Funding
The first value into the wallet, followed back until an exchange withdrawal, a bridge, or a dead end.
Method
Every link in the file is a transaction you can open.
We read the public chain. We do not guess who owns a wallet. A report says where the asset moved, in what amount, at what time, and which address looks like an exchange deposit.
The loss
The transfers that match the amount and time you reported, separated from later unrelated activity.
Collectors
Wallets that received the funds and where those wallets sent the real asset next.
Lookalikes
Fake tokens and lookalike addresses are called out so they are not treated as the money.
The deposit
When the path reaches an exchange deposit address, that address, the amount, and the time go in the file.
The stop
If the trail ends at a mixer, a bridge we cannot match, or a wallet that has not moved, the file says so.
Off-chain
Phones, emails, the site, and a unique lure that logs the opener's IP. See tactics.
Auto file
After you submit, hops, OSINT, identity leads, and a tax worksheet are built without a second click.
Tax worksheet
Form 4684 path for US investment theft, Canadian capital-loss note, and the TUCE fee. Not a filed return.
What we will not write
- A person’s name, photograph, or phone number inferred from a wallet.
- A promise that an exchange will freeze or return funds.
- A dollar figure for a token that only calls itself by a famous ticker.