Stablecoin issuers can freeze tokens, and that capability is now a selling point. It's also a source of legal exposure. When a theft puts roughly $6.3 billion in motion and an issuer freezes $823 million of stolen USDC within minutes, it's easy to conclude the system works. The reality is more complex, and if your institution is moving into stablecoin services, understanding the gaps is crucial.
These myths persist because the freeze capability looks like a clean off switch. Compliance teams are used to sanctions regimes where Freezing Without Delay is a defined legal duty under FATF Recommendation 6 and Recommendation 7. Stablecoin freezes feel similar, but the legal footing is different and still unsettled.
Myth 1: Issuers freeze funds because the law tells them to
Reality: Until the GENIUS Act takes effect on Jan. 18, 2027, each issuer largely decides when to freeze. Even after that date, the Act requires compliance with "lawful orders," defined as final orders from a court or authorized federal agency that identify the tokens or accounts with reasonable particularity. It requires issuers to obey those orders but doesn't specify whether an issuer may freeze without one.
Circle's history shows the gap. In April, it stated it freezes only when "legally compelled by an appropriate authority, through lawful process," and did not intervene during an eight-hour theft of about $230 million in USDC from Drift. In May, it added a third exception to its Stablecoin Access Denial Policy for "certain urgent law enforcement requests pending a valid court order." That's a policy choice, not a statutory command.
Myth 2: A freeze on law enforcement request is legally safe
Reality: An urgent request awaiting a court order doesn't meet the GENIUS Act's definition of a lawful order. That leaves the issuer carrying the risk. As one London lawyer put it, until there's a court order, "issuers are responsible for their own actions," and innocent bystanders hurt by a freeze might look to the issuer for compensation.
The core problem is verification. When nobody independent has checked the request, an issuer could freeze the wrong wallet. For your team, the question isn't whether the issuer acted in good faith. It's who absorbs the loss if the freeze is wrong, and whether your contract addresses this.
Myth 3: Fast freezing means stolen funds are recoverable
Reality: Speed helps, but it doesn't beat the attacker's options. In the Binance incident, about $3 billion of the stolen assets had been frozen as of Friday, and multiple issuers, including Tether and Ripple, froze tokens. Yet the thieves swapped some stablecoins for ether before issuers could act and held roughly $2.4 billion in ether and bitcoin, which no issuer can freeze.
The sequence on the public ledger shows the race. Funds moved at 4:24 p.m. ET, Tether blacklisted the wallet at 5:01, and Circle at 5:04. Anything converted into non-freezable assets in that window is beyond reach. Treat freeze capability as one control, not a recovery guarantee. Your transaction monitoring rules and exposure limits still need to assume some losses will occur.
Myth 4: Issuer freeze policies are stable and transparent
Reality: Circle changed its policy in May and didn't announce it. The change surfaced months later in a footnote to a June 22 court filing in a lawsuit over the Drift theft. Plaintiffs in that case have since filed a discovery motion asking why the policy changed.
If you rely on an issuer's freeze behavior in your risk assessment, you're relying on a document that can be rewritten quietly. Build contractual notice requirements for policy changes into your issuer agreements, and monitor published policies on a defined schedule rather than assuming last quarter's version still applies.
Myth 5: Freeze decisions are purely a compliance matter
Reality: Commercial relationships complicate the picture. Binance bought $100 million of Circle shares in September, and Circle pays Binance a monthly incentive fee for promoting USDC under a five-year agreement. Circle's spokesperson didn't say whether that relationship played any role in the freeze. There's no evidence it did, but the point stands: when an issuer's partners, shareholders, and victims overlap, you should expect questions about consistency.
Consider the contrast. Drift's loss went unfrozen; Binance's was frozen within minutes. A bank partner has to be able to explain that difference to its own customers and regulators. Inconsistent treatment erodes the customer trust that stablecoin products depend on.
What to do instead
Treat the freeze policy as a core product feature and a legal liability at the same time. Practical steps for your compliance team:
- Map the legal basis for every freeze scenario. Separate freezes under a court or agency order, sanctions-driven freezes, and discretionary freezes on law enforcement request. Document which your institution will act on and which it will decline.
- Write customer terms for foreseeable hacks. If stolen stablecoin could be frozen, partially frozen, or left unfrozen, say so explicitly. A cybersecurity professor noted these risks are entirely foreseeable and that banks should weigh whether the downside is worth the gains.
- Diligence your issuer partners. Ask for their access denial policy, change history, internal approval path for urgent requests, and indemnity terms if a freeze hits the wrong wallet.
- Plan for the unresolved rules. The OCC's final rule implementing the GENIUS Act, issued Oct. 21, doesn't define "freeze" or "seize." Those questions are left to a forthcoming rule on anti-money laundering and sanctions compliance. Your AML/CFT framework should be reviewed once that rule lands.
- Assume freezes are partial. Escalation to MLRO, law enforcement coordination, and loss reserves should all work on the assumption that conversion into non-freezable assets will happen.
The Binance freeze showed what rapid issuer action can do. It didn't settle who's liable when that action is wrong, and your institution will be asked.
