TraceOps Labs runs an automated AI agent that traces stolen and suspicious on-chain funds — across chains and bridges, with a reconciliation-and-recovery focus — and returns an evidence-backed investigation dossier.
Invite-only today · intake via the Down Tracer Telegram bot
You bring one starting point and a short description of the case. The agent does the tracing and reconciliation, and returns a structured report.
Send an Ethereum wallet address or transaction hash to the Telegram bot, plus a short description of the suspected hack, scam, or relationship you need traced.
The agent decodes the source transactions, follows funds across chains and bridges, and clusters addresses — every hop annotated with a confidence level.
It keeps a running ledger: total source vs. traced vs. current holders vs. unresolved gap. Each address is classified — attacker, helper, bridge, collector, current holder, entity stop, depleted, or unknown.
You receive a structured investigation dossier at a short-lived, single-user secure link — no dashboards to log into.
The agent prioritizes locating material funds now — holders, balances, and paths — over writing a narrative.
Follows value from the source outward to current custody, so the report ends on where the funds are — not where they might have gone.
Resolves bridge legs to destination-chain custody, with a reverse-bridge check before concluding funds have stopped moving.
Groups related addresses and labels each by role, with defensible confidence rather than a single unexplained verdict.
Decodes the full source-transaction transfer set — internal txs, logs, pagination — and separates victim value sources (vaults, pools, lending markets) from attacker contracts, including flash-loan legs.
Every dollar is accounted for against the source total, with the unresolved gap stated explicitly instead of quietly dropped.
A deposit into a CEX, bridge, or mixer is treated as an entity stop with a recovery action — not as an invitation to guess at exchange-internal movement.
Intake is an Ethereum wallet or transaction today — but tracing does not stop at one chain. The agent pursues funds into Solana, TRON, BNB Chain, Bitcoin, and across the bridges in between.
NEAR is not yet supported.
Every case produces the same fixed-structure report — authored by the agent, preserved byte-for-byte, and delivered as a rendered dossier page.
Reproducible by design. Every finding ships with the query bundle that produced it — re-run it on your own node and get the same answer.
Evidence discipline. Verified facts, labels, and analyst inference are kept separate. The agent never invents a label, bridge mapping, balance, amount, or transaction.
Funds left the source wallet through a DEX swap, bridged to a second chain, and split across several first-hop branches. Figures below are placeholders shown to illustrate structure — they do not describe a real case.
Freeze requests at named entity stops; watchlist entries for active branches.
Reports are served from private storage behind HMAC-signed links that expire in 15 minutes and are bound to the requesting user. Raw storage URLs are never exposed.
Each investigation runs in isolation with cross-job memory disabled, so one case can never influence another.
All on-chain data, labels, and calldata are treated as untrusted evidence — never as instructions to the agent.
TraceOps Labs is invite-only today. Intake runs through the Down Tracer Telegram bot — request access and we’ll get you onboarded.
Contact: [ add your Telegram / email here ]