Analysis code and outputs: cryptocurrency designation reaches the addresses that moved the money, not the infrastructure that carries it

Abstract

Code and analysis outputs supporting the manuscript. Every quantity reported in the paper is drawn from the JSON files in analysis/, each produced by a script in scripts/. The study uses three kinds of data: the complete on-chain USDT histories of the 490 addresses named in Israeli counter-terrorism seizure orders and of addresses listed under three OFAC programmes; two-hop transfer neighbourhoods crawled around those addresses; and the complete USDT transfer network on TRON to 1 January 2025, exported from an archival node with no seeding and no sampling (2,375,557,775 transfers, 15.5 trillion USDT, 744,543,633 unique directed pairs between 213,338,784 addresses). The distinction matters because a structural quantity measured in a crawled neighbourhood is not identified: the removal test reverses sign between the one-hop and two-hop boundaries in every sanctions network. Every structural claim in the paper is therefore made on the complete network. The intermediate network exports are large and are not included; the ClickHouse queries that produce them are in analysis/. Address-level role assignments and scores for undesignated addresses are deliberately not released. Version 1.1.0. Adds data/: the record-level inputs named in the manuscript's Data Availability statement — the complete USDT transfer histories of all 490 designated addresses, the Tether blacklist and fund-destruction event logs, the Aid for Ukraine Ethereum history, and the ClickHouse queries that produced them — together with the figure Source Data workbook, so that the analysis outputs can be recomputed rather than only re-read. Also corrects the throughput column of the complete-network removal table, which had included the stranded value, and regenerates the figures and tables affected. Version 1.1.1. Corrects two counts in the enforcement analysis: post-freeze receipts were read from the address-transfer frame, which holds transfers between two designated addresses twice (567 receipts of 10.9 million USDT, not 570 of 11.2 million), and the share of frozen addresses holding any balance was testing a difference of floating-point sums against zero (49% at a threshold of one base unit, not 53%). Adds the per-address and per-order arrays behind the redrawn figures, and regenerates the figures, tables and Source Data. Corresponds to GitHub tag v1.1.1. Version 1.1.2. Deposits the analysis outputs the deposited scripts read but the archive did not carry (zero_value_pairs.json, wcfrm_results.json, verified_metrics.json), so the figure Source Data can be regenerated from the archive alone; adds overflow_records.json and the script that produces it, giving per-network counts of the integer-overflow records dropped from each crawled network; corrects one Source Data sheet and the workbook README; and regenerates the figures. Corresponds to GitHub release v1.1.2. Version 1.1.3. Moves two figure annotations clear of their neighbours in the timing and enforcement figures. No analysis output changes. Corresponds to GitHub release v1.1.3. Version 1.2.0. Corrects the counterparty-persistence statistics, which were computed over every counterparty of a designated address rather than over those that dealt with it before its order: n = 20,295 rather than 22,637, 29% rather than 37% still transacting, 18% rather than 23% after 90 days, 58% rather than 64% of volume after the order. Records how concentrated the event study is (one order supplies 98% of pre-event volume) and the pre-trend in participation that the aggregate volume series does not show. Adds the value-carrying export query, which no deposited script previously produced although every value-weighted result depends on it; a path resolver so the scripts run directly from an extracted archive; the seizure-order list, anchor lists and crawled two-hop edge lists; and an analysis naming the complete network's highest-activity undesignated addresses, of which every labelled one is an exchange or payment processor. Figures revised throughout. Corresponds to GitHub release v1.2.0.