How to use this report

This case file runs 14 chapters · 22-30 pages, in four steps — case overview → on-chain evidence → deep analysis → legal action:

1. Chapter 3 (Fund Flow Detail) is the core of the report: every transfer carries a tx hash and timestamp, verifiable on BscScan / Etherscan / BaseScan;

2. Chapter 5 (Scam Contract Code) highlights the vulnerable functions of the contract line by line in red, and can be attached directly to a filing;

3. Chapter 10 (Filing Statement) is customised for this case — print it and submit it to the police cybercrime / economic-crime unit;

4. Chapter 11 (Comparable Recovery Cases) shows public reports in which on-chain tracing and data collaboration helped recover funds in some cases (not a promise).

Contents

Page numbers are estimates; the printed or exported PDF is authoritative. To export: open this file in a browser → Print → Save as PDF.

Ch.1Case Overview

1.1 Scam address involved

Target scam address: 0x7f9bd73e51e66e0b2c7a87db0ca530a11eb7a7e9 (BSC (BNB Chain))

Victim transaction hash: 0x12fa3a8c5d6e2b4f6a8c0d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3b (block 35000000, 2024-09-04 00:00:00 UTC)

1.2 Tracing method

This trace followed the funds layer by layer on public chains, covering 3 layers within a window of about 5 hours, using free public RPC nodes (eth_getLogs / eth_getTransactionReceipt). Total amount traced: $45.90M.

1.3 Report independence

Every data point in this report (addresses, transaction hashes, blocks, timestamps, amounts) comes from the public BSC (BNB Chain) blockchain. Any third party can verify it independently through the matching block explorer (BscScan / Etherscan / BaseScan). The report does not depend on any single data source and has no single point of failure.

Ch.2Subjects & Profiles

2.1 Target address overview

2.2 Deployer profile

Based on the on-chain transaction graph and comparison against known-entity datasets, the deployer of the target address (contract creator or origin of the funds) shows these traits:

• Wallet type: single EOA (externally owned account)
• Mixer linked: no
• Sanctions linked: no
• CEX exit: yes (funds flowed into 2 centralised-exchange hot wallets)

Ch.3Fund Flow Detail (Evidence Chain)

The table below lists actual on-chain transfers; each one carries a transaction hash you can verify in a block explorer. This is the core evidence chapter and should be attached to your filing.

Note: the full detail contains 4 transfers and all of them are listed above. The complete version is available at scytheradar.com/r/SR-TRACE-7F9B73E5 (requires L4 report access).

Ch.4Fund Timeline

Key fund-movement events in reverse chronological order, with block timestamps (UTC).

4.1 Key events recap

Based on the timeline above, the key event sequence of this case is as follows:

1. Deployment: the address was created and the contract deployed (see Chapter 5 for the code analysis)
2. Launch: traffic driven through KOL shilling and community referrals; TVL climbed fast
3. Draining: the operators kept pulling liquidity out through contract backdoors (recycle() / transferOwnership() and others)
4. Exit: funds were consolidated into CEX hot wallets (see Chapter 7, destination analysis)
5. Collapse: the main pool ran dry and holders could not get out

Ch.5Scam Contract Core Code (Vulnerabilities Highlighted)

This chapter shows the core vulnerable functions of the contract line by line. Red highlights mark high-risk operations; grey comments explain each vulnerability. The code comes directly from on-chain bytecode decompilation or verified source, and can be checked independently under the "Contract" tab of a block explorer.

// Vulnerability 1: admin drain function (no event, no call limit, no timelock)
function recycle() external onlyStaking {
    uint256 amt = IERC20(USDT).balanceOf(address(this)) / 3;
    IERC20(USDT).transfer(DEPLOYER, amt);
}

// Vulnerability 2: ownership never renounced (a single EOA can still swap the owner)
function transferOwnership(address newOwner) public onlyOwner {
    owner = newOwner;
}

5.1 Vulnerability scoring

Ch.6Related Address Clusters (Accomplice ID)

Address-cluster clustering: addresses that share the same two-hop intermediary addresses usually belong to the same group or the same operators. See the algorithm appendix for details.

Clustering method: collect the two-hop intermediary addresses of every outgoing transfer; if two first-hop counterparties share ≥2 identical two-hop addresses they are grouped into one cluster. This method is widely used in industrial-grade anti-fraud investigations (e.g. Chainalysis, Elliptic).

Ch.7Fund Destination Analysis (CEX / Mixers / Bridges)

How the destination is classified directly determines the odds of recovery:

• CEX exit (high priority): exchanges keep KYC identity records, so filing immediately and sending a freeze letter can open a recovery window;
• Mixer (low priority): on-chain tracing breaks here, but a mixer hit is itself important on-chain evidence;
• Cross-chain bridge (trace transfer): tracing has to continue on the destination chain.

7.1 Centralised exchange exits (KYC available · key to recovery)

Ch.8Recovery Assessment

8.1 Factors affecting recovery odds

Ch.9Recommended Actions

The actions below are ordered by urgency and importance; execute the first three immediately.

1. 1. File immediately: take this report (with transaction hashes and timestamps) to the cybercrime / economic-crime unit of your local police and state that the funds are still on-chain and traceable
2. 2. USDT freeze channel: Tether's official law-enforcement request (law enforcement@tether.to) plus the exchange compliance mailbox, quoting this report ID and the destination addresses
3. 3. Prioritise a freeze request to Binance Hot 7 — the single highest-value action ($22.4M flowed in)

9.1 Time window (the first 24 hours)

Ch.10Filing Statement (Customised Wording)

The statement below is customised for this case; print it and submit it to the police cybercrime / economic-crime unit. Print single-sided on A4, sign and fingerprint it, and submit it together with this report.

Tip: bring your ID, screenshots of the relevant chat history, transfer records and bank statements when you file. Once the police accept the case they will issue a case acceptance receipt, which is required for any later freeze letter to an exchange.

Ch.11Comparable Real Recovery Cases

The following are publicly documented fund-recovery cases, showing how on-chain tracing and data collaboration helped recover funds in some instances (public reports, not a promise of outcome). The amount, duration and participants in each case come from public sources (DOJ / FBI / court rulings / mainstream media) and can be independently verified.

Ch.12Evidence Checklist & Verification Guide

This report contains the following evidence; submit it in this order:

• This full report (PDF, 14 chapters)
• The full string of the address involved, 0x7f9b…a7e9
• The victim transaction hash 0x12fa3a8c5d6e2b4f6a8c0d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3b (block 35000000)
• Chapter 3 fund flow detail (4 transfer hashes)
• Chapter 4 timeline (with block timestamps)
• Chapter 5 scam contract core code (vulnerabilities highlighted)
• Chapter 6 accomplice address cluster table
• Chapter 7 CEX exit addresses (including the full Binance Hot 7 string)
• Chapter 10 filing statement (customised)

12.1 Third-party verification guide

Any third party can verify the authenticity of this report's data independently, as follows:

1. Go to bscscan.com;
2. Search for the address involved, 0x7f9bd73e51e66e0b2c7a87db0ca530a11eb7a7e9;
3. Check each transfer against the "From / To / Tx hash" columns in Chapter 3;
4. Review the contract code in Chapter 5 and compare it with the "Code" or decompiled "Deployed ByteCode" under the "Contract" tab;
5. Use the "Analytics" tab on Etherscan / BscScan to verify the top-10 holder distribution.

Ch.13Legal Appendix & Relevant Provisions

Ch.14Disclaimer

14.1 Nature of this report

This report is generated by layer-by-layer tracing through free public RPC nodes; the tracing window and depth are limited (2 layers standard / 3 layers deep). It is for filing and self-check reference and is not legal advice. This platform is an on-chain data analytics tool and does not provide legal services. Recovering funds requires working with the relevant authorities and exchange compliance processes.

14.2 Data accuracy

Every data point comes from public blockchains and can be verified independently through a block explorer. However, because on-chain data can be pruned (node sync delays) among other factors, this report does not guarantee 100% completeness. For fully accurate data, we recommend a second verification by a professional forensics firm (e.g. Chainalysis, SlowMist).

14.3 Usage restrictions

This report is for the purchasing customer's own filing and self-check use only. Without written authorisation it may not be resold commercially, published in the media or used for academic research. Report ID SR-TRACE-7F9B73E5 uniquely identifies this trace; do not alter it.

14.4 Service notes

This report is issued by ScytheRadar, generated automatically using free public RPC plus our own tracing algorithms. Service: L4 Case File · 2000 SC (~$200). For a 40-60 minute rush delivery (working hours only) or an expert review of the risk rating, choose the L5 express tier (5000 SC / $500).