Monitor illicit USDT at scale. Identify pools that remain freezable and the parties entitled to them. Assemble the evidence pack that supports the freeze, and sell that pack at a fixed fee to the benefiting party. Each freeze is a paid engagement and a verifiable reference.
Freezes themselves generate no revenue: Tether has frozen $4.2B+ across 2,300+ cases without invoicing any party. Each freeze, however, has a beneficiary with a budget. GLACIER originates the matter before it reaches the open market, then sells the evidence pack that supports the freeze.
Operating premise: standard practice is to wait for a client, then trace. GLACIER traces first, identifies funds while they remain freezable, identifies the entitled party, and presents a completed case file. Absent early action the window closes: under 4% of a major theft is typically frozen two months after the incident.
The platform (watcher, registry, scoring, packet generator) is internal-only tooling and is never sold, licensed, or named externally. The only external products are signed evidence packs and the freezes they support.
USDT is the one major asset class where a freeze requires only issuer action, not cross-border legal process. The engine is built on that asymmetry.
Tether can blacklist any address near-instantly. $4.2B+ frozen, 5,000+ wallets, 2,300+ cases to date. The mechanism exists and operates daily.
USDT on Tron is the dominant settlement asset for pig-butchering, scam-center, and laundering flows: the largest freezable pool of victim funds in digital assets.
GENIUS Act requires issuers to maintain seize/freeze/burn capability; FinCEN/OFAC rules extend it to secondary markets, effective Jan 18, 2027. Freeze responsiveness is becoming a legal obligation.
| Class | Definition | Example origin |
|---|---|---|
| T1 · Theft proceeds | USDT traceable ≤ N hops from a publicly attributed hack/exploit address | AFX bridge theft ($24.15M, Jul 22) |
| T2 · Fraud proceeds | USDT from addresses named in complaints, dockets, IC3-pattern clusters, or issuer/LE actions | Pig-butchering consolidation wallets ($61M DOJ case) |
| T3 · Sanctions-adjacent | USDT touching OFAC SDN-listed addresses or sanctioned-nexus clusters | Iran-linked freezes (~$500M, Jul 2026) |
| T4 · Court-flagged | USDT subject to existing freeze orders, judgments, or receiverships but not yet blacklisted | Receivership estates (Goliath-type) |
Attribution follows the market-guide methodology: primary attributions (court records, issuer actions, OFAC) outrank vendor labels; vendor labels outrank heuristics; every tag carries its provenance.
Two factors govern selection. F: whether the pool remains freezable. C: whether a party will pay for the pack that supports the freeze. Only the top of the F×C ranking is worked.
| Feed | What it yields | Cost |
|---|---|---|
| Incident reports | Hack/exploit addresses from TRM, CertiK, Global Ledger, SlowMist, Rekt publications | Free, public |
| Court dockets | Complaints, TROs, receiverships, forfeiture filings naming addresses (automated docket sweep, pointed at USDT) | PACER cents |
| OFAC / sanctions | SDN-listed addresses and updates | Free, public |
| Issuer blacklist diffs | Tether/Circle blacklisting events read directly from chain; reveals what issuers already act on, and what they have not | Free, on-chain |
| Chain telemetry | USDT Transfer events on Tron + Ethereum from tagged origins, followed hop by hop | Node/API costs, low |
| Counsel/DFIR referrals | Incidents from the CipherBlade network prior to public disclosure | Relationship |
Output is a ranked queue of ≤ 20 live pools, each carrying: origin attribution + provenance, current resting addresses, F, C, the named beneficiary type, the correct rail, and the exact next action. A pool without a stated beneficiary and rail does not enter the queue. The queue is reviewed daily; entries older than 7 days are flagged automatically, as freezability decays continuously.
Scoring is deterministic and auditable on purpose: every packet may end up in front of a judge or an issuer's compliance desk, so the selection logic itself must survive discovery. No black-box model picks targets; models may assist tracing, but every scored fact carries a human-checkable source.
Each rail carries different speed, evidence requirements, and paying party.
| Rail | Mechanics | Speed | Evidence bar | Who pays for the pack |
|---|---|---|---|---|
| R1 · Issuer | Freeze request to Tether/Circle compliance, strongest when backed by an LE reference or court order. Tether operates this process at scale with law enforcement worldwide; T3 (Tether × TRON × TRM) is the standing precedent. GENIUS/FinCEN rules make responsiveness an obligation by January 2027. | Hours–days | Clean tracing narrative + legal predicate | Claimant's counsel, estate, or the issuer (readiness desk) |
| R2 · Law enforcement | Referral packet to IC3 / USSS / DOJ strike-force channels; agency requests or compels the freeze/seizure. The $580M+ scam-center seizures and the $61M pig-butchering case both rode this rail. | Days–weeks | Prosecution-grade attribution, chain of custody | The victim or estate pays for the pack; the law-enforcement outcome provides the reference |
| R3 · Civil court | Counsel obtains TRO / prejudgment freeze / worldwide freezing order, served on issuer and exchanges. U.S. courts grant these with regularity, including service by NFT and orders against persons unknown. | Days (72h in the incident window) | Expert declaration sufficient for ex parte relief | Plaintiff's counsel; this is SOW-1, the Preservation Pack |
Rail selection rule: the pack is built once, rail-agnostic, to the highest bar (R2). A prosecution-grade pack can be submitted as an issuer request without additional work; an issuer-level pack cannot be upgraded to a court declaration without a rebuild. One artifact, three submission paths.
Ten clean, well-formed packets into Tether/Circle compliance and the LE channels establishes trusted-submitter status. Issuers triage thousands of requests; desks that submit complete, verifiable, correctly formatted packs are answered first. That standing compounds with each cycle and is not replicable without equivalent volume and quality.
The pack is the product. The beneficiary is the buyer. Collected cash is the primary metric.
| Beneficiary found | Product sold | Offer (existing, from approved report) | Band |
|---|---|---|---|
| Victim's counsel (fresh theft) | Freeze-ready declaration + exhibit pack + address schedule inside their 72h window | Rapid Asset Preservation Pack (SOW-1) | $15–50K flat |
| Receiver / trustee / estate | Batch tracing of estate-linked USDT + freeze schedule for court approval | Evidence Desk (SOW-2) | $50K / 10-file pilot |
| Insurer / coverage counsel | Causation + preservation report on the insured loss | Causation Report (SOW-3) | $15–35K / claim |
| Stablecoin issuer | Curated pre-verified freeze dossiers + lawful-order readiness | Lawful-Order Desk (SOW-4) | $50–100K sprint |
The model tolerates rail failure: if R1/R2 submissions go unanswered, the civil rail (R3) alone supports the model, because counsel pays for the pack whether or not the freeze holds; the pack is required to seek the freeze. No revenue line depends on a freeze succeeding. No fee is a percentage of recovered funds.
The loop is proven manually before automation. P0 requires no new infrastructure and two weeks.
Build boundary: everything in P1/P2 is internal tooling on Kinetic infrastructure. It is never productized, never demoed externally, never named in client-facing material. Externally there is only CipherBlade, a named expert, and a signed pack.
These rules separate a trusted evidence desk from an exposed one.
| Risk | Reality check | Mitigation |
|---|---|---|
| Issuers ignore unsolicited requests | Expected initially; issuers triage via law enforcement and known counsel | Route through R3 (counsel-commissioned) early; establish R1 standing through submission quality and volume |
| Claimant won't pay pre-freeze | Some will not | The pack is priced as the cost of seeking the freeze; counsel with a live client holds budget (verified fee bands, market guide §06) |
| Funds move before the pack lands | Freezability decays hourly | Queue decay flags; 72h-window discipline; watcher alerts in P1 |
| Tipping off launderers | A public queue would assist them | Queue and registry are gated internal; disclosure only inside packs |
| Legal blowback (interference/defamation claims) | Material if accusations are made outside legal process | Hard rules above; predicate requirement; counsel-directed routing |
| Capacity: single reviewer | Binding constraint | Queue capped at 20; 4–6 packs/month; second seat added only at P2 |
Collected cash is the primary metric. All other measures are instrumentation.
| Metric | Class |
|---|---|
| Collected cash from packs sold | Primary metric |
| $ frozen where a GLACIER pack was the trigger (chain/court-verifiable) | Proof engine |
| Packs delivered / conversations opened / trusted-submitter responses | Pipeline health |
| Queue freshness (pools ≤ 7 days) | Instrumentation |
| # | Decision | Options |
|---|---|---|
| D1 | Green-light P0 pilot | a. ⭐ go: 5 pools, 2 packs, 2 weeks, $0 new spend · b. hold |
| D2 | Justin's role in P0 | a. ⭐ he signs the 2 pilot packs (requires briefing him; pairs with the proof-kit PDF still awaiting your green light) · b. run P0 unsigned as internal drill first |
| D3 | Codename | a. ⭐ GLACIER · b. you name it |