Track dirty USDT at scale. Find the pools that can still be frozen and the people entitled to them. Build the case pack that triggers the freeze — and sell that pack, at fixed fee, to the party who benefits. Every freeze is a paid matter and a public proof point.
Freezes don't pay — Tether has frozen $4.2B+ across 2,300+ cases and invoiced no one for it. But every freeze has a beneficiary with a budget. GLACIER originates the matter before the market knows it exists, then sells the evidence pack that makes the freeze happen.
The inversion that makes it work: everyone else waits for a client, then traces. GLACIER traces first, finds the money while it's still freezable, identifies who is entitled to it, and shows up with the case already built. The client's alternative is watching the window close — under 4% of a major theft is typically frozen two months on.
The platform (watcher, registry, scoring, packet generator) is internal-only tooling and is never sold, licensed, or named externally. The only products that leave the building are signed evidence packs and the freezes they cause.
USDT is the one asset class where a freeze is a phone call, not a treaty. That asymmetry is the whole engine.
Tether can blacklist any address near-instantly. $4.2B+ frozen, 5,000+ wallets, 2,300+ cases to date — the rail exists and runs daily.
USDT on Tron is the dominant settlement asset for pig-butchering, scam-center, and laundering flows — the largest freezable pool of victim funds in crypto.
GENIUS Act requires issuers to maintain seize/freeze/burn capability; FinCEN/OFAC rules extend it to secondary markets, effective Jan 18, 2027. Freeze responsiveness is becoming a legal duty, not a favor.
| Class | Definition | Example origin |
|---|---|---|
| T1 · Theft proceeds | USDT traceable ≤ N hops from a publicly attributed hack/exploit address | AFX bridge theft ($24.15M, Jul 22) |
| T2 · Fraud proceeds | USDT from addresses named in complaints, dockets, IC3-pattern clusters, or issuer/LE actions | Pig-butchering consolidation wallets ($61M DOJ case) |
| T3 · Sanctions-adjacent | USDT touching OFAC SDN-listed addresses or sanctioned-nexus clusters | Iran-linked freezes (~$500M, Jul 2026) |
| T4 · Court-flagged | USDT subject to existing freeze orders, judgments, or receiverships but not yet blacklisted | Receivership estates (Goliath-type) |
Attribution follows the market-guide methodology: primary attributions (court records, issuer actions, OFAC) outrank vendor labels; vendor labels outrank heuristics; every tag carries its provenance.
Two numbers decide everything. F: can this still be frozen? C: will someone pay for the pack that freezes it? Work only the top of F×C.
| Feed | What it yields | Cost |
|---|---|---|
| Incident reports | Hack/exploit addresses from TRM, CertiK, Global Ledger, SlowMist, Rekt publications | Free, public |
| Court dockets | Complaints, TROs, receiverships, forfeiture filings naming addresses (automated docket sweep, pointed at USDT) | PACER cents |
| OFAC / sanctions | SDN-listed addresses and updates | Free, public |
| Issuer blacklist diffs | Tether/Circle blacklisting events read directly from chain — reveals what issuers already act on, and what they missed | Free, on-chain |
| Chain telemetry | USDT Transfer events on Tron + Ethereum from tagged origins, followed hop by hop | Node/API costs, low |
| Counsel/DFIR referrals | Fresh incidents from the CB network before public disclosure | Relationship |
Output is a ranked queue of ≤ 20 live pools, each carrying: origin attribution + provenance, current resting addresses, F, C, the named beneficiary type, the correct rail, and the exact next action. Anything that can't state its beneficiary and rail doesn't enter the queue. The queue is reviewed daily; staleness > 7 days auto-flags, because freezability decays by the hour.
Scoring is deterministic and auditable on purpose: every packet may end up in front of a judge or an issuer's compliance desk, so the selection logic itself must survive discovery. No black-box model picks targets; models may assist tracing, but every scored fact carries a human-checkable source.
A pack is only as good as the rail it rides. Each rail has different speed, different evidence requirements, and a different paying party.
| Rail | Mechanics | Speed | Evidence bar | Who pays for the pack |
|---|---|---|---|---|
| R1 · Issuer | Freeze request to Tether/Circle compliance, strongest when backed by an LE reference or court order. Tether already runs this at scale with LE worldwide; T3 (Tether × TRON × TRM) is the in-house precedent. GENIUS/FinCEN rules make responsiveness a duty by Jan 2027. | Hours–days | Clean tracing narrative + legal predicate | Claimant's counsel, estate, or the issuer (readiness desk) |
| R2 · Law enforcement | Referral packet to IC3 / USSS / DOJ strike-force channels; agency requests or compels the freeze/seizure. The $580M+ scam-center seizures and the $61M pig-butchering case both rode this rail. | Days–weeks | Prosecution-grade attribution, chain of custody | Not LE. The victim/estate pays for the pack; LE outcome creates the proof point |
| R3 · Civil court | Counsel obtains TRO / prejudgment freeze / worldwide freezing order, served on issuer and exchanges. US courts now grant these routinely, including service by NFT and orders against persons unknown. | Days (72h in the incident window) | Expert declaration sufficient for ex parte relief | Plaintiff's counsel — this is exactly SOW-1, the Preservation Pack |
Rail selection rule: the pack is built once, rail-agnostic, to the highest bar (R2). Downgrading a prosecution-grade pack to an issuer request is free; upgrading a thin issuer request to a court declaration is a rebuild. One artifact, three exits.
Ten clean, well-formed packets into Tether/Circle compliance and the LE channels buys something no competitor can fake: trusted-submitter status. Issuers triage thousands of requests; the desks that send complete, verifiable, correctly-formatted packs get answered first. That standing is the moat this engine builds — and it compounds with every cycle of the loop.
The freeze is the demonstration. The pack is the product. The beneficiary is the buyer. Collected cash is the only scoreboard.
| Beneficiary found | What we sell them | Offer (existing, from approved report) | Band |
|---|---|---|---|
| Victim's counsel (fresh theft) | Freeze-ready declaration + exhibit pack + address schedule inside their 72h window | Rapid Asset Preservation Pack (SOW-1) | $15–50K flat |
| Receiver / trustee / estate | Batch tracing of estate-linked USDT + freeze schedule for court approval | Evidence Desk (SOW-2) | $50K / 10-file pilot |
| Insurer / coverage counsel | Causation + preservation report on the insured loss | Causation Report (SOW-3) | $15–35K / claim |
| Stablecoin issuer | Curated pre-verified freeze dossiers + lawful-order readiness | Lawful-Order Desk (SOW-4) | $50–100K sprint |
Failure tolerance is built in: even if R1/R2 rails ignore half the submissions, the civil rail (R3) alone supports the model, because counsel pays for the pack whether or not the freeze ultimately holds — the pack is required to seek the freeze. No revenue line depends on a freeze succeeding, and none ever takes a percentage of recovered funds.
Prove the loop by hand before automating it. P0 needs zero new infrastructure and two weeks.
Build boundary: everything in P1/P2 is internal tooling on Kinetic infrastructure. It is never productized, never demoed externally, never named in client-facing material. Externally there is only CipherBlade, a named expert, and a signed pack.
The aggressive version of this engine gets sued or ignored. The disciplined version gets trusted. These rules are the difference.
| Risk | Reality check | Mitigation |
|---|---|---|
| Issuers ignore unsolicited requests | Likely at first — they triage via LE and known counsel | Ride R3 (counsel-commissioned) early; earn R1 standing with quality volume |
| Claimant won't pay pre-freeze | Some won't | The pack is priced as the cost of seeking the freeze; counsel with a live client already has budget (verified fee bands, market guide §06) |
| Funds move before the pack lands | Freezability decays hourly | Queue decay flags; 72h-window discipline; watcher alerts in P1 |
| Tipping off launderers | Public queue would be a gift to them | Queue and registry are gated internal; disclosure only inside packs |
| Legal blowback (interference/defamation claims) | Real if we freelance accusations | Hard rules above; predicate requirement; counsel-directed routing |
| Capacity — Justin is one signer | Binding constraint | Queue cap at 20, sell 4–6/mo; second signer only at P2 |
Same rule as the revenue report: collected cash is the only scoreboard. Everything else is instrumentation.
| Metric | Class |
|---|---|
| Collected cash from packs sold | THE scoreboard |
| $ frozen where a GLACIER pack was the trigger (chain/court-verifiable) | Proof engine |
| Packs delivered / conversations opened / trusted-submitter responses | Pipeline health |
| Queue freshness (pools ≤ 7 days) | Instrumentation |
| # | Decision | Options |
|---|---|---|
| D1 | Green-light P0 pilot | a. ⭐ go — 5 pools, 2 packs, 2 weeks, $0 new spend · b. hold |
| D2 | Justin's role in P0 | a. ⭐ he signs the 2 pilot packs (requires briefing him — pairs with the proof-kit PDF still awaiting your green light) · b. run P0 unsigned as internal drill first |
| D3 | Codename | a. ⭐ GLACIER · b. you name it |