Risk intelligence for every wallet you touch.

Animated explainer: a phishing crew launders fifty thousand dollars in forty-seven minutes, and zScreen reads what they left behind. Transcript:

1. Fifty thousand dollars.
2. Nine wallets.
3. Forty-seven minutes.
4. Now watch it slowly.
5. This is the wallet that asks to deposit.
6. One transfer in. One transfer out.
7. Created this morning. Empty now.
8. Every list comes back the same.
9. It has never touched a named address.
10. Every screening tool in this category returns exactly this answer.
11. So let us go back six hours.
12. Six hours before anything happens,
13. Wallet B sends Wallet A gas money.
14. So the drain cannot stall halfway.
15. Then four fresh wallets are created. Never used.
16. This is not sloppy. Every piece of it is designed.
17. The victim signs one approval.
18. It does not move money.
19. It grants permission to move money.
20. Seconds later the permission is used.
21. Fifty thousand dollars, one transaction.
22. The victim approved it. That is what makes it hard.
23. The money does not go to one wallet.
24. It goes to two, in the same block.
25. Eighty to the one that ran the site. Twenty to the one that supplied the kit.
26. The same split, every time this kit is used.
27. Two parties. One theft. A fixed contract.
28. Nine minutes later, Wallet A pays Wallet B back.
29. A hundred and twenty went one way. Ten thousand comes back the other.
30. People do not do this. Businesses do this.
31. That is a settlement between partners.
32. Now Wallet A moves.
33. Everything goes to a fresh wallet.
34. That wallet keeps a tenth. Sends the rest on.
35. The next one keeps a tenth. Sends the rest on.
36. The next one does the same.
37. Same fraction. Same eleven-minute hold. Every time.
38. Fast enough to beat any manual review.
39. Small enough that nothing left behind is worth anyone chasing.
40. This is a peel chain. The shape is the whole trick.
41. Twenty-six thousand walks through the front door.
42. Forty-seven minutes, start to finish.
43. And the wallet at the door
44. is the one you already cleared.
45. Look at what they actually did.
46. Pre-funded the gas, six hours early.
47. Split it in the same block.
48. Four wallets, each used exactly once.
49. The same fraction at every hop.
50. Eleven-minute holds. Never longer.
51. Remainders too small for anyone to chase.
52. These people are very good at this.
53. Six weeks later, one wallet lands on a list.
54. Every other wallet in this chain, never.
55. One hop, three hops, six hops — it does not matter how far back you walk.
56. On the day it matters, there is nothing to find.
57. A list cannot catch this.
58. Something else has to.
59. So how do you catch someone who did everything right?
60. You stop looking for who they know.
61. You read what they left behind.
62. We take the wallet apart.
63. Every transfer. Every counterparty. Every gap between them.
64. Nothing it did goes unmeasured.
65. Money. Time. Counterparties.
66. Shape. Distance. Contracts.
67. Not one after another. All of it at once.
68. On every wallet, in a fraction of a second.
69. Some shapes already have names.
70. Investigators have been drawing them by hand for years.
71. We look for all of them, on every wallet.
72. This one matches three.
73. A peel chain. A transit address. Rapid transit.
74. Three hits on a wallet nobody has ever named.
75. Named shapes only catch what someone already drew.
76. So we learn what ordinary looks like
77. from millions of wallets nobody ever labelled,
78. and measure how far this one sits from all of it.
79. This is the part that works on a pattern invented last week.
80. And then we argue with ourselves.
81. Not one model. Many.
82. Each one shown a different slice of everything nobody has labelled.
83. Each one votes on its own.
84. One of them disliking a wallet is noise.
85. Nearly all of them agreeing is a finding.
86. Run it again tomorrow. Run it again next year.
87. Same wallet. Same answer. Same reasons.
88. A screening answer you cannot reproduce is not an answer.
89. The verdict comes back.
90. Review. High confidence.
91. And it says why, in words a compliance officer can file.
92. In once, out once, kept nothing.
93. Held eleven minutes.
94. Forwarded the same fraction as the three behind it.
95. And the last line is the one that matters.
96. No contact with any listed address.
97. Still true. It was never the point.
98. Three answers. Clear, review, flagged.
99. They were careful.
100. Careful is a pattern.
101. The behaviour is the evidence.