Follow the money.
Find the exit.

Most tools stop at the exchange. FineX carries the trail one step further — to the customer deposit cluster the funds actually landed in — and states, for every case on the desk, whether the money can still be reached.

Open a caseCase queue
Fund flowTRON · USDT TRC-20
< 10 MIN100%SUBJECT71%64%58%EXITDEPOSIT CLUSTER
241
Customer deposit addresses derived
10
Exchanges covered by that derivation
202
Sanctioned addresses carried
0
Commercial data licences required

Derived from public chain data and the published OFAC sanctions list. Explorer-tagged exchange wallets are treated as ground truth; the deposit clusters are a heuristic and are labelled as one everywhere they appear.

01

Disposition

Hundreds of complaints arrive a day and a freeze window is measured in hours. A graph of wallets does not tell an investigator where the next hour is worth spending. A disposition does.

CRITICALFunds still at rest
No exit reached. The money is sitting at an address with no outgoing transfers.
SUSPICIOUSExit identified
The trail terminates at a likely exchange deposit cluster. The packet names it so the exchange can act.
CLOSEDTrail ends
The path enters a mixing service. Nothing can be followed deterministically past that point, and we do not pretend otherwise.
02

Method

  1. 01

    Victim wallet

    The address as it appears on the complaint, with the amount reported and the date the fraud occurred.

  2. 02

    Blockchain activity

    Every USDT transfer out of that address after the fraud date, followed hop by hop to a fixed depth.

  3. 03

    Taint analysis

    Each hop inherits the share of the victim's money that reached it, so the trail carries a value, not just a shape.

  4. 04

    Behavioural analysis

    Six rules read the path for dwell time, fan-out, peel chains, round amounts, address age and sanctioned contact.

  5. 05

    Entity attribution

    Where the trail ends at an exchange, sweep-pattern clustering names the likely customer deposit cluster inside it.

  6. 06

    Evidence packet

    A printed document stating the finding, the basis for it, the transaction trail and its own limitations.

03

Attribution

Exchanges issue every customer a unique deposit address and later sweep it into a main hot wallet. An address that receives from many unrelated sources and forwards almost all of it to one known exchange wallet, repeatedly, is very likely a customer deposit address at that exchange.

≥ 2
sweeps into the same tagged exchange wallet
≥ 90%
of everything received forwarded onward
0.50 – 0.95
confidence, scaled by how many sweeps were observed

Every attribution carries a confidence and the tier of evidence behind it. An explorer tag and a clustering heuristic are not the same claim, and the interface never lets them look like one.

TRON and USDT only. That is where the proceeds move. Another chain is an adapter on the same pipeline, not a new product.

Rules, not a model. An asset-freezing tool cannot hand a court a black box. Every score here is a rule that can be defended line by line.

No model decides attribution. A summary may be generated; the entity name is a deterministic lookup against a provenance-tagged table.

Public dataSelf-hostedNo licence cost

Bureau of blockchain intelligence · TRON · USDT TRC-20