TRON first · zh-TW by default

Tell «looks connected» apart from «is connected»

TCP is an on-chain money-flow forensics platform. It is not designed to draw you a picture that connects. It is designed to be able to say «there is no link» — and show its work.

See a real case Sign in to the workbench

The demo runs entirely from a recorded case snapshot. No live API, no user data, no account required.

Two things nobody in this market sells

We reviewed the public material of 16 products. For the two capabilities below we could not find an equivalent in any reviewed vendor's public documentation. Read that literally: not found in public documentation is not the same as does not exist.

White space

N-way multi-address analysis

Every product we reviewed does two things: single-address hop expansion, and A→B pathfinding. Real cases are never one address — a theft produces a dozen thief wallets, a scam produces thirty victims, and a «suspect network» is usually six addresses somebody handed you in a spreadsheet.

TCP treats N-way analysis as a first-class product surface: 2 to 25 seed addresses, 15 designed analysis modes, all sharing one traversal engine and one crawl cache. Nobody writes a second crawler.

Where it stands: 8 of the 15 modes are in Phase 1 scope; the rest are designed but not yet frozen into the API contract.

Product, not hygiene

Exoneration, and reproducibility as a mechanism

Every competitor is optimised to produce a link. «Defensible reports» is marketing copy at most vendors. A fixed as_of snapshot, a verbatim cache of every provider response, a SHA-256 manifest over every artifact, and a validate step that re-asserts every claim — that is a contract, not an adjective.

«No link found» is a first-class result here, reported to the same standard as a positive one. It tells you where the traversal stopped, why it stopped, and which apparent links were downgraded by which false-positive detector.

All five false-positive detectors are named. A flagged finding is shown, downgraded and explained — never hidden. You have to be able to disagree with us.

248 → 6 → 1 → 0

This is our reference case. A naive implementation reports 248 links between the suspect network and the thief's network. After the false-positive detectors run, the number of substantive links is zero.

Raw reachability overlap248

After FP1 victim-bridge suppression6

After the FP3 value-assets-only closure1

Non-hub survivors0

Walk the whole case →

If a future change ever makes these numbers go up, we have started manufacturing suspects. That is the alarm this case exists to raise, and it is wired into our tests.

How a case runs

Three stages, no black box in the middle.

1 · Fetch and snapshot

Pull an address's complete transfer history from public TRON nodes, keep the provider response verbatim, keyed by sha256 of the canonical URL. The as_of instant is fixed when the case is created and clamped into every subsequent provider call.

2 · Traverse and intersect

One engine computes the value graph and the reachability graph together, with time-causality enforced in the engine rather than by the caller. Every multi-address mode is «traverse plus a set operation». Every node we did not expand records why.

3 · Read and deliver

Every finding carries an evidence tier, a strength and a basis, plus its false-positive flags. Output is a readable report, a freeze-request packet for law enforcement, and a SHA-256 manifest covering every artifact.

Seven rules compiled into the engine

These are not settings. They are invariants, and they decide what this product is willing to claim.

Two graphs, always. Conclusions come only from the value graph; the reachability graph is context and visuals. Following gas and native-token edges as if they were money flow manufactures accusations against real people.
Time-causality is enforced in the engine, not left to the caller. After an address receives at T, only what it sends at or after T propagates downstream.
Amounts are raw chain integers, serialized as strings. No floats, and no Number(), anywhere.
Every finding carries {tier, strength, basis} plus an array of false-positive flags. The basis field cannot be empty.
Boundaries are a deliverable. Every node we did not expand has to say why it was not expanded.
Hubs are recorded, never traversed through. A path through a shared service is downgraded, not treated as flow.
«No link found» is a first-class result, reported to the same standard as a positive one.

What we cannot do, and what we will never do

Stating the ceiling is more useful than listing more features. Every line below is a deliberate decision, not a backlog item.

Phase 1 covers exactly one chain — TRON — and two assets, USDT and TRX. Funds that bridge out of TRON leave our graph entirely. That is our single biggest coverage gap.
There is no risk score in Phase 1 at all. It is the most common «why can't it do the obvious thing» question, and we would rather have none than one that cannot show its reasoning.
There is no proprietary entity-attribution database, and there never will be. It is built from legal process and a decade of exchange relationships; it cannot be bought or derived. Our design has to work without one.
No mixer demixing, and no full DeFi contract decoding. Phase 2 goes as far as boundary reporting: telling you where funds left the part of the world we can read.
«Real time» means roughly 3-second block polling. It is not sub-second, and there is no mempool visibility.
No KYC/KYB, no Travel Rule, no SAR filing. What we produce is a law-enforcement freeze-request packet.
We will never ask for, accept, or handle a seed phrase or a private key. That is an irreversible security liability and we refuse it.

Look at the case before you decide about an account

The public demo needs no registration, and its conclusion is negative — which we think is the right way to judge a forensics tool.

Open the public demo Read the docs and FAQ