Illustrative case: a trace that ended at an exchange
Six hops from an unauthorised transfer to an attributed centralised service, and what that did and did not make possible.
Illustrative: a trace that ended at an exchange
An illustrative case in which stolen funds reach a centralised exchange — the one destination where an intervention point may exist. It shows what the trace establishes, what is handed to the exchange, and why the exchange rather than the investigator decides what happens next. The data is synthetic.
The incident
A synthetic customer reports that roughly $412,000 in ETH left an address they controlled over a nine-minute window, in three transactions they did not authorise. They have one transaction hash and the date.
This case demonstrates a trace that ends at an attributed centralised service — the strongest outcome tracing can produce, and still not a recovery.
The investigation
Triage confirmed the transactions on-chain and established that the outbound value split immediately across two addresses. That fan-out inside minutes indicated automation rather than manual transfer, which set the scope: follow value by share to a depth of six hops, across Ethereum and, if reached, Tron.
The blockchain trace
Hop one split the balance roughly two-to-one. Hop two consolidated both branches at a single address whose behaviour was consistent with a mixing service, and a smaller branch crossed a bridge to Tron.
The bridge transfer matched on value, timing and uniqueness, so tracing continued on Tron. Two further hops led to a deposit address attributed to a centralised exchange with a recorded source and medium confidence, holding approximately $96,300 of traced value.
Key findings
- Fact. Three transactions moved value from the reported address on the stated date, each verifiable on a public explorer.
- Fact. A matched bridge transfer moved value from Ethereum to Tron.
- Analytical interpretation. The dispersal pattern is consistent with automated splitting. Confidence: medium.
- Analytical interpretation. The hop-two consolidation address behaves consistently with a mixing service. Attribution: none asserted.
- Fact. The terminal Tron address is attributed to a centralised exchange, source recorded, confidence medium.
Evidence
Eleven transaction references across two networks, a fund-flow export in CSV and JSON, the attribution source for the terminal address, and the risk model version applied. Every artefact carries a checksum recorded at generation.
Outcome
The report identified one intervention point: an attributed exchange holding roughly 23% of the original value. The customer's counsel approached the exchange with the report, and the customer filed a police report referencing the same case identifier.
Whether the exchange acted is not something this analysis controls or predicts. The trace produced a place to ask; it did not produce a return of funds.
Lessons
Three things this case illustrates: speed of dispersal is itself evidence; a matched bridge is a matched bridge and an unmatched one is not; and 'we reached an exchange' is a starting position for a legal process, not a conclusion of one.
Every address, value, date, transaction and outcome above is synthetic, created to demonstrate investigative method. It does not describe a real customer, a real case or a real service.