NEMESIS TRACER | Coldcard Forensic Monolith

Total Volume Traced

Total Trace Volume

Pending... Calculating...

Victims Mapped 0 Discovered Wallets

UTXOs Traced 0 On-Chain Flow Edges

Endpoints Resolved 0 VASPs & Terminals

Layout & Filter Controls

Network Topology (Physics Off)

Graph Legend

Seed Wallet

Standard Wallet (Hop)

CEX / Custodial

Transaction Edge

ACTIONABLE NEXUS

OSINT Indicators

Malicious / Sanctioned

VASP / Exchange

OSINT Indicators

Malicious / Sanctioned

VASP / Exchange

Mixer / High Risk

Unknown / Unclassified

Real-time Tracing Logs

Timestamp	Tx Hash	Source Entity	Flow	Target Entity	Nexus	USD Vol	Token Vol

Objectives and Mission

Primary Objectives

Identify actionable endpoints. Focus on where major funds reached exchanges, VASPs, or identifiable entities for preservation or law-enforcement action.
Prioritize the largest cases. Start with top losses ($100K+, $500K+, $1M+). We do not need to investigate thousands of small records initially.
Validate the COLDCARD connection. Classify the nexus as Confirmed, Highly Likely, Possible, or Unknown for each priority case.

Key Question: Which cases give us the clearest path from victim → stolen funds → identifiable endpoint → potential action?

Tracing Logic & Targets

Primary Suspect Address: bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r
(Graffiti Pool holding ~562 BTC). Remaining balance across 6 prominent addresses.
Total Loss Amount: 1,816 BTC ($116M - $130M USD)
Total Victims: 5,200+ unique drained Bitcoin addresses
Incident Dates: July 30, 2026 – August 3, 2026 (Initial sweep: Jul 30, 41-min window)
Target Block Windows: 960,183 to 960,191

Incident Summary Matrix

Metric	Verified On-Chain Data Point	Source Reference
Primary Attacker Wallet	bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r	Public Blockchain Ledger
Total Cryptographic Loss	1,816 BTC	TRM Labs Audit
Total Fiat Valuation	$116,000,000 – $130,000,000 USD	Galaxy Research
Total Victim Impact	5,200+ Compromised Addresses	WeirFoulds LLP Litigation Analysis
Core Attack Window	July 30, 2026 – August 3, 2026	On-Chain Time Stamps
Core Mining Block Heights	Blocks 960,183 – 960,191	Key Forensic Identifiers The Fee Footprint The primary automated exploit scripts universally set a transaction fee of exactly 30 satoshis per virtual byte (sat/vB). Zero-Change Architecture The attack completely emptied victim addresses in a single sweeping transaction, leaving zero change outputs behind. The First Wave Timestamp The opening automated heist successfully drained 1,082.65 BTC from 1,196 addresses within a narrow 41-minute window on July 30.
Origin Cluster	Date / TX Hash	Receiver Terminal (VASP)	Total Amount Landed	Action
Forward tracing to identify Suspect CEX endpoints...

Raw Tracing Logs

Export JSON

ID / Cluster	Victim Address & Entity	Date & TX Hash	Receiver & Hops	Method & Rules	Loss Value & UTXO
Awaiting trace execution...

Fingerprinted Clusters

Awaiting cluster intelligence...

OSINT Intelligence Records

Target Address	Identified Entity	Risk Categorization	Evidence Source
Awaiting OSINT enrichment...

Layout & Filter Controls

Graph Legend

Real-time Tracing Logs

Objectives and Mission

Primary Objectives

Tracing Logic & Targets

Incident Summary Matrix

The Fee Footprint

Zero-Change Architecture

The First Wave Timestamp

Raw Tracing Logs

Fingerprinted Clusters

OSINT Intelligence Records

Aggregated Transaction Details

FULL DATA MAPPED

Document Viewer

Wallet Intelligence Profile

Cryptographic Proof of Nexus

OSINT & Fingerprinting (OP_RETURN / CLUSTERING)

Transaction Intelligence

Transaction Graph Analysis

Target Alerts

Cloudflare Data Catalog (Iceberg)

Required CORS Policy