This is a real PDF produced by the same code that produces a customer's report, from a made-up
case: a wallet drained through a signed token approval, the funds forwarded to an exchange deposit
address. Every section below is in every report. Open it, then read what each part is for.
Illustrative data. The wallet, the counterparties, the amounts and the dates in the sample
do not exist on any chain. It is labelled as a sample in its own limits section and on every page.
The sections, in the order a reader meets them
1. The request being made. The first paragraph says what the reader is being asked to do
— preserve records, consider a freeze, open a case — so a compliance officer knows within ten seconds
whether this is for them.
2. What happened, with confidence tiers. Each finding carries a tier: confirmed
(read from the chain), high (two independent label sources agree and the on-chain behaviour
matches), medium (one source, or behaviour alone), or reported (a third party's label,
not ours). The sample shows three of the four: confirmed, high and reported.
3. Where the money went. The endpoint table: every address that
received funds, what it is assessed to be, how sure we are, and how much went there — with a counterparty
map above it whenever at least one counterparty resolves to a name. The sample ends at an
exchange deposit address — the best realistic outcome, because an exchange can act on a valid request.
4. What is still there. Balances at the moment of the report, and what a balance
alone cannot show: lending collateral, liquidity-pool positions, staked assets and perpetuals margin.
5. The transactions. The transfers that carry the value, each with its transaction
hash, so any figure can be checked on a public explorer by anyone, without trusting us. Zero-value contract
calls and spam-token rows are left out here and kept in the evidence file, which holds the complete set.
6. What the analysis could not establish. The limits list: which data layers were not
collected, what is a snapshot, where the trail stops (a custodial service, a commingled pool). A report
that hides its limits is worth less to a solicitor than one that states them.
7. Where to report it. The reporting routes for the customer's country, with the
reference numbers each party will ask for.
8. The evidence manifest. The SHA-256 of the manifest listing every raw response
the figures were computed from, so any figure can be re-derived rather than taken on trust. The page you
download from also shows the SHA-256 of the PDF file you received.
What is not in it, on purpose
No person's name — ever. No promise that funds will be recovered. No figure without a basis. No claim about
what a court will make of it: the report is formatted for submission to police, exchange compliance desks
and solicitors, and it is their process that decides what happens next.