Docs & FAQ

Seven concepts worth knowing

If you read only one, read the first.

The value graph and the reachability graph

The value graph contains only genuine asset-transfer edges. The reachability graph contains every edge, including gas top-ups and dust. Both are always computed, but conclusions may come only from the value graph — a finding sourced from the reachability graph is a schema violation in our data model. The reachability graph exists for context and visuals.

Time-causality

After an address receives funds at time T, only what it sends at or after T is treated as propagating downstream. Without this rule, conclusions are worthless, because relationships that existed before the incident get counted as consequences of it. Five minutes of clock tolerance is allowed.

Evidence tier, strength and basis

Every finding carries three fields. The tier is authoritative (post-incident, time-causal, value graph — the only tier that supports a conclusion), reference (all-time reachability, explicitly labelled as possibly coincidental) or background (broad neighbourhood context). Strength is strong or weak, encoded with border style rather than colour. The basis field cannot be empty; it is what makes a finding auditable.

False-positive flags

Five named detectors: victim bridge, shared service, gas/dust link only, temporal impossibility, and reused wallet. Temporal impossibility is a hard flag; the rest are soft. A flagged finding is always shown, downgraded and explained. It is never filtered away.

The boundary ledger

Traversal does not expand forever. Every node it stopped at records why — depth limit, node limit, classified as a hub, value below the expansion threshold, outside the time window, or truncated data. An empty result with a full boundary ledger is a finding; an empty result without one is a bug report.

Snapshots and as_of

Every analysis fixes an as_of instant when it is created and clamps that into every provider call. That is what makes re-running the same case tomorrow produce the same answer. To see newer data you create a new snapshot, and the two can be diffed.

Raw integer amounts

On-chain amounts are arbitrary-precision integers. A JavaScript number cannot hold a uint256, and a Python float loses precision when summing them. So amounts stay integers throughout the system, are strings in JSON, and are converted to human units only at the display edge — by truncation, never rounding, and truncation is marked as such.

Frequently asked

Which chains does TCP support?

Phase 1 is TRON only, covering USDT (TRC-20) and TRX. That is deliberate: TRON is the dominant USDT rail and the dominant retail-theft surface, and it has artifacts that other products treat as «just another chain» — energy and bandwidth rental services, gas funding, and the USDT contract blacklist.

Why is there no risk score?

Because a score that cannot show its reasoning is worse than no score. Phase 1 has none. A decomposed version, where every contributing factor shows its basis, is planned for Phase 2. Until then we would rather answer checkable facts, like «this address is on the OFAC list» or «this address is frozen by the Tether contract».

Why do labels contradict each other?

Because the real world does. A user label, an explorer tag, a free public feed and our own heuristics can all disagree. We show all of them with their sources and trust tiers. Hiding the disagreement just takes the judgement away from you.

Does «no link found» really get a report?

Yes, and to the same standard as a positive finding. It includes the traversal scope and boundary ledger, every downgraded apparent link with its reason, the money-conservation accounting, and a «what chain data cannot tell you» section. We consider this the most important thing the product produces.

What do you do with my data?

Addresses and case data live in our own database; evidentiary provider responses live in our own object storage. We will never ask for a seed phrase or a private key — no feature needs one, and holding them is an irreversible liability.

Why does an analysis take minutes?

Because we pull complete transfer histories one address at a time from rate-limited public nodes, and keep them verbatim. That is the price of reproducibility. The progress you see comes from backend-reported phases, not from a timer — a fake progress bar on a six-minute crawl is worse than none.

Can I quote your conclusions in a report?

The report marks the evidence tier of every finding. Only authoritative findings support a conclusion; reference and background findings are explicitly labelled as context. Every report also ships with the boundary ledger and a SHA-256 manifest, so the other side can check what we looked at and what we did not.

Is there an API?

There is a REST control plane, but in Phase 1 access is tied to a user login. Service accounts and API keys for machine clients are planned for Phase 2.

Is TCP v2 available now?

TCP v2 is currently deployed on its review hostnames. This public entry site is part of it, and is deliberately unauthenticated. For per-feature status see the capabilities page.