Analysis code and outputs: cryptocurrency designation reaches the addresses that moved the money, not the infrastructure that carries it

Abstract

Code and analysis outputs supporting the manuscript. Every quantity reported in the paper is drawn from the JSON files in analysis/, each produced by a script in scripts/. The study uses three kinds of data: the complete on-chain USDT histories of the 490 addresses named in Israeli counter-terrorism seizure orders and of addresses listed under three OFAC programmes; two-hop transfer neighbourhoods crawled around those addresses; and the complete USDT transfer network on TRON to 1 January 2025, exported from an archival node with no seeding and no sampling (2,375,557,775 transfers, 15.5 trillion USDT, 744,543,633 unique directed pairs between 213,338,784 addresses). The distinction matters because a structural quantity measured in a crawled neighbourhood is not identified: the removal test reverses sign between the one-hop and two-hop boundaries in every sanctions network. Every structural claim in the paper is therefore made on the complete network. The intermediate network exports are large and are not included; the ClickHouse queries that produce them are in analysis/. Address-level role assignments and scores for undesignated addresses are deliberately not released. Version 1.1.0. Adds data/: the record-level inputs named in the manuscript's Data Availability statement — the complete USDT transfer histories of all 490 designated addresses, the Tether blacklist and fund-destruction event logs, the Aid for Ukraine Ethereum history, and the ClickHouse queries that produced them — together with the figure Source Data workbook, so that the analysis outputs can be recomputed rather than only re-read. Also corrects the throughput column of the complete-network removal table, which had included the stranded value, and regenerates the figures and tables affected. Version 1.1.1. Corrects two counts in the enforcement analysis: post-freeze receipts were read from the address-transfer frame, which holds transfers between two designated addresses twice (567 receipts of 10.9 million USDT, not 570 of 11.2 million), and the share of frozen addresses holding any balance was testing a difference of floating-point sums against zero (49% at a threshold of one base unit, not 53%). Adds the per-address and per-order arrays behind the redrawn figures, and regenerates the figures, tables and Source Data. Corresponds to GitHub tag v1.1.1. Version 1.1.2. Deposits the analysis outputs the deposited scripts read but the archive did not carry (zero_value_pairs.json, wcfrm_results.json, verified_metrics.json), so the figure Source Data can be regenerated from the archive alone; adds overflow_records.json and the script that produces it, giving per-network counts of the integer-overflow records dropped from each crawled network; corrects one Source Data sheet and the workbook README; and regenerates the figures. Corresponds to GitHub release v1.1.2. Version 1.1.3. Moves two figure annotations clear of their neighbours in the timing and enforcement figures. No analysis output changes. Corresponds to GitHub release v1.1.3. Version 1.2.0. Corrects the counterparty-persistence statistics, which were computed over every counterparty of a designated address rather than over those that dealt with it before its order: n = 20,295 rather than 22,637, 29% rather than 37% still transacting, 18% rather than 23% after 90 days, 58% rather than 64% of volume after the order. Records how concentrated the event study is (one order supplies 98% of pre-event volume) and the pre-trend in participation that the aggregate volume series does not show. Adds the value-carrying export query, which no deposited script previously produced although every value-weighted result depends on it; a path resolver so the scripts run directly from an extracted archive; the seizure-order list, anchor lists and crawled two-hop edge lists; and an analysis naming the complete network's highest-activity undesignated addresses, of which every labelled one is an exchange or payment processor. Figures revised throughout. Corresponds to GitHub release v1.2.0. Version 1.3.0. Rebuilds the migration test: the reference is now the designated addresses' own reach into their counterparty layer rather than the largest incumbent, pairs are counted above a one USDT floor so address-poisoning senders no longer rank, the denominator is the counterparties the crawl actually observes afterwards, and candidates carry their rank in the complete network, which identifies the leading newcomer in both large orders as the fourth busiest address on TRON. Corrects a stale counterparty row in the uncertainty table, reports the placebo as a range over twelve seeds rather than one draw, describes the participation decline as the break it is rather than a linear slope, and records both bases of the crawl-capture figure. Corresponds to GitHub release v1.3.0. Version 1.4.0. The migration test previously excluded, by construction, the succession mode that occurs: an operator continuing from a wallet the programme designates in a later order. Measured on the complete histories, three addresses named in the May and July 2023 orders deal with 111, 106 and 103 of the March 2022 order's counterparties, about twice the reach of the best undesignated candidate. Also corrects the undesignated arm's reference population (569, not 3,063), the false claim of exact zeros in six per-order ratios, the enforcement-regime split (which measures the on-chain lock, since every address in those orders was blacklisted before signing), and the placebo range (300 seeds: median 0.73, 95% 0.48-1.13; calendar-matched 0.86). Discloses a 7% difference between the value-carrying network export and the per-address full-node histories, and reports stranded value as an upper bound. Corresponds to GitHub release v1.4.0. Version 1.4.1. The later-designated arm of the migration test is now measured on the same footing as the undesignated arm (crawl, observable counterparties, one USDT floor), with reach before the order and a size-matched percentile recorded. The wallets the programme designated later were running in parallel since 2021 rather than inheriting anything. Corresponds to GitHub release v1.4.1. Version 1.4.2. Restores the ten record-level input files under data/ (the designated-address histories, the Tether blacklist and fund-destruction logs, the Aid for Ukraine Ethereum history and the ClickHouse queries) that version 1.4.1 omitted through a packaging error. Code and outputs are identical to 1.4.1 and GitHub release v1.4.2. Version 1.5.0. The migration table now follows a single leading wallet before and after each order rather than pairing maxima from different wallets; Fig 3c is built from the untruncated full-node histories rather than the crawl; the placebo requires an actual transfer in the 26 weeks before the pseudo-event (300-seed median 0.71); Source Data carries the 92-address participation series; the uncertainty table states its resampling unit per row. Corresponds to GitHub release v1.5.0.