PEAK EXPOSURE TALLY
Autonomous Bitcoin historical watermark reconstruction and pre-forensic feasibility triage.
// 01 THE CORE PROBLEM: WHY STATIC BALANCES LIE
In cryptocurrency theft, fraud, and unauthorized transfers, victims and initial investigators frequently look at the current wallet balance of suspect addresses. In almost every case, that balance is near zero because illicit actors sweep funds immediately across multiple hops, deposit into mixers, or off-ramp to centralized exchanges.
Peak Exposure Tally solves this by shifting the focus from static current balances to the cumulative historical watermark. It reconstructs the maximum cumulative Bitcoin value controlled across your designated address cluster before dispersal began—giving you the objective dollar exposure needed to decide your next move.
// 02 PRELIMINARY TRIAGE: DO NOT OVERPAY BEFORE YOU KNOW
Retaining blockchain forensic experts and legal representation typically requires upfront retainers between $5,000 and $25,000+. Engaging professionals makes no financial sense if:
- The cumulative peak loss is smaller than the cost of hiring the investigator.
- 100% of the funds immediately entered non-custodial privacy mixers with zero traceable off-ramps.
- No identifiable centralized exchange points exist where freeze requests or subpoenas can be served.
Blockworm acts as your non-legal starting point. It provides an immediate, low-barrier tally that tells you objectively whether hiring a professional investigator is commercially justified.
// 03 HOW IT WORKS: THE 4-STAGE PIPELINE
Autonomous execution workflow from raw address intake to forensic handoff packet.
Address Clustering
Add one or dozens of known victim, theft, or counterparty addresses to your project. Group addresses together under a single case umbrella.
Watermark Reconstruction
The engine analyzes the full transaction history across all addresses simultaneously, calculating the exact peak Bitcoin exposure reached before spend.
Flow Categorization
Post-peak outflows are classified into actionable buckets: Statutory KYC Exchange Outflows (cross-referenced against each country's mandatory KYC enactment year), Mixer Volume, and remaining Unspent UTXOs.
Mid-Run Recalculation
Found new addresses mid-investigation? Add them anytime. The watermark dynamically recalculates across the combined cluster history in real time.
// 04 THE ACTIONABILITY VERDICT ENGINE
Automated decision heuristics that guide your economic and forensic next steps:
| VERDICT | ON-CHAIN CHARACTERISTICS | RECOMMENDED ACTION |
|---|---|---|
| HIGH ACTIONABILITY | Peak volume ≥ 0.35 BTC ($25,000+) with confirmed exchange dispersal occurring after the country's statutory KYC enactment year. | Engage Professional / Law Enforcement. Exchange was legally mandated to retain customer IDs. Serve expedited discovery subpoena. |
| PRE-KYC ERA LEADS | Sufficient actionable value, but exchange deposits occurred prior to mandatory KYC laws in target jurisdiction (e.g., pre-2020 in Canada/UK). | Proceed with Caution. Platform identity verification was voluntary or unmandated at deposit time. Subpoenas may return unverified or anonymous user records. |
| MODERATE | Sufficient value identified; partial exchange off-ramps or unspent balances remain monitorable. | Continue tracking cluster; consider professional engagement if additional addresses surface. |
| MIXER BARRIER | Primary dispersal routed through privacy mixers (CoinJoin/Wasabi/Whirlpool) with zero exchange off-ramps. | Do not overpay for tracing. Advanced mixer unmixing is cost-prohibitive with low probability of recovery. |
| LOW VALUE | Total peak exposure < 0.10 BTC. Traceable, but economic recovery threshold is low. | Retain records internally; cost of external forensic or legal intervention exceeds loss amount. |
// 05 STATUTORY KYC MANDATE TIMELINES (BY JURISDICTION)
Blockworm does not assume that historical exchange traffic has subpoena-actionable customer identity records. Each country enacted mandatory Virtual Asset Service Provider (VASP) customer identification (KYC) laws in different years:
| JURISDICTION | KYC EFFECTIVE | REGULATOR | STATUTORY AUTHORITY | LEGAL IMPACT ON SUBPOENAS |
|---|---|---|---|---|
| 🇨🇦 Canada (CAN) | June 1, 2020 | FINTRAC | PCMLTFA SOR/2019-156 | Virtual currency dealers designated as MSBs with mandatory KYC and 5-yr record keeping. Pre-June 2020 deposits had no federal MSB KYC mandate. |
| 🇺🇸 United States (USA) | March 18, 2013 | FinCEN | FinCEN FIN-2013-G001 / BSA (31 CFR X) | Exchangers classified as MSBs under Bank Secrecy Act; mandatory Customer Due Diligence (CDD/KYC) and SAR filing. |
| 🇬🇧 United Kingdom (GBR) | January 10, 2020 | FCA | MLR 2019 (SI 2019/1511) / 5AMLD | Cryptoasset exchanges and custodians brought under FCA AML/KYC supervision. Pre-2020 transfers carried no statutory FCA KYC duty. |
| 🇦🇺 Australia (AUS) | April 3, 2018 | AUSTRAC | AML/CTF Amendment Act 2017 | Digital Currency Exchange (DCE) providers required to register with AUSTRAC, perform KYC verification, and keep 7-yr records. |
| 🇩🇪 Germany (DEU) | January 1, 2020 | BaFin | KWG § 1 Abs. 1a / GwG (5AMLD) | Crypto assets classified as financial instruments; mandatory BaFin custody licensing and Geldwäschegesetz (GwG) customer identification. |
| 🇫🇷 France (FRA) | December 9, 2020 | AMF / ACPR | Ordonnance n° 2020-1544 / Loi PACTE | Mandatory PSAN registration with AMF for crypto-fiat, crypto-crypto, and custody with strict ACPR KYC requirements. |
| 🇨🇭 Switzerland (CHE) | January 1, 2016 | FINMA | AMLA (GwG Art. 2 para. 3) / AMLO-FINMA | Commercial crypto exchangers designated as financial intermediaries subject to AMLA/KYC (threshold tightened to CHF 1,000 in 2020). |
| 🇯🇵 Japan (JPN) | April 1, 2017 | FSA (金融庁) | Payment Services Act (2016) / APTCP | World's first dedicated statutory regime post-Mt. Gox; mandatory FSA registration, strict KYC, and 7-year record keeping. |
| 🇳🇿 New Zealand (NZL) | July 1, 2018 | DIA | AML/CFT Act 2009 (Phase 2) | Phase 2 brought crypto brokers and exchanges under DIA as reporting entities required to conduct Customer Due Diligence (CDD/KYC). |
// 06 FORENSIC HANDOFF PACKET (ONE-CLICK EXPORT)
When your tally justifies taking action, Blockworm generates a standardized, cryptographic Forensic Handoff Packet. This downloadable JSON evidence brief includes:
- [x] Project UID & Investigation Metadata
- [x] Clustered Target Addresses & Historical UTXO Snapshots
- [x] Peak Exposure Watermark (Sats, BTC, Estimated USD)
- [x] Dispersal Breakdown (Exchange vs Mixer vs Unspent)
- [x] Actionability Verdict & Decision Matrix Summary
Hand this packet directly to legal counsel, law enforcement cyber units, or commercial tracing teams to skip discovery costs.