—
Ransom Paid (BTC)
—
Addresses Traced
—
Tx Followed
—
Cash-Out Points
—
Hops Traced
Fund-Flow Trail —
Ransom address
Intermediary / peel
Exchange (cash-out)
Mixer (obfuscation)
edge width ∝ tainted amount
Primary Hop Path follow the money
Flagged Cash-Out Points off-ramps
Each flagged point is where lawful process applies:
law enforcement subpoenas the exchange for the KYC identity behind the
deposit address; mixer usage is logged as an obfuscation indicator.
SENTINEL performs none of these actions — it only reports.
Law-Enforcement Report outbox/
Generate a hand-off package (JSON + human-readable TXT) with the ransom address, hop path, tainted amounts, flagged cash-out points, and the legal trace-not-touch notice.