I. Primary Transaction Hash ($TxID$)

The $TxID$ is the unique fingerprint of the incident. Our engine utilizes this hash to deconstruct the Atomic Transaction Logic, identifying if the breach occurred via a private key compromise, a malicious smart contract “Sign” request, or a protocol-level re-entrancy exploit. This allows us to categorize the threat actor and predict their next movement based on known criminal patterns.

II. The “Peeling Chain” Identification

Attackers rarely move large sums of stolen capital directly to an exchange. They utilize a Peeling Chain—a series of hundreds of micro-transactions designed to dilute the “Taint” of the stolen assets. Our Cluster Analysis engine “collapses” these hundreds of wallets back into a single identified entity, stripping away the illusion of complexity and revealing the attacker’s primary consolidation hub.

III. Metadata & Phishing Artifacts

If the incident involved a social engineering or phishing component, the associated metadata is critical. We analyze hosting headers, domain registration timelines, and malicious script logic. By correlating these off-chain artifacts with on-chain movements, we can link your specific loss to a wider “Campaign” by known Advanced Persistent Threat (APT) groups, providing the “Probable Cause” required for international law enforcement intervention.

IV. Cross-Chain Exit Node Detection

The most complex phase of a report involves Bridge-Hopping. If the assets have been moved from one chain to another (e.g., Ethereum to Solana or Monero), our Liquidity Echo sensors look for matching volume and timing signatures on the destination chain. We maintain a continuous “Chain of Evidence” even as assets cross fragmented ecosystems, ensuring the trail never goes cold.