OURWRLDDocs
Launch terminal
Crypto Globe · 03

Victim → Scammer Tracer

A server-side BFS engine that chases stolen funds from a victim address through swaps, mixers, and bridges until the money lands somewhere identifiable — and renders the route as a live web on the globe.

Server-side BFSCross-chain bridge pivotsTerminal detection

The tracer lives at /api/public/trace-victim. Drop a victim address in the panel, set the hop depth (2–4) and minimum USD threshold, and the route runs a bounded breadth-first walk of outbound flows on Cloudflare Workers. Each hop re-uses the same wallet enrichment endpoint that powers the dossier, so every counterparty is fully classified (exchange / mixer / bridge / casino / sanctioned / scam / contract / unknown) before the BFS decides whether to keep walking.

VICTIM0xabc…hop 1hop 2hop 3hop 4CEX · BinanceMixer · TornadoBridge → SOLContinue BFS…terminal — money landednon-terminal — keep walkingcaps: maxHops · fanout · FETCH_CAP

How a hop is classified

Terminal hops stop the walk
Exchange, mixer, casino, sanctioned, scam, and bridge categories are terminals. Funds reaching one are aggregated into terminals[]and the BFS does not descend further on that branch.
Non-terminals keep walking
Unknown EOAs and contracts are pushed onto the queue with a new parent-node id. Visited addresses are de-duplicated; the queue is bounded by maxHops, fanout (default 4 outbound partners per node), and a global FETCH_CAP (14 wallet lookups).
Bridges become chain pivots
Known bridge contracts (Wormhole, Polygon PoS, Optimism Standard, Stargate, deBridge, Across, LayerZero…) are matched to their destination chain. The hop is marked terminal and tagged with the destination chain so the panel can render the cross-chain pivot.
Outflow heuristic
A counterparty is followed only when its OUT volume from the current node is at leastmax(minUsd, inUsd × 0.4) — this filters out noise-grade dust and pure inbound counterparties.

What the globe paints

The result is published to a shared activeVictimTrace store. CryptoSphere subscribes via useActiveVictimTrace, runs useVictimTraceGraph to convert hops into wallet nodes plus dashed rose flow arcs, and:

  • Forces hasInvestigation = true so the trace renders even on an empty globe.
  • Auto-focuses on the victim node and gently pulls zoom back so the funnel fits the view.
  • Draws trace arcs in #fb7185 with a 10/4 dash pattern, brighter base opacity, and ignores the "dim non-selected" rule so the full route stays visible while you pivot.
  • Positions hop destinations on concentric rings around their parent so the funnel reads outward from the victim.

Limits & honest caveats

This is a public-data forensic aid, not a court-ready report.

  • The walk is bounded by FETCH_CAP / fanout / maxHops to keep the Worker request budget reasonable. Increase min $ to focus on the largest flows when the result is truncated.
  • Post-bridge tracing is best-effort: we can't deterministically follow funds onto the destination chain without an indexer; the hop is annotated and stopped.
  • Counterparty labels come from the wallet enrichment route and the seed entity registry (known exchanges, mixers, casinos, OFAC clusters, named heist wallets).
  • Heuristic detection means OFAC matches and exchange labels are best-effort, not authoritative attribution.
← Previous
Wallet Tracking
Next →
Bubble Map & Associates
ourwrld / documentation
← Back homeLaunch terminal