This is a real PDF produced by the same code that produces a customer's report, from a made-up
case: a wallet drained through a signed token approval, the funds forwarded to an exchange deposit
address. Every section below is in every report. Open it, then read what each part is for.
Illustrative data. The wallet, the counterparties, the amounts and the dates in the sample
do not exist on any chain. It is labelled as a sample in its own limits section and on every page.
The sections, in the order a reader meets them
1. The request being made. The first paragraph says what the reader is being asked to do
— preserve records, consider a freeze, open a case — so a compliance officer knows within ten seconds
whether this is for them.
2. What happened, with confidence tiers. Each finding carries a tier: confirmed
(read from the chain), high (two independent sources agree with the behaviour), medium,
or reported (a third party's label, not ours). The sample shows one of each kind.
3. Where the money went. The counterparty map and the endpoint table: every address that
received funds, what it is assessed to be, how sure we are, and how much went there. The sample ends at an
exchange deposit address — the best realistic outcome, because an exchange can act on a valid request.
4. The transactions. Every transfer with its full hash, so any figure can be checked on a
public explorer by anyone, without trusting us.
5. What is still there. Balances at the moment of the report, and outstanding approvals
or delegations that would let the drain repeat.
6. What the analysis could not establish. The limits list: which data layers were not
collected, what is a snapshot, where the trail stops (a custodial service, a commingled pool). A report
that hides its limits is worth less to a solicitor than one that states them.
7. Where to report it. The reporting routes for the customer's country, with the
reference numbers each party will ask for.
8. The evidence manifest. The SHA-256 of every raw response the figures were computed from,
and of the manifest itself, so the report can be re-derived rather than taken on trust. The page you
download from also shows the SHA-256 of the PDF file you received.
What is not in it, on purpose
No person's name — ever. No promise that funds will be recovered. No figure without a basis. No claim about
what a court will make of it: the report is formatted for submission to police, exchange compliance desks
and solicitors, and it is their process that decides what happens next.