Case-management and freeze orchestration for stablecoin issuers to stop illicit flows within hours and satisfy law enforcement.

1. 24-hour freeze response is now a public benchmark, which makes slow manual workflows immediately look inadequate.
2. Asset-control work now spans issuers, analytics vendors, blockchain ecosystems, and police agencies, creating a clear need for a shared operating layer.
3. More than $450 million in frozen funds shows this is a material, repeated workflow worthy of dedicated software budget.
4. Coordination across 23 jurisdictions turns evidence packaging and permissions into a product problem, not just a policy memo.

Catalyst. TRM, Tether, and TRON publicly showing 24-hour freeze capability, $450 million in frozen funds, and coordination across 23 jurisdictions makes freeze-operations software newly urgent for any issuer that wants to look credible to partners and regulators.

Build a case-management and execution platform for crypto asset-control teams. The product ingests a traced wallet or inbound request, creates a structured case file, checks required authority and urgency, and routes approvals to compliance, legal, and issuer operators before the freeze step is triggered. It maintains a timeline of wallet intelligence, requested actions, freeze status, counterparties, and outbound communications so teams can show exactly why they acted and who approved it. Customers start with urgent stablecoin freeze workflows, then add recurring templates for account takeovers, sanctions hits, exchange escalations, and law-enforcement requests. The goal is not to replace chain analytics, but to turn detected risk into fast, consistent, reviewable operational action.

What's different. Most crypto compliance vendors stop at wallet tracing, screening, or alerts, leaving customers to operationalize the hard part themselves when real money must be frozen fast. This company owns the handoff from intelligence to action: approvals, freeze orchestration, cross-party coordination, and defensible case records. If it becomes the place where issuers run their highest-stakes interventions, it can accumulate unique data on response times, action patterns, and jurisdictional workflows that generic ticketing systems and analytics tools do not capture.

Jobs to be done

flowchart LR
  Buyer[Compliance lead at stablecoin issuer] --> Pain[Manual cross-jurisdiction freeze ops]
  Pain --> Product[Freeze-response operating layer]
  Product --> Outcome[Faster freezes with defensible case records]

Executive takeaways

• T3 FCU proves issuer-side freezes are now a real, repeated workflow rather than a rare exception.
• The stack is fragmented: tracing is mature, but approval routing, evidence packaging, and cross-party execution remain ad hoc.
• The beachhead is concentrated and trust-heavy, but urgency is unusually high because missed or delayed action directly worsens losses and scrutiny.
• Incumbents are adjacent rather than absent, so the most credible entry is a neutral operating layer between analytics, token controls, and legal/compliance teams.

Market definition

Software that sits between blockchain-intelligence tools and token or custody control systems to route approvals, coordinate actions, and preserve defensible evidence for asset freezes and restrictions.

Customer and buyer

Daily users are financial-crime operations and investigations leads at stablecoin issuers, custodial wallets, exchanges, and crypto banks. Legal operations and platform operators join the workflow. Economic buyers are usually the CCO, MLRO, General Counsel, or equivalent executive who owns incident-response credibility.

Buying triggers

• A scam, hack, terrorism-financing, or sanctions case forces the issuer or custodian to freeze assets within hours rather than after manual email escalation. [1][2][12][28]
• A bank, exchange, or regulator asks the business to prove it can screen, blocklist, and document high-risk wallet actions with a clean audit trail. [17][19][25][26]
• Stablecoin payment growth and a shift toward stablecoins in illicit activity increase the number and urgency of cases hitting lean compliance teams. [5][6][18]

Willingness to pay

Willingness to pay is strongest when manual workflows visibly break auditability or response speed. Comparable vendors frame the category around audit-ready case management, human approvals, and workflow efficiency, which suggests a real budget line once a customer faces repeated incidents or diligence pressure. [17][20][21]

Category dynamics

Growth signal 133% CAGR in adjusted stablecoin volume since 2023

Validation signals

• T3 FCU has already frozen over $450 million and can support asset freezes within 24 hours in urgent cases.
• Tether says it has worked with 340+ law-enforcement agencies across 65 countries on 2,300+ cases, implying a durable operational workload.
• Operation Atlantic froze $12 million and identified 20,000 victims through real-time public-private coordination.
• Circle now sells programmable compliance checks, blocklists, and reporting inside its wallet stack, validating demand for operational control layers.
• OKX described the $225 million freeze as a months-long coordinated investigation, confirming the workflow is complex and multi-party.

Regulatory & technical constraints

• Freezes must be backed by lawful authority and auditable decision records, which makes human approval and evidence retention mandatory.
• Not every asset is equally controllable; the product only works where issuers or custodians actually have blacklist or restriction capabilities.
• Multi-chain activity and cross-border counterparties complicate monitoring thresholds, escalation logic, and reporting obligations.
• The product must fit existing screening and investigations stacks rather than assume customers will replace them.

Tracing, screening, and generic AML case management are crowded; issuer-grade freeze orchestration is not. TRM, Chainalysis, and Elliptic cover intelligence and monitoring. Unit21 and Hummingbird cover generalized investigations. Circle is embedding programmable compliance controls for its own wallet stack. The whitespace is the multi-party execution layer that links these systems into a controlled, jurisdiction-aware freeze workflow.

Why incumbents do not win by default

• Chain analytics vendors. They win the detection and tracing step, but their product center of gravity is investigator workflow rather than issuer-side approvals, legal routing, and action execution.
• Generic AML case-management vendors. They understand audit trails and human approvals, but they are not crypto-native and do not own wallet intelligence, token controls, or issuer-specific playbooks.
• Issuer or wallet infrastructure providers. They can embed blocklists and screening in their own stack, but that does not automatically solve cross-party evidence packaging or neutral system-of-record needs across vendors and jurisdictions.
• Travel-rule and counterparty compliance networks. They are adjacent because they already sit in regulated crypto workflows, but their core job is pre-transaction data exchange rather than post-detection freeze execution.

Stablecoin issuers and custodial crypto platforms can already freeze assets, but many still execute urgent cases through analytics dashboards, spreadsheets, email, and counsel review. That creates a narrow but acute software wedge: the operational layer that turns a traced wallet into an approved, documented, and defensible freeze within hours. The first customer is a mid-market stablecoin issuer or custodial wallet platform with direct freeze authority, recurring TRON or USDT fraud exposure, and a lean compliance team that cannot afford incident chaos. The product should start as an approval-gated case workspace and evidence system of record, not as autonomous enforcement, because wrongful-freeze risk and legal authority checks are the main adoption blockers. Go-to-market works best as incident-led direct sales to CCO, MLRO, or General Counsel buyers, supported by referrals and integrations from analytics vendors already upstream of the alert. The market is real but concentrated: research models roughly $48.0M TAM, $16.2M SAM, and a $2.4M reachable Year-3 SOM for the initial freeze-orchestration category, so expansion into adjacent crypto investigations and asset-control workflows is required for venture scale. The main strategic risk is bundling from TRM, Chainalysis, or issuer-stack providers before a neutral system-of-record wedge is proven. Key gaps remain on actual quarterly case volume, the exact day-one integration stack, and whether buyers will fund a dedicated product versus a broader AML suite, so the first 12 months must focus on design-partner proof rather than broad market expansion.

Problem

• Stablecoin issuers and custodial platforms increasingly need to freeze funds within 24 hours, but the execution path from alert to approved action is still manual, fragmented, and hard to audit.
• High-stakes cases span compliance, legal, platform operations, analytics vendors, and law enforcement, yet most teams lack one system that records authority, approvals, evidence, and outbound actions across jurisdictions.

Solution

• Deliver a crypto-native case-management layer that ingests a traced wallet or inbound request, routes authority checks and approvals, and maintains an immutable case timeline for every freeze or restriction action.
• Start with manual-execution orchestration and jurisdiction-ready evidence packets, then add direct integrations into token-admin, wallet, and custody action systems for the highest-volume control points.

Why we win

• The wedge sits in the handoff incumbents do not fully own today: converting blockchain intelligence into approved, cross-functional, legally defensible action rather than another monitoring dashboard.
• Each case can compound proprietary approval-path, response-time, and evidence-template data into a sticky workflow graph that is hard for generic AML tools or single-vendor stacks to replicate quickly.

Milestones

flowchart LR
  Wedge[Urgent freeze-response pilot] --> MVP[Approval and evidence MVP]
  MVP --> Proof[Faster defensible case handling]
  Proof --> Expansion[Broader asset-control system of record]

Founding team

Experiment roadmap

Risk assessment

What must be true

• Mid-tier issuers and custodial platforms process enough urgent freeze cases each quarter to justify a dedicated budget line.
• Buyers prefer a neutral orchestration layer across analytics and control systems over waiting for one incumbent to bundle the workflow.
• Human-in-the-loop approvals and evidence templates reduce adoption friction enough for the product to sit in real production cases.
• One or two downstream control-point integrations cover most early production demand.
• Adjacent workflows beyond urgent freezes are close enough to support expansion after the beachhead is proven.

Open diligence questions

• How many freeze or restriction cases per month does the target design partner actually handle today?
• Which person or system owns final approval before a freeze is executed in the current workflow?
• Which integration is mandatory on day one for a pilot to be credible?
• What proof would make a buyer choose a dedicated product instead of an incumbent AML suite?
• How often do cases require multi-jurisdiction evidence packaging rather than a single internal memo?

Model sanity

• Revenue engine. Base-case revenue is driven by growing from 4 paid logos at the end of Y1 to 12 by Q4Y3 while blended ARPU rises from pilot pricing to about $200K production ACV.
• Must go right. The model needs partner-assisted production conversion to keep the sales cycle near six months, because sensitivity shows slower conversion is the biggest Y3 revenue drag.
• Model breaks if. The downside case appears if buyers keep more work in bespoke legal review, which pushes gross margin toward 68%, CAC toward $190K, and the cash low point toward roughly $140K.
• Next-round proof. The next financing is justified by exiting Y2 with 8 production logos, 70%+ gross margin, and at least one partner-sourced expansion path that proves the wedge can move beyond founder-led selling.

Scenarios

Sensitivity

flowchart LR
  IncidentTrigger --> QualifiedPilot
  QualifiedPilot --> ProductionCustomer
  ProductionCustomer --> SubscriptionAndImplementationRevenue
  SubscriptionAndImplementationRevenue --> GrossProfit
  GrossProfit --> OperatingCash

Flags: The model reaches the researched SOM only by closing 12 logos in a concentrated market, so a few lost enterprise deals move the Y3 outcome materially. · Revenue per exit FTE sits at the low end of healthy SaaS benchmarks because the company still carries workflow, compliance, and integration labor rather than a purely software-delivery model. · Gross margin clears the business-plan target only if evidence templates and downstream integrations become reusable; continued bespoke implementation would pressure both EBITDA and runway. · The $3.2M ask is near the middle of the stated seed range because trust-heavy enterprise sales and regulated onboarding lengthen CAC payback versus a typical horizontal SaaS motion.

• Incumbent adjacency. Chain-analytics vendors or large issuers may extend from alerting into basic case management and freeze tooling. Mitigation: Start with cross-party orchestration and evidence workflows that sit above analytics tools, then become the neutral system of record across multiple vendors.
• Customer concentration. The first beachhead includes a relatively small set of sophisticated issuers and custodial platforms with direct freeze authority. Mitigation: Target mid-market and fast-growing platforms first, then expand into exchanges, custodians, tokenized-asset issuers, and service providers that coordinate the same workflow.
• Wrongful-freeze liability. If the product contributes to freezing the wrong wallet or acting on weak authority, customers may face legal and reputational blowback. Mitigation: Keep humans in the approval loop, require authority checks and evidence thresholds before action, and position the system as controlled execution software rather than autonomous enforcement.