The Strings Stay Public (Why Tracing Is Not Enough)

Tracing funds walks edges until they end in a mixer, a nested service, a deposit address you cannot compel. It sees what moved. It never asks who arranged the movement, and that hand survives every wall built to stop the money. The wallets are a marionette, and the strings run through other layers of the same data. I pull four, each reaching a layer the money trail never touches.

Who built it

Contracts have authors: a deployer, an upgrade admin, role holders, multisig signers. None of it is money, all of it is public, and it rarely matches the wallets on stage.

I built my own tool for this layer, because nothing in my toolkit did it and reading it by hand kept losing details: a role granted three upgrades ago, a signer swapped on a multisig, a deployer funded two hops back. From known tokens and contracts it climbs to their deployers, the deployers’ deployers, and whoever paid their first gas, reading proxy admin slots, role grants and signer lists on the way. Every edge is one on-chain fact with its transaction, and the same input returns the same tree.

What comes back is mostly addresses you did not have: sometimes one freshly funded wallet at the root of several “unrelated” launches, the same signer on every admin multisig. The money ends in a dozen places. The authorship converges.

Where it was rehearsed

A contract exploit is rarely fired blind. The attacker needs to know the call sequence works against the target, and the cheap place to find out is a public testnet, where gas is free and failure costs nothing.

Rehearsals are careless in ways attacks are not. One key means one address on every EVM chain, so a reused deployer brings its practice history along. The work itself leaves a signature too. Sometimes the attacker deploys a contract, and the one used in the attack usually matches the one tested: the same bytecode, or at least the same function selectors.

Sometimes nothing is deployed at all, and the rehearsal is a sequence of calls: the same functions of the target, hit in the same order, with the same kind of parameters. Either way, searching for the pattern finds the practice run and whoever ran it, even from an address never used on mainnet. And testnet gas comes from somewhere: a faucet, a bridge, a wallet that also funded something else. Two addresses the operator kept apart on mainnet meet in rehearsal, where nobody expected to be watched. The most careful criminals skip the testnet and fork mainnet locally, which leaves nothing to find. The trail catches the rest.

Both strings live on public chains. The next one starts where the chain was built to go dark.

Where it left a fingerprint

Monero is the purest place built for edges to end: decoys, hidden amounts, off-chain recipients. You rarely need to beat that cryptography.

Value has to enter and leave. Often both ends pass through the same swap service or exchange, from the same machine, and the service saw one device fingerprint on the way in and on the way out. The match sits in records a court can request, and the decoys never enter the question. Different services on each end make it harder, not impossible: many keep device and session data, and a fingerprint retained on both sides can still be matched.

What they did, and when

Three strings start from something in hand: a contract, a rehearsal, a service. Sometimes you hold only a behavior and need every wallet that could have produced it. That is what queries are for: a good one describes an act, not a flow.

In the Inferno Drainer case, thousands of addresses were exploited by the same malware contracts in the same way. The query that worked asked which of them had touched the tokens of the attacked ecosystem, because whoever drained that protocol’s users carries its tokens more densely than any other operator of the kit. Thousands became a few dozen, and one lit up.

Time is the other filter. On a prediction market that resolves on news, the price shows when the news went public: the winning side jumps and stays. Only buyers before that moment matter. They still need an order, weighed on conviction (stake on the winning side), entry (surprise captured by the price paid) and record. Skilled traders lose often and win more. Someone betting on known outcomes almost never loses, and appears for one event rather than hundreds.

A ranked list is not a verdict. It picks who deserves a manual look against news timelines and funding origins, and cannot tell inside information from exceptional analysis. That limit goes in the report, next to the ranking.

What the strings are for

None of this recovers anything alone. A deployer tree freezes no account, a testnet trace returns nothing stolen, a fingerprint seizes no coins, a ranking convicts nobody. Together they map the hands behind an operation from facts others can check and queries anyone can rerun, which is what enforcement, counsel and compliant venues act on.

The money trail says where value landed. The strings say whose hand was on it. Most operations hide the first and forget the second.

So a cold trail does not close the file. When the money goes dark, the marionette stops moving. The strings stay public.

Next: Episode #14: The Transfer That Never Happened (Delta-Neutral Siphoning)