How a trace runs
- Pick the start point.Start from the wallet that took your money, or from the transaction hash of the theft. For a transaction, FORENSA finds the chain it happened on, works out who lost value and who gained it, and starts from the biggest receivers. For an address, it checks which chains that address used and starts on the busiest ones.
- Follow what left after the money arrived.For each address it reads outgoing native coin, internal transfers and tokens, but only from the moment the stolen funds came in. Older, unrelated history stays out of the trail.
- Merge per destination and asset.Fifty small USDT transfers to one wallet become one line with a total and every transaction hash behind it.
- Drop spam and dust.Tokens with no market price are ignored, except official stablecoins. Thieves and spammers mint worthless tokens to clutter a trail; they never decide where it goes.
- Follow the biggest branches first.Each address keeps its largest destinations, and the queue always expands the branch carrying the most value next.
- Stop where the money changes hands.A trail ends at a labelled exchange, bridge, mixer or DEX, at a smart contract, or at a wallet so busy that it is clearly a service. Past that point, the funds mix with other people's money.
- Label, rank, write it up.Unlabelled addresses are looked up in public label sets, findings are ranked by what can be acted on, and everything goes into a case file with explorer links for each step.
The limits are fixed in the engine and read live into this page:
Branches left over when a limit is reached are not hidden: the case file lists them as unexplored, so anyone can continue from there.
Chains: Robinhood Chain, Ethereum, Base, Optimism, Arbitrum and Polygon through their public Blockscout explorers. Tron is followed for USDT (TRC-20) through TronGrid, which allows one request per second, so a Tron trace takes about one to two minutes and covers fewer addresses. Tron has no open label source yet, so very busy Tron wallets are marked as services rather than named.
What each finding means
| Finding | What it means | Confidence |
|---|---|---|
exchange_deposit |
Money reached an exchange. Often through a deposit address that belongs to one customer account, which the exchange can identify and may freeze on a police request. | high |
stablecoin_freezable |
USDT or USDC is sitting at an address. The issuer can freeze that balance at the address level, case by case, usually on a request from police. | high |
parked |
Value is still in a wallet in the trail. It has not moved on yet. Put it on watch to know the moment it does. | high |
mixer |
Money went into a mixer. The public trail usually ends here. Police and analytics firms have tools that reach further. | high |
bridge |
Money left the chain through a bridge. The bridge transaction shows the destination chain and address, which becomes the next start point. | medium |
swap |
Tokens were swapped on a DEX. The asset changed, the owner did not. What came back is followed from the same wallet. | high |
reported |
An address is already flagged by other investigators. Your case joins an existing trail. | medium |
peel_chain |
A string of fresh wallets, each passing most of the money on. A common laundering pattern that stays followable. | medium |
Confidence levels
Where labels come from
Names like "Binance 14" or "Bybit Exploiter 1" come from the Open Labels Initiative, served through Blockscout's metadata service, and from Blockscout public tags and verified contract names. FORENSA does not invent names. Every label in a case file carries its source, so a reader can check who said it.
Labels are cached on our server for a few hours to stay polite to the label service. Only public addresses are sent there.
The seal
A case file is only useful if nobody can quietly change it later. So FORENSA fingerprints it and writes that fingerprint to Robinhood Chain.
The transaction's data field is 44 bytes, laid out like this:
"FORENSA1" || root || count · leaf = SHA-256(0x00 ||
fingerprint) · node = SHA-256(0x01 || min(a,b) || max(a,b))
The seal proves the file existed in this exact form at that block time. It says nothing about who is right; that is what the evidence inside is for.
Facts and attribution
Facts
Transfers, amounts, times, balances. They come straight from the chain, and every one in a case file has an explorer link next to it.
Attribution
Who an address belongs to. That comes from labels written by third parties. It is a strong lead, not proof of identity, and the case file always names the source.
Where a trace ends
- MixersPools such as Tornado Cash break the link between deposit and withdrawal on the public chain.
- Privacy coinsChains like Monero do not publish who paid whom.
- Some cross-chain swapsInstant-swap services and some bridges do not show the destination in the transaction itself.
- Busy service walletsPast a wallet with thousands of transactions, stolen money mixes with everyone else's.
- Missing labelsAn exchange address with no public label looks like an ordinary wallet until someone labels it.
At each of these points the case file still shows exactly where the money went in. Exchanges, issuers and police can ask for records that never appear on-chain, and that is where they start.