THE LAST HOP

Someone reports a site. I open it, screenshot it from the inside, and then follow the deposit address on chain until the trail ends. Every figure is read off a block explorer, every address is published at full length, and the whole thing is written so you can check the work yourself.

Every episode ends the same way: THE LAUNDRY SCORE, out of 10, across the five things a launderer gets graded on. Lower is worse laundering. So far, lower has been the norm.

Full write-ups live on Substack. The addresses from every episode are collected in the free Scam Address Labels set.

Episodes

The scoreboard so far

Two episodes, two published deposit addresses whose money went straight into an account at a regulated exchange. Across both, the running average on trail break is 0.0: not one mixer, not one bridge, not one swap. The sophistication goes into the website. Almost none of it goes in behind the deposit button.

Read the Control column before you take a score at face value. It is explained below.

Published is not controlled

A site printing an address on its deposit screen proves one thing: that the site published it. It does not prove the operation holds the key, and it does not prove that money arriving there is victim money.

I tested that directly on a separate case. A fake trading platform handed over six deposit addresses across six chains, in a live chat with its own operator, which is about as good as provenance gets short of a confession. I traced all six. Not one was operator-controlled. Three had never been used at all. Three belonged to uninvolved third parties, including somebody’s ordinary account at a regulated exchange, whose normal activity would read as collection volume to anyone who assumed the site owned the address.

So a fake platform publishing an address it does not hold is documented behaviour, not a theory. Every episode above now carries a control label, and so does every row of the Scam Address Labels set:

Nothing on-chain changes. Every amount, timestamp and hash in both episodes was read off a block explorer and stands. What changes is the sentence underneath them: an amount that arrived at a published address is a fact about that address, not proof of whose money it was. Episode 002 is the one this bites hardest, because both of its funded rails are exchange deposit addresses, and an exchange deposit address belongs to an account holder nobody has identified.

From episode 003 the control question gets answered before the trace is scored, by asking the operator for payment instructions directly rather than reading them off a deposit screen. One reply settles it.

If you screen against this data, treat a hit as a lead to check against your own account records. If a row matches one of your customers, the innocent explanation is live: a scam site can print a stranger’s deposit address on its payment page, and that customer has done nothing.

Why this is not casework

An episode is a fast public trace: entertainment, education, and a demonstration of method. There is no chain of custody, no exhibit hashing and no OSINT workstream, because nothing here is heading for a courtroom. If an episode turns out to matter, it stops being an episode and becomes a real case under the full casework method.

Two things hold regardless. Every on-chain figure is explorer-verified before it is published, and no episode names or implies a person. Wallets and services get named. People do not.

What a victim can actually do

Both episodes so far ended at an exchange, and that is the useful outcome, because a regulated venue holds account records. It is also where the honest answer gets uncomfortable: an exchange will not release those records to a member of the public, and once funds have been swept there is nothing left to freeze.

So the route is a report to your national police service, with the full addresses and the dates attached. The account record moves on a law enforcement request. That is what the write-ups are built to hand over.