Selected work
Cases and systems from investigations I have worked on: recoveries, a mixer case, and an investigation platform. Public details only.
$10.5M USDT recovery
I prepared the wallet-freeze lists on a $10.5M USDT case. The recovery followed with Swiss authorities, and it was one of the largest single-case USDT recoveries in Europe.
Read the essay
$1.2M USDT recovered with the US Secret Service
Another recovery: $1.2M USDT, with the United States Secret Service.
An Inferno Drainer campaign, reverse-engineered
A phishing campaign built on Inferno Drainer. I mapped the malware campaign from on-chain behavior, with nothing else to start from. The queries isolated the operator wallet and the victims.
Read the essay
11.7K BTC coin-mixing case
A complex 11.7K BTC case. The funds went into a mixer, and overflow analysis is what opened it.
Read the essay
A deterministic investigation platform
I built an investigation platform from scratch, with no language model in the loop, so every step can be reproduced and audited. At the core is a tracing engine, with bridge and DEX interpreters, a pattern classifier and a pattern description generator, on an ontology and taxonomy of blockchain behavior.