trace.sh

 
 

Independent blockchain investigator. Every trace on this site is reproducible on-chain: evidence logged, every claim tagged with how sure I am. I came up through network forensics, and now I follow money instead of packets.

 
 

On-chain, nothing really disappears. It just goes unexamined. I follow every hop to the evidence behind it, and I tag every claim with how confident I am. That's the line between a hunch and an investigation.

Proof of work
134
Tradecraft notes in the open knowledge base
8
Disciplines documented, from fundamentals to court-ready reporting
0
Unlabeled guesses. Every claim carries evidence and a confidence level

How I
investigate

A repeatable five-stage method, held to a few hard rules. Those rules, not the tools, are what make a finding stand up.

01
Scope before tools
I frame the case and pick the seeds first, and I turn down the ones that can't succeed. A trace that starts wrong ends wrong.
02
Confidence on every claim
Confirmed, high, probable, or possible. Nothing goes in as attribution on a maybe.
03
Fact, not inference
What the chain proves stays separate from what I read into it, and I write down what the evidence does not show.
04
Evidence you can rerun
Every artifact hashed, timestamped, and logged, so a second analyst retraces the steps to the same answer.
The pipeline

Five stages. One trail.

Every case runs the same five stages, whether it's a $600M bridge hack or a single scam wallet. Frame it, follow the money, group the wallets, name the actors, prove it.

01 · frameScope & Seed
02 · followOn-Chain Tracing
03 · groupClustering
04 · identifyOSINT Attribution
05 · proveEvidence & Report