain logic doesn’t scale: each drain transaction has to be signed, broadcast, and confirmed, and each one fights the others for slots in the same operator’s nonce sequence. The signing capacity is bounded, and 19 simultaneous proposals blow past that bound regardless of hardware or how well-written the script is.
Call it a simultaneous-batch defense: by overwhelming the operator’s reaction-window capacity, the multisig closes the freeze gap that would have existed for any single address. The gap isn’t shorter, it’s just uncrossable at that volume. Figure 3 shows the structural difference between a single-address freeze (which a typical drain bot can defeat) and a coordinated 19-wallet batch (which it can’t).
The defense pattern depends on three things:
- Pre-positioned multisig signers, ready to confirm in seconds rather than minutes, with the address list pre-distributed
- Coordinated submission, with all proposals hitting on-chain in close succession (3 seconds, in this case)
- Address-list completeness, so no obvious successor wallet remains usable after the batch
ZachXBT’s coordination with Tether, Binance, and OKX provided the first two. Address-list completeness is the part we can’t fully evaluate from on-chain data alone.
Putting May 4 in Context
To rank what happened, we pulled every Tron USDT batch freeze where a single execute timestamp covered five or more addresses, ordered by total amount. The query was cross-validated in Python and Go.
| Rank | Date (UTC) | Addresses | Total Frozen | Avg Gap |
|---|---|---|---|---|
| 1 | 2026-05-04 14:12:18 | 19 | $38,430,800.62 | 70.3s |
| 2 | 2026-03-31 20:57:15 | 8 | $8,724,744.65 | 74.6s |
| 3 | 2026-03-27 19:32:24 | 7 | $5,570,189.95 | 71.1s |
| 4 | 2026-03-31 20:57:18 | 7 | $4,171,169.54 | 74.1s |
| 5 | 2026-03-27 19:32:27 | 9 | $3,776,144.95 | 71.0s |
The DSJ batch is 4.4× larger than the previous record. Across the entire history of Tron USDT batch freezing in our dataset — going back to 2020 — no single coordinated batch comes close.
A more useful frame than the headline chart: out of the more than $1.29 billion frozen on Tron USDT in 2026 to date, the DSJ batch accounts for roughly 3% of the year’s total in a single 72-second afternoon window — one operator, one scheme, one coordinated takedown. As more time passes, this is going to be the case study compliance teams cite when they explain what coordinated freezing looks like at scale.
What This Case Shows
The biggest variable in recovery isn’t how fast the multisig signs — it’s whether the wallet has anything in it when the proposal lands. By the time the May 4 batch hit, $92M had already laundered out in the prior week, so the freeze locked $38.4M, but the recovery cap was set seven days earlier. A compliance pipeline that gets a 7-day jump on detection beats a pipeline that shaves 15 seconds off signing. And the 28% recovery rate is roughly the realistic ceiling for late-stage Ponzi takedowns: by the time a scheme visibly collapses, most of what’s leaving has already left, so freezing-after-collapse is containment, not recoupment. The wins are upstream — in the months when victims are still depositing and the operator is still skimming. May 4 was the right action; it just wasn’t the right timing for a higher recovery share.
Cross-chain laundering remains the unplugged hole. The $92 million that moved between April 27 and May 3 went through DEX aggregators, three bridges, and a wrapped-stablecoin loop. Stablecoin issuers can freeze on their native chain, but they can’t undo a bridge transit, so recovery is bounded by how much of the laundered volume exits the issuing chain. And while five jurisdictions warned about DSJ between February 17 and April 27, none of those warnings stopped a single dollar from leaving. Stablecoin governance is where action happens on-chain; everything else is signaling. Compliance teams that treat regulator advisories as triggers rather than endpoints catch operations earlier.
The May 4 batch also makes a structural point about defense design. Submitting 19 proposals in 3 seconds didn’t just save signer time — it overwhelmed the operator’s reaction window in a way no single-address freeze can. When targeting a connected cluster, bundling is a defense rather than a workflow nicety. The win is in the simultaneity, not the speed.
A Note on Phalcon Compliance
We track every executed and pending freeze proposal across Ethereum and Tron USDT in the BlockSec USDT Freeze Dashboard. The 19 main-batch addresses are all linked above. For compliance teams that need real-time alerts on freeze proposals targeting wallets in their portfolio — including the freeze-gap window where escape transfers are still possible — the Phalcon Compliance product runs the same data through a screening API.
For DSJ, the data was always there. The freeze landed because someone — ZachXBT, in this case — connected the laundering trail back to a clean address list, and the multisig signers were ready when the batch hit. That coordination is the part that takes weeks of investigative work; the on-chain execution, once you have a clean list and aligned signers, is a matter of seconds.