Data source: live:alchemy · scale 0–100, higher is riskier

95of 100

Address screening severe alerting

0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b

ethereum · attributed to Tornado Cash Router (Sanctioned entity or designated address, public attribution) · cluster tornado-cash

Block and escalate. Direct or heavy illicit exposure.

Traced value4,336,950USD

Direct4,336,950hop 1

Indirect1,954,611hops 2-2

Nodes traced6868 edges

Received1,210,950USD

Sent3,126,000USD

Balance0.0000ETH

Transfers300of 148

Why this alerted

screened address is itself attributed to Tornado Cash Router

score 95 reached the alert threshold of 65

Indirect exposure covers 1 observed hop(s) with a 0.5 decay per hop.

Exposure graph

Counterparty category Mixing or anonymising service Unattributed address

24 node(s) drawn (44 lower-value node(s) omitted for legibility). Ring distance is hop count; solid edge = direct hop, dashed = deeper hop. Circle area tracks USD, not risk. The highest-value node(s) on each ring are captioned; hover any dot for its full attribution.

Score composition

Category	Severity	Points
Mixing or anonymising service	high	75.0

Score = top component + 25% of the rest, capped at 100. Alert threshold is 65.

Rescreen history

First screen of this subject.

Direct and indirect exposure by category

severe high medium low not scored faded segment = indirect exposure scored share (hop-decayed) alerting threshold

Bars show each category's share of traced volume. The score uses the hop-decayed share marked on the bar, so exposure further out counts for less than the bar's width suggests.

Mixing or anonymising service high 75.0 pts

volume: direct 72.0783% (3,126,000 USD) · indirect 0.0% (0 USD)
scored: 72.0783% after hop decay vs 1.0% threshold → saturation 100.0% × 75 pts = 75.0 pts

Unattributed address none 0.0 pts

volume: direct 27.9217% (1,210,950 USD) · indirect 45.0688% (1,954,611 USD)
scored: 50.4561% after hop decay vs 100.0% threshold → saturation 50.5% × 0 pts = 0.0 pts

Exposure by hop

Category	Direct (hop 1)	Hop 2	Total
Mixing or anonymising service	3,126,000	0	3,126,000
Unattributed address	1,210,950	1,954,611	3,165,561

hop 1 observed from the subject's transfers; deeper hops are a live indexer walk that stops at identified services and walks each labelled cluster once. Budgets are split inbound/outbound so both sides of the trail receive inputs. Hop-N value is a slice of the parent; weighted value decays by 0.5 per hop. No hop is invented from the seed.

Direct counterparties (30)

Entity	Category	Jurisdiction	Attribution	Terminal	Value (USD)
Tornado Cash 100 ETH Pool 0xa160cdab225685da1d56aa342ad8841c3b53f291	Mixing or anonymising service	--	public (1.00)	traced on	1,500,000
ERC20Tornado 0x23773e65ed146a459791799d01336db287f25334	Mixing or anonymising service	--	blockscout (0.85)	traced on	900,000
Tornado Cash 10 ETH Pool 0x910cbd523d972eb0a6f4cae4618ad62622b39dbf	Mixing or anonymising service	--	public (1.00)	traced on	575,000
Unattributed address 0x7bb6...ec2c 0x7bb6dd219c7c24d0d2d298cec79167edd012ec2c	Unattributed address	--	unlabelled (0.00)	traced on	500,250
Unattributed address 0xb010...c537 0xb01046a287b0f49eb468381bdf42fbe464b6c537	Unattributed address	--	unlabelled (0.00)	traced on	250,000
Tornado Cash 1 ETH Pool 0x47ce0c6ed5b0ce3d3a51fdb1c52dc66a7c3c2936	Mixing or anonymising service	--	public (1.00)	traced on	137,500
Unattributed address 0x885e...2022 0x885e621b8209f896f66ce6ae8d76662dc9292022	Unattributed address	--	unlabelled (0.00)	traced on	57,500
Unattributed address 0x0e9c...1119 0x0e9c4dfae4671c727ffa19bb127181727d091119	Unattributed address	--	unlabelled (0.00)	traced on	50,250
Unattributed address 0x3a45...d00b 0x3a450d5a5e0247b7e676dd1868288d89f952d00b	Unattributed address	--	unlabelled (0.00)	traced on	50,000
Unattributed address 0xa036...a316 0xa0365b5847c08448d8965dc9cd9189092745a316	Unattributed address	--	unlabelled (0.00)	traced on	50,000
Unattributed address 0xadbd...280c 0xadbdc697bbc8ec2d95160f89ec8240e012b0280c	Unattributed address	--	unlabelled (0.00)	traced on	50,000
Unattributed address 0x2028...03cb 0x2028a20e7ba41d3d355af1ff4787e5ced27e03cb	Unattributed address	--	unlabelled (0.00)	traced on	50,000
Unattributed address 0xe494...6c36 0xe4948fbb3b172614cbcfe767eea38b8c57276c36	Unattributed address	--	unlabelled (0.00)	traced on	37,500
Unattributed address 0x7c0d...4d91 0x7c0dbf7626af610df9e249f2acc6a194519a4d91	Unattributed address	--	unlabelled (0.00)	traced on	25,000
Unattributed address 0x8cdd...1c9b 0x8cdde88bec70e5c59a73c381a579dfbb44651c9b	Unattributed address	--	unlabelled (0.00)	traced on	25,000
Unattributed address 0x5459...c718 0x5459736d81c31766ed1468916fe6fed3aeeac718	Unattributed address	--	unlabelled (0.00)	traced on	25,000
Unattributed address 0x5f5d...b43a 0x5f5dc1daadb4bb4f9ef49b25188b558304a2b43a	Unattributed address	--	unlabelled (0.00)	traced on	20,000
Tornado Cash 0.1 ETH Pool 0x12d66f87a04a9e220743712ce6d9bb1b5616b8fc	Mixing or anonymising service	--	public (1.00)	traced on	13,000
Unattributed address 0xdd5e...ff96 0xdd5e30c370310cd939684f113ef18d41a0b7ff96	Unattributed address	--	unlabelled (0.00)	traced on	7,250
Unattributed address 0x2173...29c1 0x21735e49bce26a99d7b33de54de6c2e7573d29c1	Unattributed address	--	unlabelled (0.00)	traced on	7,250
Unattributed address 0xd60a...72f8 0xd60ac585551a826aab1dc4eccf551b59bd2872f8	Unattributed address	--	unlabelled (0.00)	traced on	2,500
Unattributed address 0xd5e0...2b75 0xd5e0072e3c9e499488e0a3ac95061df859d42b75	Unattributed address	--	unlabelled (0.00)	traced on	1,250
Unattributed address 0xbebb...6bc7 0xbebb99159f5dc525619ab8246e058ad6bd146bc7	Unattributed address	--	unlabelled (0.00)	traced on	750
TornadoCash_erc20 0x169ad27a470d064dede56a2d3ff727986b15d52b	Mixing or anonymising service	--	blockscout (0.85)	traced on	500
Unattributed address 0xd895...43cc 0xd89503fbdc999aa3b85726877a40eac26dba43cc	Unattributed address	--	unlabelled (0.00)	traced on	500
Unattributed address 0xfc72...faac 0xfc72217978d34ac68856f5491f32f4195d87faac	Unattributed address	--	unlabelled (0.00)	traced on	250
Unattributed address 0x85aa...f163 0x85aa77108e24a13fec1f4fc7800aafe4b546f163	Unattributed address	--	unlabelled (0.00)	traced on	250
Unattributed address 0x0919...c72a 0x0919f2b5d4c385ad943c948b2bd3d6047f89c72a	Unattributed address	--	unlabelled (0.00)	traced on	250
Unattributed address 0xa32f...c6e9 0xa32f7dd58e208eab53421ba61ae738ce366fc6e9	Unattributed address	--	unlabelled (0.00)	traced on	100
Unattributed address 0x23af...16ca 0x23af1b2ef410248c26e71eab3f76088b3d3116ca	Unattributed address	--	unlabelled (0.00)	traced on	100

Cluster ownership and attribution

Entities58clusters in trace

Identified151.31% of value

Illicit entities3severity 7+

Illicit volume3,126,00072.078% of traced

Operators055 self-custody

Entity	Category	Attribution	On-chain party	Distance	Value (USD)	Share
Tornado Cash 0.1 ETH Pool tornado-cash · 4 of 3 address(es) seen	Mixing or anonymising service	high law enforcement record or operator confirmation	protocol	direct	2,225,500	51.315%
ERC20Tornado erc20tornado · 1 of 1 address(es) seen	Mixing or anonymising service	low single-source or heuristic attribution	protocol	direct	900,000	20.752%
TornadoCash_erc20 tornadocash-erc20 · 1 of 1 address(es) seen	Mixing or anonymising service	low single-source or heuristic attribution	protocol	direct	500	0.012%
Unattributed address 0x4f0e...e8f7 unlabelled-6456e8f7 · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	2 hops	573,580	13.225%
Unattributed address 0x7bb6...ec2c unlabelled-d012ec2c · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	500,250	11.535%
Unattributed address 0x4e5b...972f unlabelled-4c7e972f · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	2 hops	500,250	11.535%
Unattributed address 0xb03b...8198 unlabelled-79618198 · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	2 hops	322,665	7.44%
Unattributed address 0xb010...c537 unlabelled-64b6c537 · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	250,000	5.764%
Unattributed address 0x3486...75ab unlabelled-4b5875ab · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	2 hops	244,312	5.633%
Unattributed address 0xf70d...dbef unlabelled-dfa3dbef · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	2 hops	243,468	5.614%
Unattributed address 0x885e...2022 unlabelled-c9292022 · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	57,500	1.326%
Unattributed address 0x0e9c...1119 unlabelled-7d091119 · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	50,250	1.159%
Unattributed address 0x15de...c2eb unlabelled-f54cc2eb · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	2 hops	50,250	1.159%
Unattributed address 0xadbd...280c unlabelled-12b0280c · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	50,050	1.154%
Unattributed address 0xa036...a316 unlabelled-2745a316 · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	50,037	1.154%
Unattributed address 0x2028...03cb unlabelled-d27e03cb · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	50,006	1.153%
Unattributed address 0x3a45...d00b unlabelled-f952d00b · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	50,000	1.153%
Unattributed address 0xe494...6c36 unlabelled-57276c36 · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	37,500	0.865%
Unattributed address 0x7c0d...4d91 unlabelled-519a4d91 · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	25,000	0.576%
Unattributed address 0x8cdd...1c9b unlabelled-44651c9b · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	25,000	0.576%
Unattributed address 0x5459...c718 unlabelled-aeeac718 · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	25,000	0.576%
Unattributed address 0x5f5d...b43a unlabelled-04a2b43a · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	20,000	0.461%
Unattributed address 0x4d38...fc61 unlabelled-2784fc61 · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	2 hops	13,914	0.321%
Unattributed address 0xdd5e...ff96 unlabelled-a0b7ff96 · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	7,250	0.167%
Unattributed address 0x2173...29c1 unlabelled-573d29c1 · 1 of 1 address(es) seen	Unattributed address	low single-source or heuristic attribution	self_custody	direct	7,250	0.167%

Confidence mix: 1 high, 0 moderate, 57 low. For a custodial operator the beneficiary is the end user behind the address and is not visible on-chain, so an exchange appearing here is a routing endpoint, not a suspect.

Behavioural patterns

Pattern	Detected	Confidence	Evidence
Peeling chain	yes	moderate	Run of 3 successively smaller outbound transfers totalling $100,000, consistent with peeling a bulk balance into small increments.
CoinJoin or joint spend	yes	moderate	68 transfers of near-identical value inside a 6-hour window, the shape of a collaborative mix rather than ordinary payments.
Mixing service use	yes	high	$3,126,000 (72.08% of flow) moved directly with an anonymising service.
Cross-chain hopping	no	—	No material bridge or swap routing.
Structured deposits into a service	no	—	No run of similar-sized deposits into a single service.
Rapid layering	yes	high	75 outbound transfer(s) left within an hour of funds arriving, median dwell 0.0h.

Velocity of funds

Median dwell	0.0 h
Fastest dwell	0.0 h
Sub-hour hops	75 of 75 (100.0%)
Band	immediate

Transfer size bands

Band	Transfers	Value	Share
retail	243	211,950	4.89%
professional	57	4,125,000	95.11%
institutional	0	0	0.0%

Patterns are computed from the observed transfer set only. They describe transaction shape, not intent, and a detection is not by itself evidence of an offence.

Service risk profiles

No directory-profiled service appears in this trace.

Liquidity pool illicit concentration

No liquidity pool or bridge appears in this trace.

Transfer sample (50)

When	Direction	Counterparty	USD
2026-08-28 16:07	in	0x213cfeb89529efc2eae2...	0
2026-08-28 16:03	in	0x4af043aca08bbe1fa2ac...	0
2026-08-28 15:58	in	0x3446ca64c9d4fd9eb35d...	0
2026-08-28 15:56	in	0x3446ca64c9d4fd9eb35d...	0
2026-08-28 15:54	in	0x3446ca64c9d4fd9eb35d...	0
2026-08-28 15:52	in	0x3446ca64c9d4fd9eb35d...	0
2026-08-28 15:49	in	0x3446ca64c9d4fd9eb35d...	0
2026-08-28 15:46	in	0x542db1a465fe63941fff...	0
2026-08-28 15:45	out	0x169ad27a470d064dede5...	100
2026-08-28 15:45	in	0xa32f7dd58e208eab5342...	0
2026-08-28 15:45	in	0x4750bcfcc340aa4b31be...	0
2026-08-28 15:45	in	0xa32f7dd58e208eab5342...	100
2026-08-28 15:44	in	0x09efa4777a855eb946df...	0
2026-08-28 15:44	in	0xf50ef13e5c29f9cf52b6...	0
2026-08-28 15:44	in	0x03392600086874456e08...	0
2026-08-28 15:43	in	0xf50ef13e5c29f9cf52b6...	0
2026-08-28 15:43	in	0x4750bcfcc340aa4b31be...	0
2026-08-28 15:42	in	0x4750bcfcc340aa4b31be...	0
2026-08-28 15:39	in	0x0a5b2bf3ccfb44c1d22f...	0
2026-08-28 15:39	out	0x12d66f87a04a9e220743...	250
2026-08-28 15:39	in	0xdd5e30c370310cd93968...	250
2026-08-28 15:39	out	0x47ce0c6ed5b0ce3d3a51...	2,500
2026-08-28 15:39	in	0x213cfeb89529efc2eae2...	0
2026-08-28 15:39	in	0x5f5dc1daadb4bb4f9ef4...	2,500
2026-08-28 15:38	out	0x12d66f87a04a9e220743...	250
2026-08-28 15:38	in	0xbebb99159f5dc525619a...	250
2026-08-28 15:38	in	0x4750bcfcc340aa4b31be...	0
2026-08-28 15:37	out	0x12d66f87a04a9e220743...	250
2026-08-28 15:37	out	0x47ce0c6ed5b0ce3d3a51...	2,500
2026-08-28 15:37	out	0x12d66f87a04a9e220743...	250
2026-08-28 15:37	out	0x12d66f87a04a9e220743...	250
2026-08-28 15:37	out	0x12d66f87a04a9e220743...	250
2026-08-28 15:37	out	0x47ce0c6ed5b0ce3d3a51...	2,500
2026-08-28 15:37	out	0x47ce0c6ed5b0ce3d3a51...	2,500
2026-08-28 15:37	out	0x12d66f87a04a9e220743...	250
2026-08-28 15:37	out	0x47ce0c6ed5b0ce3d3a51...	2,500
2026-08-28 15:37	out	0x12d66f87a04a9e220743...	250
2026-08-28 15:37	out	0x47ce0c6ed5b0ce3d3a51...	2,500
2026-08-28 15:37	out	0x12d66f87a04a9e220743...	250
2026-08-28 15:37	out	0x12d66f87a04a9e220743...	250
2026-08-28 15:37	in	0xdd5e30c370310cd93968...	250
2026-08-28 15:37	in	0x5f5dc1daadb4bb4f9ef4...	2,500
2026-08-28 15:37	in	0xdd5e30c370310cd93968...	250
2026-08-28 15:37	in	0xdd5e30c370310cd93968...	250
2026-08-28 15:37	in	0xdd5e30c370310cd93968...	250
2026-08-28 15:37	in	0xdd5e30c370310cd93968...	2,500
2026-08-28 15:37	in	0x0a5b2bf3ccfb44c1d22f...	0
2026-08-28 15:37	in	0x4750bcfcc340aa4b31be...	0
2026-08-28 15:37	in	0xdd5e30c370310cd93968...	2,500
2026-08-28 15:37	in	0xdd5e30c370310cd93968...	250

Provenance

Screening ID	SCR-06cb7c0bb506
Created	2026-08-28T16:08:57+00:00
Data source	live:alchemy
Provider detail	https://eth-mainnet.g.alchemy.com/v2/… \| native=148 token=16 internal=136
Providers	https://eth-mainnet.g.alchemy.com/v2/… (preferred when enabled), https://eth.blockscout.com
Label set	187 entities, 19 categories
Hop decay	0.5 per hop
Trace stops at	custodian, defi, exchange, high_risk_exchange, merchant, mining

Cluster members

0xd90e2f925DA7...0x8589427373D6...0x910Cbd523D97...0x12D66f87A04A...0x47CE0C6eD5B0...0xD4B88Df4D29F...0xA160cdAB2256...0x7221222433f8...0x179f48C78f57...

Informative

Notice / Disclaimer

Limits that apply to this artefact as a whole. Sources and hashes stay in provenance; this section is how to read them.

ChainTrace screenings combine public blockchain data with a seeded label set. Hop 1 is observed from the subject's transfers; deeper hops are a live indexer walk that stops at identified services (exchanges, custodians, merchants, mining, high-risk exchanges and DeFi). Unlabelled counterparties stay unknown. Synthetic seed entities are demonstration labels, not live attribution.