==========================================================================
  SENTINEL — ON-CHAIN RANSOM TRACING REPORT
  Law-Enforcement Referral Package (SYNTHETIC / DEMO DATA)
==========================================================================
Case ID           : RANSOM-TRACE-20260829-024817
Generated (UTC)   : 2026-08-29T02:48:17.660862+00:00
Prepared by       : SENTINEL Track-Back Platform — On-Chain Ransom Tracing Module (automated)
Intended recipient: outbox/ (SIMULATED — in production: FBI IC3 / CISA via authenticated channel)
Integrity SHA-256 : ed5b5cb92e59a9007a938fe7409433df55c983233fdfe90be564f4e04da20034

--------------------------------------------------------------------------
  LEGAL — TRACE, DO NOT TOUCH
--------------------------------------------------------------------------
TRACE-NOT-TOUCH NOTICE. This report is the product of READ-ONLY analysis
of a public-style blockchain ledger. SENTINEL does not inject tokens
into any wallet, and does not move, seize, freeze, or claw back funds.
The blockchain is a public ledger; we merely FOLLOW the money and record
the trail. Identification of the individuals behind these addresses and
any seizure of funds are performed EXCLUSIVELY by law enforcement
through lawful process (for example, a subpoena to the exchange named at
the cash-out point for its KYC records). We collect and report;
investigators act.

--------------------------------------------------------------------------
  RANSOM PAYMENT
--------------------------------------------------------------------------
Ransom address : demo1RansomLockBitDepositAddr9F2A
Amount paid    : 12.0 BTC
Hops traced    : 6
Addresses seen : 9
Tx followed    : 11

--------------------------------------------------------------------------
  PRIMARY FUND-FLOW TRAIL (follow the money)
--------------------------------------------------------------------------
  START   hop 0  [RANSOM] (Ransomware deposit address (criminal))
            demo1RansomLockBitDepositAddr9F2A
            tainted here: 12.0 BTC
        -> hop 1  [INTERMEDIARY] (Layering hop A)
            demo1IntermediaryHopA7c3d0000001
            tainted here: 7.0 BTC
            via tx: tx0002
        -> hop 2  [INTERMEDIARY] (Consolidation wallet)
            demo1ConsolidationWalletBB550005
            tainted here: 8.0 BTC
            via tx: tx0006
        -> hop 3  [EXCHANGE] (QuickSwap Exchange (regulated off-ramp))
            demo1ExchangeQuickSwapDeposit0007
            tainted here: 7.0 BTC
            via tx: tx0010

--------------------------------------------------------------------------
  FLAGGED CASH-OUT / OFF-RAMP POINTS
--------------------------------------------------------------------------
  [EXCHANGE] demo1ExchangeQuickSwapDeposit0007 (QuickSwap Exchange (regulated off-ramp))
      reached at hop 3
      tainted value arriving: 7.0 BTC
      lawful next step (BY LAW ENFORCEMENT): Refer to law enforcement to subpoena the exchange for KYC records tied to this deposit address

  [MIXER] demo1MixerTumblerServiceXY990006 (Coin mixer / tumbler service)
      reached at hop 2
      tainted value arriving: 4.0 BTC
      lawful next step (BY LAW ENFORCEMENT): Flag mixer usage as an obfuscation indicator for the law-enforcement referral

  [EXCHANGE] demo1ExchangeGlobalCoinDeposit008 (GlobalCoin Exchange (regulated off-ramp))
      reached at hop 3
      tainted value arriving: 3.0 BTC
      lawful next step (BY LAW ENFORCEMENT): Refer to law enforcement to subpoena the exchange for KYC records tied to this deposit address

Total tainted value reaching flagged cash-out points: 14.0 BTC

--------------------------------------------------------------------------
  RECOMMENDED LAWFUL ACTIONS (performed by investigators, not us)
--------------------------------------------------------------------------
1. Forward this package to FBI IC3 (ic3.gov) and/or CISA. 2. For each
flagged EXCHANGE, law enforcement issues a subpoena / legal request for
the KYC identity tied to the deposit address. 3. MIXER usage is
documented as an obfuscation indicator. 4. Any freezing, seizure, or
clawback of funds is carried out solely by law enforcement through the
courts and the regulated exchange — never by SENTINEL.

==========================================================================
  END OF REPORT — We TRACE the public ledger and REPORT.
  We never touch, move, or seize funds.
==========================================================================
