Illustrative case: business email compromise, traced in hours
A redirected settlement, a fast first hop, and the difference the reporting window made.
Illustrative: business email compromise traced in hours
An illustrative case showing how a business email compromise is traced when the loss is reported within hours. It walks the incident, the investigative steps, and the on-chain trace to the receiving service. The data is synthetic and the case is illustrative, not a record of a real engagement or a promised outcome.
The incident
A synthetic company reports that a supplier settlement of roughly $240,000 in USDC was sent to an address supplied in an email that was not from the supplier. The finance team noticed within four hours.
This case demonstrates why the reporting window dominates every other factor in business email compromise.
The investigation
Triage began the same day. Scope was deliberately narrow and fast: identify the first hop, determine whether value had reached an attributed service, and produce something the company's bank, insurer and counsel could act on immediately.
The blockchain trace
The receiving address held the funds for just under six hours before moving them in a single transaction to a deposit address attributed to a centralised exchange, source recorded, confidence high.
Because the report was produced inside that day, the intervention request reached the exchange while the value was still at an identified service rather than after further dispersal.
Key findings
- Fact. One transaction moved the settlement to the address supplied in the fraudulent email.
- Fact. A single onward transaction moved value to an attributed exchange deposit address.
- Unverified information. The company's account of which email was fraudulent, retained as supplied and labelled as such.
Evidence
Two transaction references, the attribution source for the terminal deposit address, a timeline export, and the company's own correspondence retained as supplied evidence.
Outcome
A report was delivered within the same working day identifying one intervention point at an attributed exchange. The company's counsel contacted the exchange and the company notified its insurer and its bank.
What the exchange did with the request is outside anything this analysis controls. The value of the work was the speed and the specificity of the ask.
Lessons
In business email compromise, hours matter more than technique. Report immediately rather than after an internal review; the first hop is the one that decides whether there is anywhere to ask.
Every address, value, date, transaction and outcome above is synthetic, created to demonstrate investigative method. It does not describe a real customer, a real case or a real service.