Fund Flow Graph Explorer
About this graph: Trace the movement of stolen BTC from victims to the attacker's
wallets. Nodes are addresses, edges are transfers, and size shows the BTC amount. Color shows the attack
wave. You'll see three main patterns: centralized collecting (Waves 1 & 2), noisy
transfers with privacy mistakes, and isolated vaults (Wave 3). Click any node to see details.
Data last updated: —
Data last updated: —
Filter wave:
Building transaction graph…
Legend
Victim address (swept)
Wave 1 sweep (30 sat/vB)
Wave 2 sweep (50.2 sat/vB)
Wave 2b sweep (10 sat/vB)
Wave 3 sweep (201 sat/vB)
Attacker consolidator
Node Details
Click any node in the graph to inspect its details — address, BTC value, wave attribution, and fee rate.
Drag to pan · Scroll to zoom · Double-click to focus
Three Attacker Patterns
Community Investigation
Pattern A · Scripted Batches
Five clear scripted waves followed by consolidation. This Bitcoin remains untouched. The attacker seems to be waiting.
Pattern B · Messy & Noisy
Repeated, noisy transfers. Some funds moved to Binance or ChangeNOW. This might be a different attacker entirely.
Pattern C · Holding Steady
Similar to Pattern A, this Bitcoin has not moved — possibly because it's being heavily monitored.
Source: @ProfEduStream.