Obsidian
The platform that finds money and seizes it. One lane, full depth: USDT on TRON, traced to the terminal address, frozen at the issuer, subpoenaed at the exchange, sealed for the court.
The on-chain finding: freezing is not the bottleneck. Listing is.
We queried the USDT contract's blacklist directly against the full OFAC sanctioned-TRON set. Every sanctioned address that still holds real money is already blacklisted by the issuer. On the listed set there is effectively nothing left to freeze. The rail already swept it.
The rail executes completely
Of the OFAC-listed TRON addresses with a balance, the on-chain read returns blacklisted for all of them. Once an address is on a list the issuer acts on, the money is frozen. Freeze capacity is not the constraint.
The unfrozen money is unlisted
The billions still sitting on chain are the wallets nobody has named: fraud proceeds no victim reported, addresses no investigator traced into a citable packet, and money one hop downstream of a listed address that moved before anyone re-listed it.
Obsidian is the list factory
The opportunity is not the sanctioned set, that is swept. It is everything the lists never named, surfaced from intelligence sources, qualified deterministically, and packaged as an evidence-complete freeze request a sponsoring authority can file.
Compliance tools answer "is this risky?" OBSIDIAN answers "where is the money, who can freeze it, and what do I file?"
Said plainly: OBSIDIAN is the easy-money platform for counsel groups. Clients in through a qualified intake, a guided workflow to freeze and seizure, and a signed court-grade packet out the other side. The firm bills the client; the platform makes the win repeatable.
Recovery has no software
Every incumbent investigator tool is built for compliance screening and law enforcement analytics. The counsel and victim-recovery workflow, trace, freeze, subpoena, exhibit, is delivered today as bespoke services. Nobody sells it as a product.
Depth beats breadth
Incumbents defend forty chains at shallow attribution. OBSIDIAN takes one lane, USDT on TRON, and owns it end to end: full transfer history, on-lane court-verified attribution, and the only asset with a working issuer-level freeze rail.
A filing, not a graph
The trace is not the product. The product is the action it ends in: a freeze dossier served on the issuer, a records demand served on the exchange, and a sealed exhibit a court will accept. Every screen exists to reach one of those three documents faster.
Working position: OBSIDIAN ships CipherBlade-branded, dogfooded by CB investigators on live matters, then licensed per matter to outside counsel through the existing referral lane. Kinetic supplies the engine. Final branding call is open, section 11.
The wedge: one asset, one chain, all of it.
It is where the victims already are
Investment-fraud and pig-butchering proceeds move overwhelmingly as USDT over TRON: cheap, fast, dollar-denominated, favored in the exact corridors where scam operations run. CB's live case intake is already dominated by this pattern. Demand backs into the product; the product does not go looking for demand.
The moat problem disappears at this scope
TRON is account-based: no UTXO clustering science, TRC-20 transfers are clean event logs with full per-account history exposed by public infrastructure. One chain and one contract means OBSIDIAN can hold complete coverage of its lane. On this lane we are not chasing incumbent breadth, we are deeper than they bother to be.
The only asset with a freeze button
Tether blacklists addresses at the issuer level on law-enforcement and court-backed requests; the T3 unit exists precisely to execute them. BTC and ETH traces end in a report. A USDT-TRON trace can end in immobilized money. OBSIDIAN is built around that rail.
Incumbents are looking the other way
The majors are fighting over nine-figure government contracts and enterprise compliance seats. Mid-market recovery counsel, the buyer who bills a victim by the hour and needs a freeze this week, has no tool priced or shaped for them. That buyer is already in CB's inbox.
Doctrine: citable by design.
In United States v. Sterlingov, the defense spent months attacking Chainalysis Reactor as unvalidated heuristics: not peer reviewed, no published error rate. The court ultimately admitted the testimony, but the playbook is now standard and the pressure on black-box tracing grows every term. OBSIDIAN's answer is structural: remove the attack surface instead of arguing about it.
Every hop is a raw on-chain event
A OBSIDIAN trace is a chain of TRC-20 transfer events, each one independently verifiable by anyone with a block explorer. No proprietary clustering stands between the evidence and the court. What heuristics exist, time-window linking, peel detection, are disclosed in the methodology annex of every exhibit.
Every label carries its citation
Attribution comes from the tag ledger: court records, verified casework, victim documentation, exchange deposit fingerprints. Each label ships with its confidence class and its source document. A tag that cannot be cited does not ship. This is the CipherCanon standard applied to a live product.
A named investigator signs
Machine output never leaves the platform unsigned. A named investigator reviews, attests, and signs every freeze dossier, records demand, and exhibit. The tool sharpens the expert; it never replaces the declarant. That is what survives cross-examination.
OBSIDIAN says
- Traced through raw on-chain transfer events, methodology disclosed.
- Attribution cited to a court record or documented source.
- Reviewed and signed by a named investigator.
- Built to survive scrutiny under Daubert.
OBSIDIAN never says
- Proprietary risk score of 87.
- Our algorithm indicates.
- Trust the software.
- Any claim without a document behind it.
Eight modules. One motion: qualify, find, hold, demand, prove, remit.
The intake and qualification module
Counsel groups open matters through a structured intake: victim statements, transaction hashes, amounts, jurisdictions. OBSIDIAN runs an instant viability read, live freezable balance, terminal exchange exposure, attribution hits against the ledger, and produces a qualification score with a recommended workflow path. Weak cases are declined with a documented reason before anyone burns hours. Strong cases route straight into trace.
The trace engine
Input: victim transaction hashes or addresses. OBSIDIAN walks the full TRC-20 USDT transfer history forward, follows splits and consolidations, detects peel patterns and time-window sweeps, and terminates every branch at one of three states: a terminal exchange deposit address, a dormant hold, or an already-frozen address. Heuristics are disclosed, versioned, and printed in every methodology annex. Typical case, hashes to terminal map, under one hour.
The attribution ledger
Every address label in OBSIDIAN carries a confidence class and a source document: court_record from federal dockets, forensic from corroborated casework, verified from documented victim intake, observed from live infrastructure capture, plus exchange deposit fingerprints and the public issuer blacklist. Labels without citations do not exist in the system. The ledger is the same standard the sealed pack feed already ships.
The freeze rail
When a branch terminates at a live hostile balance, OBSIDIAN assembles the freeze dossier in one motion: traced path, cited attributions, victim evidence references, and the submission package shaped for the issuer's law-enforcement channel and the T3 process. Counsel or the cooperating agency signs; OBSIDIAN tracks the request clock and confirms the blacklist event on chain when it lands. The 11,000-freeze public record proves this rail moves.
The KYC subpoena module
Every terminal exchange address maps to a playbook: the entity to serve, the jurisdiction, the legal channel, the required format, the authentication procedure, the realistic response window. One click generates the records demand, subpoena for US-served entities, court-order package for offshore venues, pre-filled with addresses, hashes, and time ranges in the exact format each exchange requires. Counsel signs, OBSIDIAN routes and tracks the response clock.
The armed watch
Traced-but-unripe branches do not go stale, they go on watch. OBSIDIAN monitors every flagged address, alerts on movement in minutes, and pre-stages the freeze dossier so the moment funds touch a freezable or servable position, counsel is one signature from action. This is the armed, always-on posture productized: defense that converts to offense.
The packet press
Every OBSIDIAN action can be sealed: trace maps, attribution citations, freeze confirmations, exchange responses, assembled into a numbered, hash-stamped, investigator-signed exhibit with a full chain of custody and the disclosed-methodology annex. Built on the existing exhibit line. The output is not a screenshot of a graph; it is a document a court admits. Every packet closes with a CipherBlade expert-witness attestation: a named investigator reviews the trace, adopts the findings, and stands behind them as declarant. Serious, court-grade, signed.
The remit workflow
Recovery does not end at the freeze. OBSIDIAN carries the matter through the last mile: seizure and forfeiture support packages for the agency or court holding the funds, victim remission petitions in the required format, restitution distribution schedules, and a closing statement that reconciles every traced dollar to an outcome. Frozen money that never reaches a victim is a half-finished product; remit is what makes OBSIDIAN whole.
The Arsenal: TRON-native instruments the wide platforms will never build.
This is the F1 program. Total depth on one lane produces instruments that are impossible for multichain breadth players, and every one of them makes the packet stronger, the freeze faster, or the counsel richer.
Gas-funder unmasking
Every fresh scam wallet needs TRX or energy from somewhere. The funding wallet links hundreds of unrelated wallets to one ops desk. The choke point of the entire operation, and a TRON-only artifact.
Peel-storm dragnet
Real-time detection when a tranche shatters into hundreds of micro-wallets. Amount-conservation and velocity matching map the cluster in seconds, handled as one object, not four hundred addresses.
Energy-rental attribution
Ops rent TRON energy to move USDT gas-free. The delegate-resource transactions form a second hidden linkage layer across the whole cluster.
Flight-response detection
When one freeze lands, the rest of the treasury starts running. The platform sees the panic live and pre-stages freeze packs on every sibling wallet before consolidation.
Failed-transfer evidence
Attempted sends from a blacklisted address are on-chain proof of ongoing control and intent. Auto-captured into the packet with timestamps.
Permission-change forensics
TRON account-permission reassignments mark wallet handoffs between operators. Custody changes inside the TCO, timestamped, citable.
Operator-hours fingerprinting
Activity histograms across the cluster reveal the desk's working hours and timezone. Jurisdiction inference presented as pattern evidence.
DEX-hop unwrapping
USDT to TRX to USDT washes through on-chain DEXs are unwound automatically with swap receipts attached to the trace record.
Cross-matter collision alerts
Your terminal address appears in three other matters on the platform. Joinder and mass-action opportunities served to counsel automatically. A network effect no incumbent can copy.
Per-victim entitlement math
When forty victims feed one pot, selectable pro-rata, LIFO, or FIFO tracing with the methodology disclosed produces the remission distribution table courts demand. No platform produces it.
Off-ramp SLA ledger
Real response-time and compliance statistics per exchange, built from actually served demands. Counsel picks the fastest door with data, not folklore.
Consolidation-window prediction
Dormant pots wake on schedules. Behavioral timing models alert before the desk's usual sweep window opens.
Posture, locked: the engine is loud, the door is calm. The public narrative says built to dismantle TCO treasuries. The counsel door says bring this weapon to your client's case. Nobody fears the F1 car they get to drive.
The counsel journey: retainer to recovery.
Counsel opens a matter through structured intake. OBSIDIAN scores viability and picks the workflow path before hours are spent.
Full USDT-TRON path to every terminal address, each branch classified: freezable, servable, dormant.
Dossier assembled, signed, and submitted on the issuer rail. Live balances immobilized while the case is built.
Records demands served on terminal exchanges through the right channel in the right format. Response clocks tracked.
Dormant branches on 24/7 watch with pre-staged action packs. Movement converts to a freeze in minutes, not days.
The packet press produces the court-grade record, closed by a CipherBlade expert-witness attestation.
Forfeiture support, remission petitions, distribution schedules. Every traced dollar reconciled to an outcome.
The sell to counsel in one line: your client's money stops moving in day one, the exchange's records arrive in weeks, and everything you receive is already shaped for the filing. Ease of use, targeted use case, speed to resolution. That is the whole pitch.
Quicker than the rest
Hashes to freezable posture in a day, not a quarter. Speed to resolution is the headline metric.
Mapped, not improvised
Every matter runs a workflow path: qualify, trace, hold, demand, packet, remit. No blank-page casework.
One stop
Trace, freeze, subpoena, expert attestation, and the court-grade packet in one place. No vendor daisy chain.
Near guaranteed
Qualified intake means you only take cases that score. The platform declines weak matters before hours burn.
Best ROI in the building
Flat platform cost, you keep the contingency. Margin is math, not hope.
No expertise needed
Zero blockchain literacy required. The platform speaks lawyer, not chain.
Defensible by default
Every packet is pre-built to survive challenge. You never sweat the expert fight; a named investigator already signed.
Predictable economics
Access plus events. No surprise invoices, no percentage games, clean ethics posture.
No dead hours
Viability scoring at intake protects the book. Declines come with documented reasons you can give the client.
Works while you sleep
Armed watch converts dormant pots into freezes at 3am. The case advances between your calendar slots.
A practice area, not a case
Repeatable intake, repeatable workflow, repeatable wins. Crypto recovery becomes a line of business.
The clock: two metrics, one lifecycle.
The chain moves in seconds, the legal system moves in weeks. So the matter runs on two separate clocks: Time-to-Freeze, which must happen in hours, and Time-to-Remit, which is bound by courts and issuer compliance. OBSIDIAN is built to crush the first clock and de-friction the second.
Case viability collapses if funds are not held within 24 to 72 hours. Peel storms disperse a pot into hundreds of wallets or hit a CEX off-ramp in under two hours. Intake fires the trace, the dossier, and the issuer block request in one motion.
The freeze is temporary custody, not recovery. Remittance is bound by TRO filing speed, judicial review, and the issuer legal queue. The platform attacks every controllable segment: drafting, exhibits, service formats, and status pressure.
- Intake & qualification score
- Automated TRON trace + dossier
- Issuer emergency block request
- CEX terminal notifications
- Ex parte TRO auto-drafted from the trace record
- Counsel signs and files, exhibits pre-built
- Judicial review: 10-14 days fast lane, 6 wks multi-jurisdictional
- Order granted, served to issuer legal
- Forfeiture order through issuer legal + engineering queue
- Burn of blacklisted USDT, reissue to victim wallet
- Per-victim distribution table from the entitlement engine
- Matter closed with sealed final packet
Traditional practice treats every scam like a bespoke corporate lawsuit. The platform productizes the three slowest segments: human forensics delay becomes an instant automated trace, pleading drafting becomes auto-populated court-ready motions, and issuer submissions ship in the exact format the compliance desk expects, front of queue instead of back. Target ranges above are design targets from published case patterns, not guarantees, and every matter states them that way.
Screens: the working surface.
Hyperminimal operator register. Four core screens, mocked below as they will ship.
Architecture: the seizure machine.
The data spine, priced in months not decades.
| Layer | Source | Access | Build cost |
|---|---|---|---|
| Transfer history | TRON public node infrastructure, per-account TRC-20 history and event logs | Public API, free tier to start, paid tier at scale | Weeks. Ingestion plus mirror store. |
| Freeze state | Issuer blacklist calls on chain, complete public record since 2017 | Fully public and auditable | Days. Event watcher plus backfill. |
| Attribution | Court-verified tag feed, verified victim intake, casework corroboration, sanctions lists, deposit fingerprints from resolved matters | Owned. This is the asset nobody can copy. | Live today. Grows with every matter. |
| Exchange playbooks | Per-venue legal process requirements, channels, formats, response records | Curated from public LE guides plus CB institutional experience | Weeks for top 10 venues. CB already knows this cold. |
| Gap fill | Licensed third-party attribution where a branch exits the lane | Negotiated. The incumbent conversation becomes a supplier conversation. | Optional. Not on the critical path. |
The strategic point: on this lane the expensive data is public, the differentiating data is ours, and the incumbent moat is irrelevant. Attribution breadth matters for screening forty chains. It does not decide whether one USDT pot on TRON gets frozen this week.
Money: access, events, attestation, watch.
- Counsel workspace, unlimited intake
- Qualification scoring included
- Annual commitment, firm-wide seats
- The subscription floor of the business
- Full trace to terminal map
- Court-grade packet, hash-stamped
- CB expert attestation included
- Stake-banded uplift above $1M traced
- Freeze dossier assembled and served
- KYC demand pack per exchange
- Paid win or lose, no contingency
- Remit package priced as an event
- 24/7 monitoring of traced addresses
- Movement alerts in minutes
- Pre-staged freeze packs
- Recurs while funds sit. The annuity.
One live matter, first year
Access share plus trace packet plus one freeze plus two demands plus ten months of watch: roughly $10,000 to $14,000 per matter at list, near-zero marginal cost after the engine exists. Twenty counsel groups at five matters each clears $1M ARR without touching enterprise pricing.
Never a cut of recovery
No percentage of recovered funds, ever. Fees are flat, event-based, and stake-banded. Counsel keeps the contingency and the ethics exposure; OBSIDIAN monetizes volume and speed. This keeps the platform clean of champerty and fee-sharing fights and keeps every packet unimpeachable.
Legal gates: what OBSIDIAN is, and is never.
OBSIDIAN is
- Litigation support and investigative software engaged by counsel.
- A drafting and routing tool. Counsel of record signs and issues every demand.
- An expert-witness platform. CB investigators attest as named declarants.
- A freeze requester through lawful issuer and LE channels only.
OBSIDIAN is never
- A law firm. It takes no cases and gives no legal advice.
- An issuer of legal process. No subpoena leaves without counsel's signature.
- A custodian. It never holds, moves, or touches funds or keys.
- A contingency player. No percentage of recovery, in any form.
Counsel-of-record gate
Demand rail unlocks only inside a matter with verified counsel. Bar number captured at intake, signature required at issue. Same pattern as the existing legal-gated products.
Attestation gate
No packet ships without a named investigator adopting it. The review queue is a hard gate in the workflow, not a rubber stamp: reject sends the trace back with reasons.
Freeze channel gate
Freeze submissions go only through the issuer's law-enforcement and verified-investigator channels, with the cooperating agency or court reference attached. OBSIDIAN tracks; it never pressures.
Roadmap and open decisions.
Trace engine plus terminal classification on a real closed CB matter. Judge it with real data.
Intake, trace, freeze rail, packet press. CB dogfoods on live matters. Playbooks for top 10 venues.
Tenanted workspaces, demand rail, attestation queue, billing. Three friendly counsel groups from the referral lane.
Armed watch GA, remit workflows, stake-banded pricing, second corridor evaluation only after the lane is won.
A Kinetic product. CipherBlade fulfills.
Revised 2026-08-18. Obsidian is Kinetic-owned: Kinetic is the technical shop, the brand, the billing, and the IP. CipherBlade is the fulfillment partner for expert-witness testimony and the non-automated tracing work, and every packet carries a named CB attestation.
Clickable prototype first
Locked 2026-08-18: a light clickable prototype of the exact core flow, intake to packet, on a seeded matter. Judge it in hand, then fold in capabilities from the labs platforms.
Access plus events, as specced
Locked 2026-08-18. Section 09 model stands: firm access, per-matter trace and packet, per-event actions, armed watch recurring. Numbers stay open for tuning at counsel beta.
Loud engine, calm door
Locked 2026-08-18. The category story is loud: built to dismantle TCO treasuries, the F1 program. The counsel-facing door stays calm and outcome-first: recover your client's money with the most technically serious weapon in the field.
Obsidian, standing
Working name as of 2026-08-18. TROVE parked as a separate concept. Candidates held in reserve: Levy, Marshal, Sequester, Replevin, Vise, Recourse, Quarry, Remedy, Warrant, Paydirt. The final name must tell counsel: easy wins, mapped lifecycle, one stop, near guaranteed, best ROI. Search continues for something with more heat.
OBSIDIAN 360 Spec v0.1 · 2026-08-18 · Confidential · Sources: Messari Q2 2026 TRON report, Tether T3 FCU releases, Bitquery blacklist audit, US v. Sterlingov D.D.C. Daubert opinion, exchange LE guides. Figures dated as marked.