Funds blocked on an exchange?
We clear suspicion with evidence.
We unblock frozen USDT, investigate thefts, prove the origin and integrity of funds, and deliver the strongest AML service on our own forensic engine.
Tether blacklist · sanctions · scam databases. Two seconds, no signup.
Free tools: Address checker · Stolen-funds tracer · Verification certificate · Freeze Radar · MiCA exchange status
This is how an exchange AML engine sees your deposit: risk propagates along the transaction chain even when the dirty node sits two hops away from you. Our report builds the same graph on our own engine and documents how far your funds really are from the risk cluster.
Check an address in 2 seconds, right in Telegram
A free checker bot: send a TRON, Ethereum or Solana address and get the Tether blacklist verdict, a sanctions screen and an address passport (age, patterns, tags). No registration. Handy for vetting a counterparty right before a P2P deal.
Open @OnyxAML_bot or use the web checker →- 3-network check for Tether blacklist and freeze: TRON · Ethereum · Solana
- Sanctions screen: Chainalysis on-chain (6 EVM) + OFAC, address passport
- Address monitoring with alerts · full automated address report
- Honest: we show facts, not an invented "risk percentage"
From a free check to full representation
Start small. Take the next step only if you need it.
Checker & bot
Blacklist, sanctions, address passport for TRON/ETH/Solana. No registration, instant.
Check an address →Automated address report
Extended transfer window, monthly activity, top-counterparty screen (blacklist + sanctions + tags for each) and honest limits. Free for now, while we build up screening volume.
Order on the checker →Paid diagnostics
Forensic audit of your addresses and Source of Funds: what exactly triggered the flag and your real distance from risk.
Free assessment →Full representation
Dossier + communication with exchange or issuer compliance until the final decision. Payment tied to outcome.
Free assessment →What you receive in paid work
Not a "consultation" but concrete artifacts for your case: documents ready to submit to an exchange's or bank's compliance officer.
Risk zones, categorized exposure, flow tracing, Tether freeze dates and an integrity hash, in Chainalysis/TRM-class form. Our attribution depth is smaller, because we work without their closed databases, and we say so in the report itself.
A chronological reconstruction of your capital with documents, in the format compliance actually reads.
A ready cover letter in the institution's language (EN for international exchanges) with an Exhibit index and screening facts.
A verifiable artifact for a counterparty or bank: evidence that due diligence was performed.
Step by step for your exchange and jurisdiction: compliance → regulator → court, with an honest odds assessment.
Documents are drafts for your case, with no outcome guarantee (compliance decides). We are accountable for the quality of forensics, dossiers and communication. Law-sensitive documents are reviewed by a lawyer.
Onyx Academy: learn a new profession
35 lessons across 6 tracks: vetting counterparties, exchange AML screening, responding to freezes, forensics, real case walkthroughs and compliance-ready documents. Passing the exam opens the graduate workspace: a case builder, our lawyers' knowledge base and document templates. Seven lessons are free.
Operational Capabilities
Our methodology is built on four pillars of forensic and legal defense.
Blockchain forensics on our own engine
We do not resell someone else's check. Our engine reads the chain itself: it finds the transfer that tripped the exchange's risk model, builds a two-level graph of connections, follows the flow through transit wallets to a labelled node, and shows who the address actually dealt with. Sanctions are screened across six networks and the Tether blacklist is read straight from the contract. You get a report with dates, hashes and the limits of the method stated plainly.
Source of funds dossier
Most appeals fail on the origin of funds, and almost always because the submission is disorganised. We build the history of the capital so that every claim has a specific document behind it: bank statements, property sale contracts, investment history, and the fiat-to-crypto link tied to transaction hashes. The case decides the length, not a wish to impress with the thickness of the folder.
Filing with compliance
A support ticket and a compliance package are different genres. We file through the platform's official channel as one complete set: a cover letter with numbered exhibits, the forensic report and the source-of-funds dossier. For P2P freezes we argue your standing as a bona fide purchaser. Privileged contacts inside exchanges do not exist, and anyone promising them is selling an illusion.
Issuer-level restrictions
When funds are frozen by the smart contract itself, exchange compliance is no longer enough: the issuer decides. We prepare the evidence pack and the statements for the petition, and we state the odds honestly from the start. On the available data only a few percent of addresses are ever released, and the route that works usually runs through the agency that requested the restriction.
Pick your situation
Typical scenarios, explained
Declassified Case Files
Representative examples of our forensic intervention.
The "Triangulation" Trap.
The Situation: The Client, a high-volume OTC trader, sold 145,000 USDT via Binance P2P. He received fiat currency to his bank account and released the crypto. Three days later, his Binance account was suspended indefinitely under "Risk Control."
The Analysis: The fiat funds the Client received were illicit proceeds from a third-party victim (phishing). The scammers used the Client as a "mule" to wash dirty fiat into clean crypto. Police requested the restriction.
The Onyx AML Intervention
We did not argue "innocence"; we argued Law. We structured a legal defense proving the Client was a "Bona Fide Purchaser for Value without Notice."
- We exported the chat logs proving no collusion with the scammer.
- We provided a forensic trace showing the Client's USDT was clean prior to the trade.
- We submitted a formal legal opinion to the investigating cyber-police unit.
The "Indirect Contamination" Defense.
The Situation: An institutional client's account containing 850k USDT was restricted directly by Tether Limited. The funds were flagged as "High Risk" due to interaction with a DeFi protocol exploited by a sanctioned entity.
The Analysis: Our forensic audit revealed the contamination was "indirect" (Hops > 5). The client had no direct link to the illicit actors, but automated compliance software flagged the account due to volume.
The Onyx AML Intervention
We prepared a sworn affidavit for Tether's Legal Department in the BVI. We proved that the 850k entered the account before the contamination event occurred, validating the funds' integrity.
- Cluster Isolation: Proved funds entered before contamination.
- KYC/KYB Packet: Full corporate due diligence.
- SOW Report: Verified source of wealth from software licensing revenue.
How it works
- Forensic audit. We find the transaction that triggered the exchange's risk engine and mathematically measure your funds' distance from illicit clusters. The result is a report compliance understands.
- Source of Funds dossier. We reconstruct your capital's lifecycle (banking trails, deals, taxes, exchange history) into a single chronological narrative. This is where most self-made appeals fail.
- Compliance communication. One precise, legally verified response instead of a dozen tickets. For USDT restrictions, a legal package addressed to the issuer (Tether Legal).
Interactive case assessment
Pick the parameters to get an honest preliminary read on complexity, timelines and budget. This is an orientation, not a quote; the free case review gives the precise assessment.
Diagnostics is fixed-fee; representation is staged. The exact price follows the free assessment.
Time-critical? Message an operator directly on Telegram →The Onyx Thesis
In the last decade, we witnessed the migration of global capital from fiat rails to the blockchain settlement layer. Bitcoin promised sovereignty. Stablecoins (USDT/USDC) provided utility. But mass adoption brought mass surveillance.
Today, the blockchain is the most transparent financial ledger in history. With the introduction of MiCA in Europe and global FATF compliance, exchanges have become deputized agents of financial control. They use automated heuristics to freeze legitimate capital based on probabilistic risk scores.
We do not patch consequences. We build a position. Our own engine reads the chain and translates it into the language compliance accepts: facts, dates, transaction hashes and a documented distance between your funds and the risk. We are the bridge between the code of the blockchain and the code of law.
Why you can trust us
No "guarantees"
The decision is made by exchange compliance. Anyone promising "100% unlock in 24 hours" is a scammer. What we sell is the quality of the forensics and the dossier, and we tell you honestly when a case is hopeless.
Client screening
Before taking a case we run AML on your addresses ourselves. We decline sanctioned and knowingly illicit flows, including any sanctions-evasion schemes. This protects us and our bona fide clients.
The same lens the exchange uses
We read an address through the same set of signals its risk model uses: blacklist, sanctions, age, movement patterns and counterparties two levels out.
Staged payments
Fixed-fee diagnostics first, so you know the plan, the odds and the price before paying for representation.
Research / Breakdowns
Did the MiCA deadline cause more USDT freezes? The July data
Many expected a surge in USDT freezes after the MiCA deadline on July 1, 2026. We checked our own smart-contract event corpus: the…
Is it safe to hold USDT on TRON after the freeze wave?
Most USDT freezes happen on TRON, but the danger is not the chain; it is the counterparty. Why TRON accumulates the most freezes, …
Binance left the EU on July 1, 2026: what users should do
Binance did not obtain a MiCA CASP licence and suspended EU services from July 1, 2026. Who is affected, which licensed alternativ…
Exchange AML review deadlines: you get 72 hours, they get forever
No exchange publishes a maximum duration for its own compliance review, while user-side windows are strict: Bybit gives 72 hours, …
How often does Tether actually unfreeze USDT? The honest numbers
In 2025 Tether froze $1.26B across 4,163 addresses; only 3.6% were unfrozen the same year, and 55.6% of the value was permanently …
USDT Freeze Report for Q2 2026: 1,143 freezes and a record day on July 1
Onyx AML's first periodic report on USDT freezes from smart-contract data: 1,143 addresses in Q2 2026 (89% on TRON), $554M burned …
Your exchange is winding down in the EU under MiCA: how to get your funds out
On July 1, 2026 unlicensed exchanges wind down in the EU. Step by step: how to withdraw funds urgently, what to do with a forced-w…
How to verify a counterparty before P2P and prove USDT is clean
A step-by-step check of a counterparty's address before the deal: Tether blacklist, sanctions, scam databases and patterns, all in…
MiCA from July 1, 2026: what happens to funds on unlicensed exchanges
July 1, 2026 ends MiCA's transition period: exchanges without CASP authorization must stop serving EU clients. Who gets hit, what …
How exchange AML screening works: what compliance actually sees
Risk score, hops, clusters and retrospective re-scoring: exchange AML engines explained in plain language, including why bona fide…
How not to become a money mule: a P2P trading safety checklist
A practical P2P safety checklist: counterparty vetting, third-party payments, deal records, address AML hygiene. Trade P2P without…
USDT "frozen": by the exchange or by Tether's blacklist? Two different problems
An exchange freeze and Tether's smart-contract blacklist are fundamentally different restrictions with different procedures. Diagn…
Exchange froze your funds: what to do in the first 24 hours (and what not to)
A step-by-step plan for the first 24 hours after a crypto exchange freeze: what to preserve, how to read the compliance letter, wh…
How to check a crypto address before sending funds: 5-minute AML hygiene
Three levels of address checking before a transfer: Tether's contract blacklist, risk scoring and manual explorer analysis, plus w…
Video verification at a crypto exchange: what they actually check
Why an exchange requests a video call or additional review, what questions they ask, how to prepare, and why a rehearsed story is …
How to withdraw a large amount from an exchange without a freeze: an honest guide
Why large withdrawals trigger AML reviews, what genuinely lowers the odds of a manual review, and why splitting the amount works a…
What Chainalysis actually sees: clusters, heuristics, and where errors come from
How analytics engines cluster addresses, where "mixer" and "scam" labels come from, why false positives happen, and how the same f…
Lawyer or blockchain forensics: who to call when an exchange freezes your funds
When a frozen-funds case needs a lawyer, when it needs a forensic analyst, and when both. An honest map of the tools, with no conf…
How to check a crypto address for sanctions free (OFAC, Chainalysis)
A sanctioned address is the heaviest risk in crypto: here the exchange acts under law. How to check TRON, Ethereum or Solana for s…
Where frozen USDT goes: what happens to the money after
Our corpus of 2,993 USDT contract events: 73% of frozen addresses just sit there, 16% are destroyed, 11% are released. Timings, re…
Source of Funds: how to prove where your crypto came from
What counts as proof of source of funds, how to close the fiat-to-crypto gap with a TxID, the seven blocks of the statement, and a…
Free preliminary case assessment
Describe your situation and we will give you an honest assessment: what is realistically possible, how long it takes and what it costs. No "guaranteed unlocks": they do not exist, because the decision sits with compliance.