TraceOps Labs runs an automated AI agent that traces stolen and suspicious on-chain funds, across chains and bridges, with a reconciliation-and-recovery focus, and returns an evidence-backed investigation report.
Invite-only today · intake via the TraceOps Agent Telegram bot
You bring one starting point and a short description of the case. The agent does the tracing and reconciliation, and returns a structured report.
Send a wallet address or transaction hash on a supported chain to the Telegram bot, plus a short description of the suspected hack, scam, or relationship you need traced.
The agent decodes the source transactions, follows funds across chains and bridges, and clusters addresses, with every hop annotated with a confidence level.
It keeps a running ledger: total source vs. traced vs. current holders vs. unresolved gap. Each address is classified as attacker, helper, bridge, collector, current holder, entity stop, depleted, or unknown.
You receive a structured investigation report at a short-lived, single-user secure link, with no dashboards to log into.
The agent prioritizes locating material funds now, holders, balances, and paths, over writing a narrative.
Follows value from the source outward to current custody, so the report ends on where the funds are, not where they might have gone.
Resolves bridge legs to destination-chain custody, with a reverse-bridge check before concluding funds have stopped moving.
Groups related addresses and labels each by role, with defensible confidence rather than a single unexplained verdict.
Decodes the full source-transaction transfer set (internal txs, logs, pagination) and separates victim value sources such as vaults, pools, and lending markets from attacker contracts, including flash-loan legs.
Every dollar is accounted for against the source total, with the unresolved gap stated explicitly instead of quietly dropped.
A deposit into a CEX, bridge, or mixer is treated as an entity stop with a recovery action, not as an invitation to guess at exchange-internal movement.
Submit a wallet address or a transaction on any supported chain, and the agent follows the funds wherever they move, across chains and bridges.
Every case produces the same structured report, authored by the agent, preserved byte-for-byte, and delivered as a rendered page.
A few of the core sections:
Reproducible by design. Every finding ships with the query bundle that produced it, so you can re-run it on your own node and get the same answer.
Evidence discipline. Verified facts, labels, and analyst inference are kept separate. The agent never invents a label, bridge mapping, balance, amount, or transaction.
Funds left the source wallet through a DEX swap, bridged to a second chain, and split across several first-hop branches. Figures below are placeholders shown to illustrate structure, and do not describe a real case.
Freeze requests at named entity stops; watchlist entries for active branches.
Reports are served from private storage behind HMAC-signed links that expire in 15 minutes and are bound to the requesting user. Raw storage URLs are never exposed.
Each investigation runs in isolation with cross-job memory disabled, so one case can never influence another.
All on-chain data, labels, and calldata are treated as untrusted evidence, never as instructions to the agent.
TraceOps Labs is invite-only today. Intake runs through the TraceOps Agent Telegram bot. Request access and we’ll get you onboarded.
Contact: haoxiang@traceopslabs.xyz
