Code built into a token contract that lets the owner block specific wallets from transferring tokens.

Blacklisted wallet can receive tokens. Can't send them. Can't sell them. Funds frozen in place while the rest of the market keeps moving.

One line of code with two completely opposite use cases depending on who's running it and why.

The Legitimate Version

USDC has a blacklist function. So does USDT. Both explicitly disclosed. Both used regularly.

Regulatory compliance. Law enforcement requests funds linked to hacks frozen. OFAC sanctions require cutting off access to designated entities. Coinbase and Circle freeze addresses associated with Tornado Cash after OFAC sanctioned it. Hack occurs on a major protocol, stablecoin issuers freeze the hacker's addresses to prevent laundering.

These are the cases blacklist functions were designed for. Centralized stablecoins operating in regulated environments have genuine need to comply with legal requirements. The function exists. The trust exists because the operators are known, regulated entities with public accountability.

Same function. Completely different context when it's a random token that launched yesterday.

The Malicious Version

Developer deploys token. Blacklist function sitting in the contract. Nobody checks.

Retail buyers accumulate. Chart looks healthy. Community forming. Developer watching wallet addresses fill up with buyers.

At some point developer calls the blacklist function on specific addresses. Or all addresses except their own and insider wallets. Retail holders suddenly can't sell. Insiders exit freely into whatever buying pressure remains.

More sophisticated version: developer doesn't blacklist immediately. Lets the token run. Builds genuine-looking community. Then selectively blacklists addresses that have large holdings. Reduces the sell pressure that would come from those wallets. Keeps the chart looking better while continuing to attract new buyers. Eventually exits.

Retail never knew the function existed. Never thought to check.

Solana: Freeze Authority

Same concept. Different name on Solana.

Solana's token standard has a freeze authority field. Whoever holds freeze authority can freeze a specific wallet's token account. Frozen wallet can't transfer, sell, or do anything with those tokens until the freeze authority unfreezes it.

Token scanners on Solana display this directly. Green indicator means freeze authority revoked. Red means it's still active. Checking freeze authority alongside mint authority is the basic two-second check before touching any new Solana token.

Project with freeze authority still active and no explanation for why means one person can freeze any wallet holding their token at any time. That's not a minor detail.

How to Check

Takes seconds. No excuse not to.

Solana: DEXScreener, Rugcheck, GMGN all display freeze authority status directly on token pages. Green or red. Immediate answer.

Ethereum: TokenSniffer scans for blacklist functions automatically. Etherscan lets you read contract code directly if you want to verify manually. Look for mappings called blacklist, blocklist, or sometimes disguised with innocent names like isExcluded or restricted.

Red flag isn't just having the function. It's having it with no disclosed reason, no known trustworthy operator, and no audit confirming its limitations.

USDC has a blacklist. Coinbase runs it. Public accountability exists. New memecoin has a blacklist. Anonymous developer runs it. No accountability. Completely different risk.

When Blacklist Plus Other Red Flags Stack

Single red flag is a question mark. Multiple red flags stacking is a pattern.

Blacklist function active. Mint authority not revoked. High dev hold. Bundled launch activity. Fresh deployer wallet.

Every one of those individually has an explanation. All of them together on the same token doesn't. That combination describes a token specifically designed to extract money from buyers while preventing exits.

No single metric catches everything. Combination of signals is how serious traders evaluate new launches in the first thirty seconds.