Capstone case study: from first trace to recovery

Real cases use every skill in this course at once, under time pressure and with incomplete data. This capstone follows one fictional theft from the first alert to the return of funds. At each step, ask three questions: which lesson does the action come from, what record does it leave, and how far can the result be trusted? All names, addresses and figures are invented, and the figures add up, so the case doubles as a reconciliation exercise (network fees other than the swap costs on Chain B are ignored).

The case at a glance

At 02:10 UTC on 14 March 2026, an attacker who had compromised a signing laptop at Nordhaven Exchange (Country A) drained three hot wallets. Prices at the time were ETH USD 2,500 and BTC USD 80,000.

Other parties: Brightwater OTC, a registered broker in Country B; Lumen Exchange in Country C; a stablecoin issuer; a smart-contract mixer with fixed 100 ETH pools; and a lock-and-mint bridge to Chain B, an EVM rollup.

Hour one: the question, preservation and the first freeze

Nordhaven's monitoring alerted at 02:31 and its incident lead called the police cyber unit at 02:40. The duty investigator opened a case file and recorded the seeds: three theft txids, the attacker's addresses on two chains and the amounts per asset (Lesson 1.2). Before the first query ran, the request "find the money" was rewritten as a scoped question: where did the assets stolen in these three transactions go, up to recorded cut-off blocks on each chain; which custodial services received any of them; and how confident are we in each link? The scope fixed the chains (Ethereum, Chain B, Bitcoin), a hop limit for peel chains and a stop rule at any custodial service. Nordhaven's engineers were asked not to wipe the compromised laptop; it was imaged and the image hash recorded before analysis (Lesson 8.3).

The two Ethereum theft transactions were read from their receipts, not an explorer summary: status 1 (success), and for the USDT theft the decoded Transfer log (Lessons 2.4 and 2.9), with units normalized at once: USDT has 6 decimals, so a raw value of 4,000,000,000,000 is 4,000,000 USDT (Lesson 2.6). The attacker's main Ethereum address had been funded two days earlier with 1.0 ETH withdrawn from a 1 ETH pool of a smart-contract mixer, before it had sent any transaction; it is the attacker's own gas money, not stolen value, so it stays outside the reconciliation. That funding says almost nothing about who is behind it, so it was recorded as a dead end, not a lead (Lesson 6.3).

Freezable assets came first. At 02:48 the attacker swapped 1,500,000 USDT for 600 ETH on a decentralized exchange, a rate of 2,500 USDT per ETH that matched the market (Lesson 5.2). The remaining 2,500,000 USDT sat at one address, so the investigator sent an urgent freeze request to the issuer, which blocked the address at 03:05 (Lesson 10.1). By 03:30 indicators had gone out through police-to-police channels and an industry alert network.

Nordhaven's proposed on-chain bounty message to the attacker was held until the case team agreed wording that would not reveal what investigators knew (Lesson 1.5).

Days 1–12: tracing the split

The attacker now held 3,000 ETH (2,400 stolen plus 600 from the swap) and 50 BTC, and split them. Every link was graded on the A–D scale (Lesson 3.2).

The bridge step ran the seven-check match of Lesson 5.4: both txids, the message ID, the recipient and the matching amount went into the trail. The mixer step followed Lesson 6.3: the gas-funding pattern was recorded as an inference with its basis and limits, and the 600 ETH as untraced rather than "probably the attacker's".

The peel chain was followed with a recursive query over the inputs and outputs tables (Lesson 2.9) that, at each hop, joins the change output to the transaction spending it and keeps that transaction's larger output. "Largest output" is only a rule of thumb, so each hop was checked against the change-detection signals of Lesson 4.2: the change always went to a fresh address of the same script type as the input, the payments were round while the change was not, and every transaction shared the same version, fee rate and locktime pattern, a consistent wallet fingerprint. Agreement makes each change call more robust, but these are all change-detection signals read from the same transactions, not independent evidence, so control of the change stays at grade C (Lesson 3.2) however many of them agree.

The Lumen label rested on what happened next: each deposit address was later swept together with more than 100 other addresses into a single hot wallet (Lessons 4.1 and 3.4), and that hot wallet carried a single third-party tag. A second examiner re-ran each trace from node data, with tool versions and label snapshots recorded (Lessons 3.6 and 8.2).

Testing a hypothesis: who holds bc1q…9tm4?

The 18 BTC remainder had not moved. The analyst set out three hypotheses: the attacker's own wallet (H1), an address of a custodial service (H2), or a third party paid by the attacker (H3). The flow is consistent with all three: it proves where the funds went, not who controls the address. Diagnostic items were the change signals at every hop, which point to the same wallet as the earlier hops (against H3); the address's lack of any history before the peel chain and the absence of a sweep into a hot wallet (against H2). H1 survived; H3 was kept alive as a minority view, because the case against it rested on heuristic signals alone (Lesson 1.2). The interim judgment, stated with separate likelihood and confidence as Lesson 9.2 requires: It is likely that the attacker controls bc1q…9tm4. Confidence is moderate, because the link rests on change heuristics that agree but are not independent records.

From cash-out service to suspect

Brightwater's attribution rested on two independent indicators: its own published deposit instructions, a self-identified source that does not list individual customer deposit addresses, and a label in two independent datasets, checked and dated (Lesson 4.6). That is why the Brightwater label started at grade B and the Lumen label only at C: a source that speaks for the entity can support grade B on its own, whereas a single third-party tag is one indicator with known failure modes (Lesson 4.5). As a registered provider in Country B, Brightwater could be asked to preserve records at once through police and FIU channels, followed by a mutual legal assistance request from Country A (Lessons 1.3 and 1.4). Countries A and B set up a joint investigation team.

Brightwater's records showed that all 4,980,000 USDC and the four mixer withdrawals (400 ETH, or USD 1,000,000 at USD 2,500) were credited to one corporate account whose director we call Suspect 1. Brightwater had already paid out USD 2,980,000 (1,980,000 for USDC and 1,000,000 for ETH) to a bank account in Country B; 3,000,000 USDC was still on the account. The records, authenticated as Lesson 7.5 describes, independently corroborated the mixer inference, which rose from grade D to B, with the grade history kept.

Lumen's records showed the six deposits went to accounts opened by three money mules, raising the Lumen label to grade B. The device identifiers used to log in to those accounts matched a device that had logged in to Suspect 1's Brightwater account (Lesson 4.7). The attribution chain ran address → cluster → service → account → person, each layer with its own evidence (Lesson 4.5).

Device evidence

On 4 April, Country B officers searched Suspect 1's home under a warrant (Lesson 7.2). Examiners imaged the phone and found a photo of a seed phrase in a notes-app backup (Lessons 7.1 and 7.3). Restored on an isolated examiner device under lawful authority, it derived bc1q…9tm4 (Lesson 7.4). The 18 BTC were swept the same morning into an agency-controlled 2-of-3 multisig (Lesson 10.2). The seed words appear in no case note, log, report or case photograph; the case file records the derived address as the non-secret identifier, two named people were present and recorded whenever the seed exhibit was opened, viewed or restored, and it was resealed under a new seal number (dual control), and the sweep txid lets anyone confirm when the funds moved (Lesson 8.3).

The device finding did what no heuristic could: the interim judgment on bc1q…9tm4 was replaced by a record, a seed on Suspect 1's phone that derives the address, grade A for control of the address (Lesson 4.5). Who used that seed remains an individual-layer question, answered with the rest of the device and account evidence. The heuristic analysis stays in the file as the reasoning that pointed there.

Freezes and seizures

The bank account had been opened two weeks before the theft and received no other money, so no allocation method was needed; the report said so explicitly rather than leaving the point open (Lesson 3.3). Each seizure was valued at the time of transfer with a stated price source (Lesson 10.3). Nordhaven asked for the bitcoin back in kind, so no interim sale was sought.

Notification, report and testimony

Lumen and Brightwater were each notified through compliance channels with only their own deposit addresses, txids, amounts and the grade of each link. One address in the attacker's earlier Ethereum history, outside the stolen-funds trail, resolved through a naming service to what looked like a private person's name; it stayed out of every shared document and went only into a restricted annex for legal process (Lesson 1.5).

The lead examiner's report followed Lesson 9.2: instructions, materials with hash values of every provider return and image, methods, findings by link with grades, limitations, and appendices with txid tables generated by query. Following Lesson 9.3, it carried one Sankey diagram per asset rather than one mixing units; a flow chart showing traced, inferred and untraced value in different line styles; and a timeline with one lane per chain. Before trial, unused material, including label sources and published research on the mixer heuristic's error rates, was disclosed (Lesson 8.4).

In cross-examination, defense counsel put it to the examiner that mixer heuristics are unreliable. The examiner agreed that the gas-funding pattern alone is only an inference (grade D), pointed to the independent corroboration in Brightwater's records that raised it to grade B, and noted that the link concerned USD 1,000,000 of the USD 14,000,000 and that no other finding depended on it (Lesson 9.4). Conceding the limit made the rest of the evidence more credible.

Return of funds and reconciliation

Nordhaven had reimbursed its customers from reserves, so it stood as the claimant. Countries B and C returned what they held to Country A under asset-return arrangements of the kind FATF Recommendation 38 expects, with each payout address verified by signed message before transfer (Lesson 10.4). Meanwhile, Nordhaven customers were contacted by fake "recovery agents"; the police published a warning that they would never charge fees.

Recovery was 72.9% of the loss at theft-time prices, and the bitcoin, returned in kind, was fully restored. The ETH and USDT losses (USD 6,000,000 + 4,000,000 = 10,000,000) were covered at 62% by the recoveries that trace back to them: the USDT reissued, the USDC seized and the bank funds frozen (2,500,000 + 3,000,000 + 700,000 = USD 6,200,000). Every unit of stolen value has a destination in the table, the final check that the trace is complete.

Exam focus: first-hour priorities (seeds, a scoped question, preservation, freezable assets first, indicators out, controlled communication with the attacker); reading receipts and normalizing token units; why a mixer-funded attacker address is a dead end; grading each link on the A–D scale and keeping the grade history when records raise an inference; matching bridge deposits to releases; following a peel chain and confirming change with several heuristics; attributing deposit addresses through sweeps and why a self-identified label outranks a single third-party tag; testing control hypotheses and stating likelihood and confidence separately; how device evidence turns a control inference into a record, and handling seeds without recording them; attribution layer by layer from cluster to person; choosing the lever for each asset (issuer, provider, bank, keys); minimal disclosure to services and a restricted annex for personal data; conceding limits under cross-examination; reconciling recovered and lost amounts to the total loss.