Operations

How this runs

Attribution register
01Who operates this on day one?
I4C and state cyber cells. Accounts are per officer through the department’s own single sign-on, which is why the prototype’s sign-in has no password field — a prototype has no business holding a credential, and the screen says so rather than mocking a login.
02Where does the data sit?
Self-hosted by the deploying agency. No case data leaves it: the wallet address, the reported amount and the fraud date stay on the agency’s own deployment, and nothing is sent to a third-party analytics service. The only outbound calls are reads of public TRON endpoints, which are blockchain data, not case data. There is no database — the label tables are plain JSON files in the repository.
03What does it cost to run for a year?
Hosting only. The chain data comes from public endpoints with no licence fee, and there is no database to pay for. A single small instance capable of serving one state cyber cell runs at roughly ₹6,000–₹18,000 a year depending on the provider; on existing NIC or departmental infrastructure the marginal cost is zero. That figure is hosting, and hosting only — it excludes officer time and any future paid API tier if request volumes outgrow the public endpoints. The comparison worth making is per-seat commercial chain-analytics licensing, which is quoted per analyst per year and is foreign-hosted.
04What breaks in the field?
Four things, honestly. Rate limits — the public endpoint throttles after roughly fifty rapid calls; the client caches per address, paces requests and returns partial data rather than failing a trace. Unlabelled addresses — if the trail ends somewhere we hold no label for, we say so instead of guessing, and the case is dispositioned on whether the funds are still at rest. Cross-chain hops — a bridge is a hard stop today; the trail ends at the bridge and is recorded as such. Mixers — nobody can follow a mixer deterministically, so the case is closed at the entry point rather than continued on speculation.
05Which parts are AI-assisted?
Stated plainly, because a caught omission would put every other claim here in doubt. The frontend was substantially AI-assisted: component code, layout, and copy drafting throughout app/ and components/. The chain client and the clustering script were AI-assisted and then verified against live chain responses. What is not delegated: the clustering thresholds, the six behavioural rules and the triage logic are hand-specified and hand-reviewed, and no attribution decision is made by a language model — naming an exchange is a deterministic lookup against a provenance-tagged table. No language model runs in this system at all — the investigator summary on each trace is assembled from the figures already computed for that case, so it cannot drift from the evidence printed beside it and the same trace always produces the same sentences. AGENTS.md §11 offers a hosted model for that paragraph; it was not taken, because the answer to “what if it hallucinates the exchange name” is stronger when it covers the whole product rather than everything except the prose.
06Who maintains it after the team graduates?
The maintenance surface is deliberately small and is not code. It is two plain data files — data/hot-wallets.json, the exchange wallets we cluster against, and data/risk-lists.json, the sanctioned addresses — plus six rules in one file. Refreshing the label tables is re-running one script and committing its output; it needs an analyst, not the original authors. The build plan and every design decision are written down in the repository rather than held by whoever wrote them.
07What is not built yet?
Cross-chain tracing. A bridge is a hard stop: the trail ends there and is recorded as such. We looked for a way to do it honestly and could not find one — the officially documented TRON bridge addresses carry no USDT transfers at all, so a detector built on them would ship labels for addresses that never appear in the flows we trace. A TRON mixer list and a community abuse list are empty, on purpose: no citable public source was available, and an unsourced entry here would close a case wrongly. Sanctioned laundering services are covered under the OFAC list instead. Rule calibration. We measured how often each behavioural rule fires on wallets nobody reported — peel-chain on 94%, fan-out on 88%, sanctioned contact on 0% — so the weaker rules are known to be weak. Re-setting those thresholds against a larger sample is not done. No Indian VASP is in the seed list: 2,500 tagged holders were scanned and not one Indian exchange is publicly tagged, which is the gap a sovereign tool exists to close rather than one we can close with a copied address.
01

Case files to open first

Which cases are real

10 entries in the register were captured from the chain by this pipeline, each carrying the SHA-256 of every response it was built from. The rest are illustrative: valid addresses with hand-built traces, kept because they show a fuller trail than short real ones do. Any trace opened here says which it is — the badge reads RECORDED TRACE or LIVE TRACE.

  • FX-2026-6619TDii6vao7xyWg2rKPbCPWVRpSmne8xcqYxfunds at rest, never sent
  • FX-2026-6568TJjc21brTnnmKhiYHQuBD9Pxpfy7BwXHYQends at Bybit
  • FX-2026-5139TXq2kpXz13Z16b2Fjq58NerQTmU7gkkGexends at MEXC
  • FX-2025-5852TRWDtgCfXzTcMv8W6iJxh6umeqeF3zG7n5ends at ISIL KHORASAN
  • FX-2026-5843TXncpWJZ8ZxUcwrpTP4SE4nNhZnKZM4QzCends at MEXC
  • FX-2026-3825TVebSaNSdNHirwz46UPEzMgGy6pSQQu2aRends at MEXC
  • FX-2026-9749TUGHe9CTbZG44YvqfTSBd3mTAysCWcVNL6ends at ISIL KHORASAN
  • FX-2024-4759TTQd8Bo1nhKEVgkKJVP3SRYZ1nDNStckvjends at ISIL KHORASAN
  • FX-2025-8453TBfVDwNS6hC2Ln2qTLTRKMMPddscFEhhrUends at ISIL KHORASAN
  • FX-2026-1956TQGFsqQcGMSozKhjmEU9C4eA4gfbn5gQDnends at Binance

Each was captured from the chain and committed to the repository, so it reads with the network down and can be re-verified from the response hashes in its packet.

Standing limitation

Attribution produced here is an investigative lead carrying a stated confidence and a stated evidence tier. It is not, on its own, grounds for freezing an account, and every evidence packet says so in writing on the page an officer would file.