Funds tracing report
71% of the value taken on 3 August 2026 reached deposit addresses at three identifiable exchanges within nine days. 18% is in two dormant wallets. 11% was bridged to a network outside the scope of this report.
41.6 ETH and 62,000 USDC (GBP 212,000 at the time) left Ms Example's wallet in two transactions on 3 August 2026 after a fraudulent 'support' call. The funds were split three ways, partly swapped into a stablecoin, and moved through four hops. The largest share reached deposit addresses at three exchanges we identify with high or medium confidence; the schedule in section 6 gives every transaction reference. Whose accounts those are can only be established by the exchanges themselves.
1Starting point and scope
Commissioned by Example Law LLP on behalf of Ms K. Example. On 3 August 2026 the client, following instructions given over the telephone by a caller claiming to be from her wallet provider, approved two transactions from her wallet 0x8c2e...40aa: 41.6 ETH at 14:07 UTC and 62,000 USDC at 14:09 UTC, both to 0xb31f...77e2. The report follows those funds on Ethereum, Arbitrum and BNB Chain to the first point at which they reached an exchange, a service, or a wallet where they remain. Branches worth less than GBP 500 at the time were not followed. Values are in pounds at the time of each transaction.
2The flow of funds
The funds were divided at the first hop and each branch followed separately. The diagram shows value at the time of each transfer.
| Hop | Date / time (UTC) | From | To | Asset / amount | Value then (GBP) | Note |
|---|---|---|---|---|---|---|
| 0 | 3 Aug 14:07 | 0x8c2e...40aa (client) | 0xb31f...77e2 | 41.6 ETH | 88,200 | First fraudulent transaction |
| 0 | 3 Aug 14:09 | 0x8c2e...40aa (client) | 0xb31f...77e2 | 62,000 USDC | 48,900 | Second fraudulent transaction. Total is GBP 212,000 with fees and price movement accounted for in the schedule |
| 1 | 3 Aug 14:31 | 0xb31f...77e2 | 0x4c80...1a9d (A) | 28.0 ETH | 59,400 | Split 1 of 3 |
| 1 | 3 Aug 14:31 | 0xb31f...77e2 | 0x0d57...e3b1 (B) | 62,000 USDC | 48,900 | Split 2 of 3 |
| 1 | 3 Aug 14:33 | 0xb31f...77e2 | 0x9a12...c04f (C) | 13.55 ETH | 28,700 | Split 3 of 3; 0.05 ETH kept for fees |
| 2 | 3 Aug 15:02 | 0x4c80...1a9d (A) | Decentralised exchange | 28.0 ETH -> 59,180 USDT | 59,100 | Swap; value continues in USDT |
| 2 | 4 Aug 09:14 | 0x0d57...e3b1 (B) | Exchange 2 deposit address 0xf1e3...9b20 | 36,500 USDC | 28,800 | Endpoint |
| 2 | 4 Aug 09:20 | 0x0d57...e3b1 (B) | Bridge contract | 25,500 USDC | 20,100 | Bridged to a network outside scope - see section 4 |
| 2 | 5 Aug 22:47 | 0x9a12...c04f (C) | 0x19d4...50aa | 8.1 ETH | 17,500 | Dormant since |
| 2 | 5 Aug 22:49 | 0x9a12...c04f (C) | 0x6e02...b7c3 | 4.0 ETH | 8,600 | Dormant since |
| 3 | 6 Aug 03:12 | 0x9a12...c04f (C) | Exchange 3 deposit address 0x71c4...9a2e | 1.4 ETH | 3,000 | Endpoint |
| 3 | 8 Aug 11:40 | 0x4c80...1a9d (A) | 0x2be9...04d1 | 59,180 USDT | 46,700 | Layering; held 4 days |
| 4 | 12 Aug 07:55 | 0x2be9...04d1 | Exchange 1 deposit address 0xd18e...77f0 | 59,180 USDT | 46,800 | Endpoint |
3Where the funds are now
| Endpoint | Type | Identification | Confidence | Amount | Value then (GBP) | Status at report date |
|---|---|---|---|---|---|---|
| 0xd18e...77f0 | Exchange deposit address | Exchange 1 - labelled in two public datasets; swept to the exchange's known hot wallet 40 minutes after receipt | High | 59,180 USDT | 46,800 | Swept into exchange 12 Aug |
| 0xf1e3...9b20 | Exchange deposit address | Exchange 2 - sweep pattern to a labelled hot wallet; not itself labelled | Medium | 36,500 USDC | 28,800 | Swept into exchange 4 Aug |
| 0x71c4...9a2e | Exchange deposit address | Exchange 3 - labelled | High | 1.4 ETH | 3,000 | Swept into exchange 6 Aug |
| 0x19d4...50aa | Wallet | Fresh wallet, no other history | - | 8.1 ETH | 17,500 | Unmoved; balance 8.1 ETH |
| 0x6e02...b7c3 | Wallet | Fresh wallet, no other history | - | 4.0 ETH | 8,600 | Unmoved; balance 4.0 ETH |
| Bridge contract | Bridge | Destination network outside scope | - | 25,500 USDC | 20,100 | See section 4 |
4Obfuscation
- Split into three branches at hop 1 within two minutes.
- Swap of 28 ETH to USDT on a decentralised exchange at hop 2, so branch A continues in a different asset.
- Layering through one intermediate wallet on branch A, held for four days before the exchange deposit.
- Bridge of 25,500 USDC at hop 2 to a network outside the scope of this report. The bridge's outgoing leg is recorded; the incoming leg on the destination network would need to be matched by amount and time in a separate exercise, which we can quote for.
- No mixer was used on any branch we followed.
The pattern - quick split, one swap, deposits to exchanges within days - is consistent with an operator cashing out rather than holding.
5Attribution
The chain shows keys, not people. What can and cannot be said about who controls each address:
| Address | What the evidence supports | Confidence |
|---|---|---|
| 0xb31f...77e2 and the hop-1 wallets | Created within the 48 hours before the theft, funded only by these transactions, used only for this. Controlled by the person who obtained the client's approval or someone acting with them. | High |
| Exchange deposit addresses | Each belongs to one customer account at the exchange named. Which customer is known only to the exchange. | - |
| 0x19d4...50aa, 0x6e02...b7c3 | Same operator as above, on funding and timing. No link to any labelled or identifiable entity. | Medium |
6Schedule of transactions
All 23 transactions from the client's wallet to each endpoint, in order, with full references. The first six are shown here; the complete schedule is delivered as a CSV and as an appendix suitable for exhibiting.
| # | Date / time (UTC) | Network | Transaction reference | From | To | Asset | Amount | GBP then |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-08-03 14:07:41 | Ethereum | 0x7d2e...a91c | 0x8c2e...40aa | 0xb31f...77e2 | ETH | 41.6 | 88,200 |
| 2 | 2026-08-03 14:09:12 | Ethereum | 0x3b90...f204 | 0x8c2e...40aa | 0xb31f...77e2 | USDC | 62,000 | 48,900 |
| 3 | 2026-08-03 14:31:05 | Ethereum | 0xc4a1...0e77 | 0xb31f...77e2 | 0x4c80...1a9d | ETH | 28.0 | 59,400 |
| 4 | 2026-08-03 14:31:05 | Ethereum | 0xc4a1...0e77 | 0xb31f...77e2 | 0x0d57...e3b1 | USDC | 62,000 | 48,900 |
| 5 | 2026-08-03 14:33:50 | Ethereum | 0x88de...5b3a | 0xb31f...77e2 | 0x9a12...c04f | ETH | 13.55 | 28,700 |
| 6 | 2026-08-03 15:02:19 | Ethereum | 0x1f6c...d8e0 | 0x4c80...1a9d | DEX router | ETH -> USDT | 28.0 -> 59,180 | 59,100 |
| ... |
7Information for the solicitor
The facts a disclosure request or freezing application would need, without comment on the applications themselves:
| Exchange | Deposit address | Received | Amount | Value then (GBP) | Reference |
|---|---|---|---|---|---|
| Exchange 1 | 0xd18e...77f0 | 12 Aug 2026 07:55 UTC | 59,180 USDT | 46,800 | Schedule #21 |
| Exchange 2 | 0xf1e3...9b20 | 4 Aug 2026 09:14 UTC | 36,500 USDC | 28,800 | Schedule #9 |
| Exchange 3 | 0x71c4...9a2e | 6 Aug 2026 03:12 UTC | 1.4 ETH | 3,000 | Schedule #14 |
The two dormant wallets hold 12.1 ETH between them at the report date. We can notify you if either moves.
8Limits
This report covers Ethereum, Arbitrum and BNB Chain. Funds bridged to another network were followed to the bridge and no further. Exchange identification relies on public labels and observed sweep patterns and is graded; the account holder behind a deposit address is known only to the exchange. Activity inside an exchange is not visible on-chain. Branches below GBP 500 at the time were not followed. Attribution of an address to a person is an inference from the evidence stated. This report is not legal advice and does not itself recover anything.