Illustrative case: a trace that ended at a mixing service
A case where the honest finding was that the trail stopped, why we reported it that way, and what the customer was able to do with it.
Illustrative: a trace that ended at a mixing service
An illustrative case showing an investigation that does not succeed. The trace follows stolen funds until they enter a mixing service, at which point linkage between deposits and withdrawals cannot be established. It is published because failed traces are a normal outcome, and a method that never fails is not being described honestly.
The incident
A synthetic customer reports approximately $180,000 in USDT moved from an exchange account after a credential compromise. They have two transaction hashes.
This case demonstrates the outcome our industry is least willing to publish: a trace that honestly ends.
The investigation
Triage confirmed both transactions and established a single onward hop. The scope was set at eight hops with a 5% value floor, on the expectation that a credential compromise of this size would be moved deliberately rather than automatically.
The blockchain trace
Hop one moved the full balance to a fresh address. Hop two moved it, unsplit, into a construction that pooled value from a large number of unrelated sources within the same period.
Outputs from that construction could not be matched to the inputs on value, timing or any other observable property. There is no technique that resolves this; every candidate output was equally consistent with every candidate input.
Key findings
- Fact. Two transactions moved the reported value on the stated date.
- Fact. Value entered a pooling construction at hop two.
- Analytical interpretation. The construction's behaviour is consistent with a mixing service. Confidence: medium. No entity attribution asserted.
- Limitation. Outputs cannot be matched to inputs. The trace ends here.
Evidence
Four transaction references, a fund-flow export ending at the pooling construction, and a written limitations section stating precisely why the trace terminated.
Outcome
The report told the customer plainly that blockchain analysis could take this no further. It also documented the first two hops to an evidential standard, which was useful to the exchange's own investigation of the credential compromise — a different question, and one where the answer lay in the exchange's access records rather than on-chain.
The customer was advised that continued monitoring of the pre-mixer addresses had limited value here, and was told so rather than sold it.
Lessons
A trace that ends is a finding. Reporting it as a finding — rather than continuing on a guess to produce something that looks like progress — is the difference between an investigator and a vendor.
Every address, value, date, transaction and outcome above is synthetic, created to demonstrate investigative method. It does not describe a real customer, a real case or a real service.