Live investigation session Case file · ML / 2026 / 08
Follow the movement. Then ask what the pattern means.

Following Dirty Money Across the Blockchain

A practical, plain-language tour of how investigators map and track suspicious money flows, using a live synthetic training network on the Polygon blockchain.

Wed, Aug 19, 2026 · 7:00 PM IST No blockchain experience needed Evidence-led tracing demo

This is an interactive deck. Use the button, Right Arrow, or swipe left to move through the slides.

Before We Start

Why you will see patterns, not case files

🔒 Due to confidentiality obligations…
…I cannot show you the exact addresses, amounts, or case details from my real investigations. Names, numbers, and identifiers from active or closed matters stay sealed.
✅ …so I built this instead
Every address you'll see tonight was created by me before this session, funded with a valueless educational token, and every move is live on the Polygon blockchain, permanent and verifiable by anyone.
📚 The patterns are real
The network I built mirrors the exact behaviors investigators see in real cases: breaking money into smaller pieces, mixing it through many wallets, and finally feeding it back into the "clean" economy.
The rule of tonight: I share the how investigators think and how patterns look, never operational details that could compromise any real case.
Key Takeaways

What you will carry away tonight

1️⃣
Laundering has a repeatable shape
Three stages, placement, layering, integration, recognized by law worldwide. Criminals improvise, but the shape keeps repeating, on cash and on chain alike.
2️⃣
The blockchain is a public ledger, forever
Every transaction ever made is still there, readable by anyone with an internet connection. It is the best informant criminals ever hired, they just don't know it.
3️⃣
On-chain and off-chain complete each other
Crypto is moved on chain, but laundering is finished off chain, at banks, merchants, and exchanges. The full crime lives across both worlds.
4️⃣
You can trace it yourself, tonight, live
I built a 13-wallet money-laundering network live on Polygon, and together we will walk through it step by step, like an investigator would.
If you remember only one sentence: the money can change wallets a thousand times, but the ledger remembers every single change, in order, forever.
Part One · The Basics

Money laundering: dirty money pretending to be clean

In plain words
Taking money earned from crime and making it look like it came from somewhere honest, so the criminal can spend it without raising alarms. It is not stealing; it is the cover-up after the stealing.
The crime must end somewhere real. A criminal can't live on numbers in a wallet. Someday the money must become a car, a house, a business, groceries, something usable. That need is what makes every laundering network findable.
The three stages, defined worldwide (FATF)
🪙
1 · Placement. "Getting it in"
Dirty money enters the financial system, usually broken into small, safe-looking pieces.
🔀
2 · Layering. "Confusing the trail"
Money is moved around many times, through many wallets, to hide where it started and who controls it.
🏪
3 · Integration. "Making it look clean"
Money re-enters normal life as payments, purchases, or investments, appearing earned honestly.
The three-stage model comes from the FATF Recommendations, the global standard followed by 200+ jurisdictions, including India (PMLA, 2002).
Part Two · The Shift to Crypto

Why criminals moved from suitcases of cash to wallets of code

Cash had problems…
  • Physical, heavy, risky to move, countable
  • Slow across borders, a suitcase can't fly itself
  • Hard to use in big deals, few large purchases are made in cash
…so they found the internet of money
  • One address can move millions in seconds
  • No borders, a wallet in India can pay a wallet in Argentina instantly
  • Create a new wallet in 10 seconds, for free, no ID needed
The appeal is speed and scale, not invisibility.
…but they forgot the fine print 🔍
  • Public ledger: every transfer recorded forever, viewable by anyone
  • Pseudonymous, not anonymous: an address hides a name, not a behavior
  • Pattern leaves footprints: speed, size, and timing of transfers create a fingerprint
  • The off-ramp betrays them: to spend it, they must touch a bank or exchange that knows their name
On chain, cash's one advantage disappears. Cash left no record. Crypto leaves everything, forever, in order, publicly. Criminals traded anonymity for speed, and speed is exactly what investigators measure.
~$82B in illicit value observed on-chain in 2025 (aggregated industry reports). Stablecoins are now the dominant vehicle, faster still, but equally recorded.
Part Three · The Anatomy

One crime, three moves, seen the same way in cash and crypto

🪙
PLACEMENT
Big dirty pile gets broken into many small, "normal-looking" pieces that can quietly enter the system.
structuring / smurfing
🔀
LAYERING
Pieces hop between many wallets, split, merge, and pass through, so the trail becomes a tangled web.
hopping / commingling
🏪
INTEGRATION
Money lands where it is spent, merchants, exchanges, investments, now wearing a clean costume.
payments / off-ramps
What an investigator actually looks for: wallets created minutes before big moves · identical small amounts arriving together · wallets that receive a lot and keep almost nothing · money that reappears where it started. None of these is proof alone. patterns stacked together form the picture.
Part Four · Two Worlds, One Crime

The crime is half on screen, half in the real world

⛓️
ON CHAIN
  • Dirty funds enter through wallets
  • They hop, split, and merge across hundreds of addresses
  • The ledger records every hop, in order, forever
  • Investigators can see the entire journey here
↔️
🏦
OFF CHAIN
  • Exchanges and banks know the human behind the account (KYC)
  • Merchants receive payments; goods and services change hands
  • This is where money becomes usable, the end goal
  • Paper trails, IDs, and accounts live here
The bridge between the two worlds is where laundering gets caught. The blockchain shows the journey. The exchange shows the name. The investigator connects both, and the "anonymous" wallet becomes a person with a case file.
On-chain activity proves the movement Off-chain records prove the person Together = a complete case
Case File 01 · Synthetic training network

What the first clue tells us

Do not begin with every transfer. Begin with one observable event, then follow the recipient.

Start here
One source, several fresh wallets

TREASURY sends equal 950K c4 USD allocations into the first branch wallets.

First visible pattern
Money converges quickly

SM1 and SM2 forward funds into HUB1, while parallel wallets converge through HUB2.

Question for the room
What should we follow next?

Do not chase every line. Follow the next recipient, then test the pattern at each junction.

13 wallets · 20 transfers · 5,000,000 c4 USD · valueless educational token on Polygon

Interactive case map · click a node or stage

The network, as an investigator sees it

Synthetic build · 5,000,000 c4 USD (valueless) · Polygon
🏦
TREASURY
money source
🧑‍🦰
SM1
smurf
🧑
SM2
smurf
🧑‍🦱
SM3
smurf
🌀
HUB 1
funnel
🌀
HUB 2
funnel
⚡
ROUTER
pass-through
🔐
VAULT
consolidation
🏪
MERCHANT
spending
🔄
EXCHANGE
off-ramp
😶
IDLE
never moved
🔎 Click to enlargeScroll to explore
Following the Money. Live

How I trace it, step by step

Step 1 · Pick a seed wallet
Every trace starts at one address, here, a smurf wallet. Ask: who funded it, and how old is it?
Step 2 · Profile it
Balances, every transfer in and out, token holdings. New wallet + round amount + fast forwarding = three flags already.
Step 3 · Follow the next address
Each recipient becomes the next seed. Repeat, the network reveals itself hop by hop.
Step 4 · Draw the graph
The whole journey becomes a map, hubs, funnels, pass-throughs, and dead ends all visible at once.
🚩 Red flags we will see tonight
  • Many small, equal amounts arriving at once (structuring)
  • Wallets that forward everything and keep almost nothing (pass-through)
  • Fresh wallets moving within minutes of creation
  • Money that circles back to where it started (the wash loop)
  • Wallets funded but never used (silent staging accounts)
Remember: any of these alone is suspicious, not criminal. Investigators build the pattern, the shape of the whole network, before anyone is accused of anything.
↩
Evidence view: the return path

Open the receipt only after the room has spotted the EXCHANGE → SM1 loop.

⌘
Evidence view: what the transaction says

Use the decoder to support the conclusion, not to make the slide do the teaching.

🔎 Click to enlargeScroll to explore
🔎 Click to enlargeScroll to explore
The Bottom Line

The ledger never forgets, and that changes everything

What the map can show
  • The order and direction of every visible transfer
  • Where many branches meet, split, or circle back
  • Which wallets appear inactive or act only as pass-throughs
What still needs investigation
  • Who controls an address and why the transfer happened
  • Whether an off-chain payment or identity closes the case
  • Independent records that confirm the explanation
⚡
Pass-through evidence

ROUTER illustrates an address that receives value and forwards it onward with little retained.

😶
The silent wallet

No onward movement is an observation, not proof. It may be staging, unused, or irrelevant.

🔎 Click to enlargeScroll to explore
🔎 Click to enlargeScroll to explore
Tonight you saw the thinking, not just the tools: classify before you chase, follow the shape of the money, and remember that on-chain activity is only half the story, the off-ramp is where the case closes.
⛓️

You've seen the map.
Now learn to read it professionally.

Tonight was awareness, the shape of laundering and how a trace begins. Doing this on real cases, with real tools, under real deadlines, is a deeper skill.

The chain never forgets Patterns > secrets The off-ramp closes the case
🎓 Cryptocurrency Money Laundering Analyst. C4 Academy
Hands-on training in exactly what you glimpsed tonight: multi-chain tracing, wallet profiling, evidence-grade documentation, and the investigation lifecycle, from seed address to court-ready narrative. Built for investigators, compliance analysts, and anyone who wants to go from aware to operational.
c4academy.com/cryptocurrency-money-laundering-analyst.php
DM me for the details, happy to help you decide if it's right for you.
1 / 12