Tracing 40 ETH Through a Bridge, a Peel Chain, and an Exchange Deposit

Prioritize the path that reaches an identifiable custodian. The 12 ETH swapped to USDC and sent to a centralized exchange deposit address is the fastest freezing opportunity: record the swap transaction, the USDC contract, the deposit address, the amount, and the exchange's deposit-credit timing; send a preservation request immediately. The 9 ETH bridge transfer is next: capture the source-chain burn or lock transaction, the destination-chain release or mint transaction, the bridge contract, and the recipient address, because the 20-minute bridge window may still allow a freeze on the destination chain. The 18 ETH peel chain should be traced fully, but it is lower priority for a 72-hour freeze because each hop adds delay and the amounts are fragmented; still, record every txid and distinguish change from transfers using value, fee, and address behavior. The 0.7 ETH mixer path is unlikely to be frozen but should be documented for the criminal referral and for any sanctions or mixer policy issue. Do not ignore the 0.2 ETH to address C: small amounts can fund gas or test addresses.

Address D is a common funder, not proof of common control. A single address can fund gas for many unrelated users if it is an exchange withdrawal hot wallet, a faucet, a payroll service, a bridge relayer, or a scam operator paying many mules. The fact that D funded 60 addresses in one week is a lead, not a conclusion. The investigator should test timing and amount patterns: identical gas top-ups, sequential funding, funding immediately before each theft-related spend, and reuse of the same change address would raise confidence. Conversely, variable amounts, round-number withdrawals, and funding that predates the theft would lower it. The correct label in the report is common funding source or possible common controller, with the basis stated. Overstating attribution can taint a freezing request and undermine the case if the exchange identifies a different customer.

The package should include a transaction graph with txids, block heights, timestamps, asset types, amounts, and fees; the exchange deposit address and its attribution basis; the bridge deposit and destination transactions; the mixer interaction; and the common-funder analysis clearly labeled by confidence. Include the exchange's preservation letter, legal process, and the receiving VASP's contact. Evidence should be hashed and accompanied by a custody log. The affidavit should state the theft, the amount traced, the path, and why there is a risk of dissipation, without overclaiming ownership of every address. Include the 72-hour timeline and the specific freeze requested. If the exchange path is the only strong lead, say so; a focused, defensible request is more likely to succeed than a broad claim that all 40 ETH are in one cluster. Also preserve node and API logs that show when the investigator observed each transaction.