The Desk Opens on Monday
Constraints, episode 8
The stolen value lands at an exchange on a Saturday night. You watch the deposit confirm. One action can stop it now and it is not yours to take: somebody at that exchange has to freeze the account, and that desk opens on Monday.
A recovery turns on moments like that one. Stolen value cannot stay in motion forever, and sooner or later it comes to rest with somebody who holds it on the thief’s behalf: an exchange, a broker, some custodial service. That is the window, and it exists because a third party now has the funds and can decline to release them. Most of the attention in this work goes to the tracing that finds the window. What decides the case is more often whether somebody is ready to act in the hours it stays open.
The width of a window is not something you read off the chain. What governs the outcome is how much of that time somebody on the receiving end is awake, reachable, and authorised to act.
A great deal of illicit value moves late on a Friday. The ledger is no darker then and the timing conceals nothing; it leaves the request with nowhere to land. Public holidays do the same with more leverage, joining two dead stretches into one, so a desk closing on a Wednesday evening may not reopen until the following Monday. And a recovery rarely depends on a single desk: the exchange sits in one country, the authority whose signature is needed usually in another, and their waits do not overlap. Each handoff begins when the one before it ends, so the delays add.
The fastest thing that can happen to a case needs no authority at all. An exchange can freeze an account on its own initiative, before a court has said anything, and that is the only route quick enough to catch a window opening on a Saturday. It is conditional on form. Every venue has its own way of receiving such a request, and its compliance team has to validate what arrives against criteria you do not set and cannot see. A request they cannot validate is not usually refused. It comes back as a question, or it waits in a queue until somebody can classify it, and inside a window a slow answer and a refusal produce the same result: the money moves on.
Most of the time you do not learn what they need until you have already sent something. The requirements are rarely published, they differ between venues and between the people staffing them, and they change. So the volley that happens at a lawyer’s desk happens here too, compressed into hours. They come back wanting the path expressed differently: the bridge hops decoded in a more familiar way, or the share of each transaction attributable to fraudster-controlled funds calculated according to a methodology they recognise. And the same finding has to be restated in a structure their own systems will accept. Each question is another day against a window that is already open.
I lost a window that way. I had sent an exchange the path as I had built it, with the bridge transfers evidenced from the transaction payloads, which is where the proof actually sits. The compliance team did not work in that form and could not check it. They came back asking, and I rewrote the report around links to the same transfers on a bridge explorer, in a view they could open and read without taking my word for any of it. The second version was correct, and so was the first. While the two of us established that, the funds left the exchange.
Preparation, then, cannot mean knowing the answer beforehand. It has to mean producing a new version of the finding in hours rather than weeks: the decoding automated, the path already normalised, the evidence held in a form that can be re-cut on demand. The usual case for automation is speed, and speed of tracing counts for nothing by then, because the tracing is done. What automation buys is the ability to re-present a finished finding, in a shape nobody warned you about, before the window closes. What you build in advance is the capacity to rebuild the document, rather than the document.
When that route is closed, or has been pursued as far as it can go, the case goes to one of two desks, and they are not interchangeable. On the civil route it belongs to a lawyer acting for the victim, who brings you in as the expert. On the criminal route it belongs to law enforcement, and in most jurisdictions they cannot adopt what you found: the investigation has to be theirs, conducted and evidenced independently, however good the work that reaches them.
That obligation settles what the report has to be. A document written to persuade is the wrong object for a reader who is not permitted to be persuaded. What they need is a route they can walk themselves: sources, queries, and reasoning set out so each step can be reproduced from primary data on their own systems. Every step they cannot reproduce is one they have to rebuild from nothing, and rebuilding is counted in weeks. The report works better as a teaching document than as an argument.
The lawyer’s desk fails in the opposite direction. There you are taken as the expert, and what follows is a volley: why this address and not the one beside it, what rules out the innocent explanation, how this holds if the other side puts an expert against it. Each round of questions costs days. A report that answers them only once they are asked has spent the window on its own correspondence.
Before any of that, the instruction itself needs reading. It comes from the lawyer, and it carries a non-technical model of what happened, so a scope drawn from a mistaken premise produces a narrow task, carried out correctly, that answers a question nobody needed answered. The cost stays invisible until the work comes back and the real question is still standing. Examining the assumptions inside the request, and saying so early, belongs to the work rather than to the courtesy around it.
Whatever is handed across is closer to a photograph than to a live feed: the case as it stood when it was taken, faithful to its instant and to nothing after. None of it can be timed. The money surfaces when it surfaces and will not wait for the offices to open, so the preparation has to be finished before the night it is needed, down to one named person watching the few addresses that matter, so that a movement reaches somebody instead of a queue.
A picture can also stop being true while nobody touches it. A balance can read as full after the tokens behind it have been burned, on platforms that follow transfers without reading the contract’s own state. Whoever holds the case then acts in full confidence on a screen that stopped being accurate hours earlier, and speed is no protection, because the fault is in how the balance is represented rather than in the delay.
Which is where this stops being a problem of logistics. Three readers, and the same requirement in three shapes: a compliance team that has to validate on its own criteria, an officer who has to rebuild the case as their own, a lawyer who has to defend it against someone paid to break it. None of them can take your word for it. Finding the truth is half of an investigation; representing it so that somebody else can reach it independently is the other half.
The blockchain keeps no calendar. Everyone who can act on what it shows keeps one. Knowing where the money is changes nothing by itself: the work that decides the outcome happens before the window opens, and consists of making sure somebody is standing in it, holding a picture still true enough to act on.