The endpoint: exchange, seizure, or dead end

Graduate · enrolled learners

This lesson opens with NetWalker ransomware takedown, January 2021.

What happened

NetWalker was a ransomware operation that extorted victims worldwide. In January 2021 a coordinated law-enforcement action charged a Canadian affiliate, Sebastien Vachon-Desjardins, seized about 454,530 dollars in cryptocurrency from ransom proceeds, and took down the group's dark-web site. The on-chain tracing that supported it followed ransom payments through the transaction graph until they reached regulated exchanges, where deposit addresses are tied to identity through know-your-customer records. That is where the trace turned into action: an exchange endpoint let investigators attach names, freeze and seize funds, and build a case, while the same funds sitting in self-custody would have been fully visible on-chain and out of reach. The trail was on-chain the whole way; the arrest and the seizure happened at the point where the trail met a service that could connect an address to a person.

The decision point

A trace is not finished when you run out of hops; it is finished when it reaches an endpoint, and the endpoint, not the length of the trail, decides whether the trace can become anything. There are three. A regulated service, an exchange with identity records, is where an address can be tied to a person, frozen, subpoenaed, or seized, and it is where most enforcement actually happens. A direct seizure, obtaining the wallet's key as in the Colonial Pipeline case, is rarer and decisive. A dead end, funds resting in self-custody, in a non-cooperative jurisdiction, or truly pooled in a mixer, is a trace that is complete and unactionable: you can see exactly where the money is and do nothing about it. The analyst's final tracing skill is reading which endpoint they have reached, because a perfect trail to a dead end and a short trail to an exchange are worth very different things, and confusing visibility with reach is a common mistake.

Recorded loss

$454,530

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.