Independent On-Chain Investigator

The trail doesn't end
at the mixer.

Blockchain intelligence. Fund flow analysis. OSINT. The investigations that start where most reports stop.

#CryptoForensics #OnChainOSINT #DeFiExploits #BlockchainIntelligence
July 20, 2026 Allbridge Core · Investigation

Allbridge Core's $1.65M Exploit: Tracing the Funds Through DAI, RAILGUN, and a NEAR Hot Wallet

A flash loan from Kamino, a distorted pool ratio, and three withdrawals out of Allbridge Core's Solana pool. One leg swapped to DAI and moved toward NEAR through a wallet funded via RAILGUN. Another leg matched — to the decimal — a bridge transaction already under separate investigation.

Allbridge Core RAILGUN NEAR Protocol Mayan Protocol
Read investigation →
June 16, 2026 Guide · Blockchain Forensics

How to Trace Funds After Tornado Cash

A practical methodology for post-mixer tracing. Real tools, real SQL queries, and the behavioral patterns most investigators miss — developed across live exploit investigations.

Dune Analytics Metasleuth LI.FI Hyperliquid
Read guide →
June 15, 2026 Cyrus Finance · Part 2

Two Months Before Tornado Cash: The Cyrus Finance Solana Side-Channel

Closing the books on Cyrus Finance. The remaining 210 BNB followed the same laundering architecture — but 1.67 BNB peeled off through a different bridge entirely, on a route the attacker had been quietly preparing since January. That detour leads somewhere Part 1 never went: Solana.

BNB Chain Tornado Cash Solana Hyperliquid
Read investigation →
About

On-chain investigator with a focus on the part of the trail that everyone else writes off as "the funds went to a mixer, the end." I trace DeFi exploits, document manipulation patterns, and follow money across chains — Tornado Cash exits, bridge aggregators, DEX routing, and L1s that most compliance tools don't index.

Background in OSINT and blockchain forensics. Available for investigations, collaborations, and tip-offs on incidents worth following.