Wallet forensics

What a wallet held, and who it held it with

One address, seven measurements: what it is mixed up in, which addresses share its operator, what it has done lately worth flagging, its book at any past instant, its distance from a sanctions list, the counterparties it trades with or against, and the wallets behind the same exchange account.

Two upstreams, and one of them is reconstructed

The first three sections come from the forensic engine, which is not connected to this deployment today — they render as not analysed, never as nothing found. The last four are implemented and tested, but the address-level chain history they read does not exist yet: Scienter has no transfer backfill, and building one is separate work.

So an address we have not reconstructed returns nothing, and this surface deliberately does not fill that gap with a plausible-looking invention. A generated hop count under a real stranger's address, on a page headed “sanctions”, would be a fabricated allegation rather than a demonstration.

Every profile in this file was generated by a seeded simulation and describes no real activity. The addresses are synthetic: sha256('SCIENTER-DEMO-WALLET:' + label)[:40]. Nothing here is a measurement, and the sanctions section is not a screen.

Worked examples

Synthetic addresses, so the four reconstruction panels can be seen working without attaching a finding to anybody. Each is sha256("SCIENTER-DEMO-WALLET:" + label)[:40], which anyone can recompute.

What each section measures

Risk breakdownforensic engine: What is this wallet mixed up in?; A composite risk score with every contributing factor shown beside its source, or marked uncited.
Entity clusterforensic engine: Which addresses share an operator?; The engine’s own attribution across whatever heuristics it runs, with the confidence it assigns.
Flagged activityforensic engine: What has this wallet done recently that is worth flagging?; Transactions the engine flagged, with the chain, the counterparty and the severity it assigned.
Historical replayreconstructed: What did this wallet hold, and what was it up, as of any past instant?; Average-cost position accounting replayed over the fill stream. Realised profit is net of fees and computable from fills alone; unrealised profit is null, never zero, wherever a held instrument could not be priced.
Sanctions overlayreconstructed: Is this address on a list, or how many hops from one?; Exact match against a sanctions reference list, then a breadth-first search for the shortest path through the counterparty graph to any listed address. Only ever presented as a screen when both the list and the graph are real.
Ally / adversary graphreconstructed: Who does this wallet consistently trade alongside, and who against?; Fills on the same instrument inside a short window are one observation, aligned if on the same side. The edge weight is shrunk towards neutral by sample size, so one coincidence cannot outrank four hundred observations.
CEX deposit clusteringreconstructed: Which addresses are one exchange account?; Addresses that funded the same exchange deposit address are grouped. Confidence falls as the member count rises — a crowded deposit address is an omnibus, not one person with forty wallets — and every false-positive mode is stated per cluster.

A Hyperliquid trader's performance record — deflated Sharpe, the copy gate, the signals they were on — is a different and separately measured surface at the wallet leaderboard. That one scores the trading; this one scores the conduct, and the two are kept apart so neither reads as evidence for the other.