Unit 3 · Level 1 · Wallet anatomy
Following the money
Tracing funds is just reading transactions in a row: money leaves address A, lands at B, splits toward C and D, merges again at E. Splits and shuffles slow you down but delete nothing; every branch stays on the ledger. The trail usually ends in one of two places: an exchange (a known entity) or a mixer (a deliberate link-breaker).
Free to play. No ads, no token, no account needed to start.
What you get asked
Put the basic tracing routine in order
Patience beats genius here. Professional investigators do exactly this, with software to handle thousands of branches. The logic is what you just ordered.
A stolen-funds trail ends at a labelled exchange deposit address. What do you now know?
The chain hands you the doorstep, not the ID card. Exchanges run KYC, so law enforcement can request the account holder's identity; that last step is off-chain.
What does a mixer like Tornado Cash actually do to a money trail?
Nothing is deleted: deposits and withdrawals are all still public. The link between YOUR deposit and YOUR withdrawal is what drowns in the crowd.
Splitting stolen funds across hundreds of wallets doesn't delete the ___. Analysts can still walk every branch.
Complexity buys time, not erasure. Every one of those hundreds of wallets has a public history that leads back to the split.
After the 2022 Ronin bridge hack (over $600M stolen), investigators tracked the funds for months. Why couldn't the hackers erase their tracks?
They mixed, hopped chains, and waited, yet analysts and authorities followed the branches for months, and some funds were seized. Immutability cuts both ways: thieves can't shred the evidence. 🐜
The rest of this unit
Every address tells a story: age, habits, identity, and where the money went.