Skip to content This library is free, offered as dana. If it helps your work, donate here →
penguin tree ai
← back to libraryDonate here

This is one of 3,622 free prompts in the penguin tree ai library. Sign up once and the whole library opens, with new prompts by email.

open the library →

Blockchain fund flow trace

Traces on-chain cryptocurrency fund flows across hops, classifies wallet clusters and counterparty risk, detects mixing/layering/peel-chain patterns, and produces an investigator-ready trace narrative with…

download .md

Purpose

Produce a structured, defensible trace of how funds moved to or from a target crypto address — identifying the ultimate source and destination, flagging obfuscation techniques (mixers, layering, peel chains), and classifying counterparty risk — so an AML investigator can make a disposition decision and document it for a SAR or case file. Solves the problem of turning raw hop data into a coherent, risk-rated narrative.

When to Use

Invoke this skill when the user asks to:

  • Trace where funds in a specific wallet or transaction came from (source-of-funds)
  • Trace where funds from a flagged address ultimately went (destination-of-funds)
  • Investigate a suspicious address, transaction hash, or counterparty
  • Identify whether funds passed through a mixer, tumbler, or bridge
  • Build the on-chain evidence trail to support a SAR or AML case narrative
  • Assess counterparty exposure to sanctioned, darknet, or high-risk entities

Inputs Required

Before starting, collect:

  • Target identifier: The address or transaction hash under investigation
  • Chain: Bitcoin, Ethereum, Tron, or other network (determines UTXO vs. account model)
  • Direction: Source-of-funds (inbound) / Destination-of-funds (outbound) / Both
  • Trigger reason: Why this is being investigated (alert, subpoena, exchange flag, chargeback)
  • Trace depth: Maximum hops to trace (default: 5 hops or until a known service/exchange endpoint is reached)
  • Available attribution data: Any Chainalysis/TRM/Elliptic labels, exchange KYC, or subpoena returns the user already has
  • Case context: Customer identity, expected legitimate activity, jurisdiction

If attribution data is missing, work from on-chain heuristics and flag every unattributed cluster as "unknown — requires attribution vendor lookup" rather than guessing an identity.

Instructions

Step 1: Establish the Target and Model

Confirm the chain's accounting model, because it changes the tracing logic:

  • UTXO chains (Bitcoin, Litecoin): Trace by transaction outputs; apply common-input-ownership heuristic to cluster addresses controlled by one entity; account for change outputs
  • Account chains (Ethereum, Tron, BSC): Trace by address balance and token transfers; distinguish native transfers from ERC-20/TRC-20 token movements and internal contract calls
  • State the target address/tx, the chain, the direction of the trace, and the value in both native units and USD at time of transaction (note the price basis).

Step 2: Map the Fund Flow, Hop by Hop

For each hop from the target (up to the depth limit), document:

  1. Hop number and direction (inbound source or outbound destination)
  2. Address/cluster involved
  3. Amount and % of traced funds (track proportional flow — funds split across outputs must be tracked by share)
  4. Timestamp and any timing pattern (rapid succession, structured intervals)
  5. Attribution / entity type: Exchange, DeFi protocol, mixer, bridge, merchant, personal wallet, or unknown

Use proportional tracing (taint-by-share): when funds split, follow the largest and any suspicious branches; note branches abandoned and why.

Step 3: Detect Obfuscation Patterns

Flag any of the following, with the specific evidence:

  • Mixing/tumbling: Deposit into a known mixer (Tornado Cash, Wasabi CoinJoin, Sinbad) or CoinJoin-style equal-output transactions that break the trace
  • Layering: Multiple rapid hops through fresh wallets with no economic purpose, designed to distance funds from origin
  • Peel chain: A large sum that repeatedly peels off small amounts to fresh addresses while forwarding the remainder — classic cash-out obfuscation
  • Chain-hopping / bridging: Movement across chains via bridges or cross-chain swaps to evade single-chain analysis
  • Nested exchange / instant swap: Funds routed through a non-KYC swap service (e.g., an anonymous instant exchange) to sever attribution
  • Structuring: Amounts deliberately kept below reporting or exchange-limit thresholds

For each detected pattern, note where in the hop sequence it occurred and its effect on trace confidence.

Step 4: Classify Counterparty Risk

Assign a risk tier to each identified counterparty, using Chainalysis/TRM-style categories:

  • Severe: Sanctioned entities (OFAC SDN), darknet markets, ransomware wallets, child-exploitation, terrorist financing
  • High: Mixers/tumblers, high-risk/non-KYC exchanges, scam/fraud clusters, gambling on restricted jurisdictions
  • Medium: DeFi protocols with weak controls, P2P platforms, unhosted wallets with mixed history
  • Low: KYC-compliant regulated exchanges, known merchants, institutional custodians

State direct exposure (target transacted directly with the entity) vs. indirect exposure (within N hops) — direct exposure carries materially higher weight.

Step 5: Determine Source and Destination Conclusions

  • Source-of-funds finding: Where funds most plausibly originated and whether that origin is legitimate, high-risk, or indeterminate
  • Destination-of-funds finding: Where funds ultimately settled — a cash-out exchange (name it if attributed), continued in cold storage, or lost to a mixer
  • Confidence level: High / Medium / Low, with the reasoning (attribution quality, hops broken by mixing, unresolved branches)

Step 6: Assign Overall Risk Rating and Recommend Action

Produce a single risk rating (Severe / High / Medium / Low) and a disposition recommendation:

  • File SAR / escalate to investigations
  • Restrict or freeze account pending review
  • Request additional info (attribution lookup, RFI to customer, subpoena)
  • Clear and document — no further action

Step 7: Draft the SAR-Supporting Narrative

Write a concise factual narrative suitable for a case file: what was traced, the obfuscation observed, the counterparties involved, the source/destination conclusions, and why the funds are (or are not) suspicious. Use plain, evidentiary language — no speculation stated as fact.

Output Format

  • Structure: Header with target details → hop-by-hop flow table → obfuscation findings → counterparty risk table → source/destination conclusions → overall risk rating → SAR narrative → recommended actions
  • Length: 900–1,400 words
  • Format: Tables for the hop map and counterparty risk classification; structured findings and prose for the narrative
  • Sections: Trace Summary · Fund Flow Map · Obfuscation Detected · Counterparty Risk · Source & Destination Findings · Overall Risk Rating · Case Narrative · Recommended Actions
  • Tone: Investigator-grade — factual, evidentiary, precise; every risk claim tied to specific on-chain evidence; assumptions and confidence gaps stated explicitly

Quality Checklist

Before delivering output, verify:

  • [ ] Every hop in the flow map lists amount, % of traced funds, timestamp, and entity type
  • [ ] Proportional tracing is applied where funds split — shares are tracked, not just "funds moved"
  • [ ] Each detected obfuscation pattern cites the specific hop where it occurred
  • [ ] Every counterparty has a risk tier AND is marked as direct or indirect exposure
  • [ ] The overall risk rating is stated as a single tier with supporting reasoning
  • [ ] Confidence level is declared, and any unattributed cluster is labeled "unknown" rather than guessed
  • [ ] The SAR narrative contains no speculation presented as established fact

Notes

  • Attribution is only as good as the vendor data behind it — always distinguish heuristic clustering (probabilistic) from confirmed attribution (KYC, subpoena, vendor label).
  • A trace that dead-ends at a mixer is not a failure: "funds entered [mixer] at hop N, trace confidence drops to low beyond this point" is itself a material, reportable finding.
  • Direct exposure to a Severe-tier counterparty typically warrants immediate escalation regardless of amount — flag it at the top of the summary, not buried in the table.
  • Cross-chain movements require re-anchoring the trace on the destination chain; note the bridge and the corresponding destination transaction so the trail remains continuous.

How to use this skill

This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.

Installing in Claude Code:

  • ~/.claude/skills/<folder-name>/SKILL.md — auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)
  • <your-project>/.claude/skills/<folder-name>/SKILL.md — auto-loads only when working in that project (recommended for project-specific skills)

Restart Claude Code or open a new session to register.

Using in Claude.ai, ChatGPT, Gemini, or other AI tools:

  1. Drag this file into a new chat, or copy and paste its contents
  2. Send your task or request as your next message — the AI will apply the skill where it fits

For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills