MYTHOS — Exchange Attribution Intelligence | From Suspect Wallets to Exchange Attribution

02 — THE ATTRIBUTION CHALLENGE

One address reported.
Thousands of transactions conceal where the money rests.

A victim names a single wallet. Behind it: peel chains, consolidation hops and obfuscation layers engineered to exhaust manual review — while the funds move toward an off-ramp in hours, not weeks.

63%rise in crypto-linked fraud complaints across recent reporting cycles (indicative).
38 hrsmedian analyst effort to trace one multi-hop case by hand.
72 hrstypical window before dispersed funds reach an off-ramp exchange.

Complaint filed→ Suspect address→ 4,812 transactions→ Hidden fund flow→ Unknown exchange→ Investigation delay

All figures synthetic — demonstration narrative only. Replace with agency-verified statistics before operational use.

03 — PLATFORM CAPABILITIES

Five disciplines.
One verdict.

I

Exchange Attribution

Probable off-ramps named through deposit-wallet fingerprinting, address-reuse correlation and off-ramp behaviour models.

Exchange “K” 87%Exchange “M” 42%

II

Wallet Clustering

Co-spend, change-address and temporal heuristics assemble co-controlled wallets into reviewable entity clusters.

CLUSTER C-118 · 14 WALLETSCLUSTER C-119 · 6 WALLETSCLUSTER C-122 · 3 WALLETS

III

Fund Flow Analysis

Value-weighted multi-hop paths with peel-chain, split and merge detection across six hops.

12.48 ETH · VICTIM → HORIZON4 HOPS · 23 ENTITIES

IV

Risk Intelligence

Transparent weighted scoring — every point traceable to the transaction that earned it.

RISK 92 / HIGH · 14 INDICATORSEXPOSURE · 3 SCAM ENTITIES

V

Investigation Support

Sealed, hash-anchored evidence packs: verdict, flow maps, ledgers and draft exchange-notice requests.

ANNEXURES A–F · PDF + JSONCHAIN-OF-CUSTODY SEALED ✓

LIVE CONSOLE — POWERED BY THE MYTHOS API

File an address.
Receive an attribution.

CHECKING BACKEND…

LIVE SOURCES · CHECKING…

INTAKE · FORM I-01

Suspect wallet address CHAIN AUTO-DETECTS ON INPUT

Chain Fraud typology

Trace mode LIVE READS PUBLIC CHAIN DATA · FALLS BACK TO DEMO IF UNREACHABLE NCRP acknowledgement no. (optional)

Officer Unit

Analyst note (optional)

POSTS TO /api/cases · THEN RUNS THE TRACING ENGINE.

AWAITING INTAKE

No live case loaded. File a suspect wallet on the left — the engine will collect, trace, cluster and attribute it here, step by step.

① INTAKE → ② COLLECTION → ③ TRACING
④ CLUSTERING → ⑤ ATTRIBUTION → ⑥ REPORT

04 — BLOCKCHAIN TRACING · CENTERPIECE

Follow the funds,
hop by hop, to the off-ramp.

Interactive reconstruction of dossier MYT-2026-0117. Replay the movement, isolate a hop, or hover any entity for its forensic summary.

VICTIMINTERMEDIATE OBFUSCATIONEXCHANGE DEPOSIT EDGE WIDTH ∝ VALUE MOVED

HOVER AN ENTITY FOR ITS FORENSIC SUMMARY

BLOCKS 19,204,118 → 19,208,441 · SYNTHETIC TRACECASE MYT-2026-0117

FRAUD TYPOLOGY ATLAS — SERVED BY /api/typologies

Seven crime shapes.
Seven tracing playbooks.

Every intake is classified against these typologies. The engine weights its tracing strategy — peel-chain hunts, mule fan-out mapping, bridge pursuit — on the reported shape.

LOADING TYPOLOGIES…

05 — INVESTIGATION WORKFLOW

Six steps from complaint
to court-ready lead.

01 · INTAKE
Victim Reports Wallet Address
Complaint, FIR reference and suspect address ingested with chain auto-detection.
02 · COLLECTION
Wallet Intelligence Collection
Full history, counterparties and exposure assembled — 4,812 transactions, 1,140 counterparties.
03 · TRACING
Blockchain Transaction Analysis
Value-weighted forward trace to six hops with peel-chain and split/merge detection.
04 · CLUSTERING
Wallet Clustering & Entity Detection
Behavioural heuristics group co-controlled wallets — cluster C-118, fourteen wallets.
05 · ATTRIBUTION
Exchange Attribution
Deposit fingerprints matched against the entity directory — Exchange “K”, 87% confidence.
06 · REPORTING
Investigation Report Generation
Hash-anchored evidence pack: verdict, flow maps, ledgers, draft exchange notice.

06 — ANALYTICS PREVIEW

One dossier.
Every panel in agreement.

INVESTIGATION DOSSIER · MYT-2026-01170x7a…9f3e · ETHEREUM · 4,812 TXNS

WALLET INTELLIGENCE

Address0x7a41…9f3e

Risk rating92 / 100 · HIGH

Transactions4,812 · first seen 41 days ago

ExposureDirect scam-cluster contact · 3 entities

EXCHANGE ATTRIBUTION

87%confidence · EXCHANGE “K”

Deposit wallet0xB4…c21d · reuse ×7

runners-up · “M” 42% · OTC “R” 28%

TRANSACTION ANALYSIS

Volume traced12.48 ETH · ≈ ₹31.2L (indicative)

Timeline03:12 → 14:52 · 4 hops · 11h 40m

RISK INTELLIGENCE

Direct transfer from known scam cluster +32
Mixer interaction within 2 hops +24
Peel-chain dispersal pattern +14
Fresh deposit-wallet reuse (×7) +12
No verified-entity offset +0

ALL PANELS DRAW FROM THE SAME TRACE GRAPH

07 — FOR LAW ENFORCEMENT

Built for the desk
where time is evidence.

01

Faster Investigations

Manual tracing measured in weeks compresses to hours — collection and hop expansion run while the analyst reviews.

38 hrs → ~3 hrs pilot estimate · synthetic

02

Actionable Intelligence

Cases close with named leads — exchange, deposit wallet, controller cluster — ranked by confidence.

5 leads / case ranked · evidenced

03

Better Attribution

Off-ramps identified even through obfuscation layers, via post-mixer deposit fingerprints.

87% confidence dossier MYT-0117

04

Improved Evidence Collection

Hash-anchored packs, reproducible hops and annexured ledgers support cybercrime proceedings.

Annexures A–F maps · ledgers · hashes

LEA INTEGRATION DESK — SAHYOG · NCRP · FIU WORKFLOW

From attribution
to action within the SLA.

NCRP → MYTHOS → SAHYOG PIPELINE

Complaint lands on NCRPAcknowledgement number attaches at intake and follows the case everywhere.
Automated trace + attributionSeconds of compute replace ~38 manual hours; confidence-scored VASP named.
Notice drafted in-consoleFreeze (102 CrPC / 106 BNSS), preservation (91/94) or KYC disclosure — pre-filled, officer-signed.
Routed via SAHYOGFIU-registered VASPs acknowledge inside SLA; offshore entities parallel-track MLAT.

DEMONSTRATION DRAFTS ONLY — VERIFY PROVISIONS AND ROUTE THROUGH AUTHORISED CHANNELS.

AUTOMATED ALERTS · LIVE

LOADING ALERTS…

RISK MATRIX · —

LOADING MATRIX…

OPERATIONS DASHBOARD · LIVE

LOADING STATS…

CASES BY TYPOLOGY

LATEST DOSSIERS

CASE	TYPOLOGY	RISK	ATTRIBUTION

08 — TECHNOLOGY OVERVIEW

An intelligence stack,
not a black box.

Conceptual architecture for evaluation. No implementation detail, no live connectivity in this demonstration.

LAYER 05 · PRESENTATION

Investigation DossierCase console · flow canvas · evidence-pack builder · review surfaces

LAYER 04 · INTELLIGENCE

Risk Intelligence LayerWeighted fraud indicators · exposure models · scoring audit trail

Entity AttributionExchange directory · deposit fingerprints

Wallet ClusteringCo-spend · change · temporal

Analytics EngineHop expansion · peel-chain detection

LAYER 01 · DATA

Blockchain Data LayerMulti-chain ingestion · normalised transactions · deterministic re-trace

◈ DETERMINISTIC RE-TRACE◈ HUMAN-IN-THE-LOOP◈ HASH-ANCHORED EVIDENCE◈ NO LIVE MAINNET IN DEMO

FOR LEA IT TEAMS — REST + JSON

Built to plug into
NCRP, SAHYOG and FIU rails.

METHOD	ROUTE	PURPOSE
GET	/api/health · /api/docs	Status + catalogue
GET	/api/typologies · /api/exchanges · /api/risk-matrix	Reference packs
POST	/api/cases	Intake (NCRP ref, typology, officer)
POST	/api/cases/:id/trace	Run tracing engine
GET	/api/cases/:id/report	Standard report A–G + sha256
POST	/api/cases/:id/notice	SAHYOG notice draft
GET	/api/dashboard · /api/alerts	Ops aggregates + alert feed
GET	/api/chains	Live coverage per chain + sources

curl -X POST http://localhost:3000/api/cases \
  -H "Content-Type: application/json" \
  -d '{"walletAddress":"0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045",
       "typology":"PHISHING", "mode":"live",
       "complaintRef":"NCRP-2026-881142"}'

# → 201 { case: { id: "MYT-2026-0130", mode: "live", … } }
curl -X POST http://localhost:3000/api/cases/MYT-2026-0130/trace
curl http://localhost:3000/api/cases/MYT-2026-0130/report

09 — REQUEST DEMONSTRATION

Bring your hardest
cold case. Watch it traced.

A sixty-minute supervised walkthrough on synthetic infrastructure. One historical wallet shape — mixer, peel-chain, cross-chain welcome — reconstructed live, with the sealed demo report yours to circulate.

One address reported.Thousands of transactions conceal where the money rests.

Five disciplines.One verdict.

Exchange Attribution

Wallet Clustering

Fund Flow Analysis

Risk Intelligence

Investigation Support

File an address.Receive an attribution.

INTAKE · FORM I-01

—

HOP LEDGER

AUTOMATED RECOMMENDATIONS

Follow the funds,hop by hop, to the off-ramp.

Seven crime shapes.Seven tracing playbooks.

Six steps from complaintto court-ready lead.

Victim Reports Wallet Address

Wallet Intelligence Collection

Blockchain Transaction Analysis

Wallet Clustering & Entity Detection

Exchange Attribution

Investigation Report Generation

One dossier.Every panel in agreement.

WALLET INTELLIGENCE

EXCHANGE ATTRIBUTION

TRANSACTION ANALYSIS

RISK INTELLIGENCE

Built for the deskwhere time is evidence.

Faster Investigations

Actionable Intelligence

Better Attribution

Improved Evidence Collection

From attributionto action within the SLA.

NCRP → MYTHOS → SAHYOG PIPELINE

AUTOMATED ALERTS · LIVE

RISK MATRIX · —

OPERATIONS DASHBOARD · LIVE

CASES BY TYPOLOGY

LATEST DOSSIERS

An intelligence stack,not a black box.

Built to plug intoNCRP, SAHYOG and FIU rails.

Bring your hardestcold case. Watch it traced.

One address reported.
Thousands of transactions conceal where the money rests.

Five disciplines.
One verdict.

File an address.
Receive an attribution.

Follow the funds,
hop by hop, to the off-ramp.

Seven crime shapes.
Seven tracing playbooks.

Six steps from complaint
to court-ready lead.

One dossier.
Every panel in agreement.

Built for the desk
where time is evidence.

From attribution
to action within the SLA.

An intelligence stack,
not a black box.

Built to plug into
NCRP, SAHYOG and FIU rails.

Bring your hardest
cold case. Watch it traced.