Wallet trace — what the Professor maps:

• Deposit transaction hashes from the claimant wallet to the SafeCaps platform receiving address.
• Forwarding wallets the platform consolidated through — typically two to four hops on the deposit chain (BTC / ETH / USDT-TRC20 / BSC / Polygon / Arbitrum / Optimism / Avalanche).
• Bridge crossings between chains, where the operator moves value into a chain with deeper liquidity ahead of the off-ramp.
• Mixer interactions — Tornado-Cash variants, Sinbad, and the smaller obfuscation services that operators rotate through under regulatory pressure.
• Final off-ramp wallet — the centralised exchange deposit address that received the consolidated funds.

From the lectern — off-ramp identification:

• SafeCaps’s off-ramp endpoint, in this casefile, is the centralised exchange that holds compliance leverage — typically named in the packet alongside the deposit address.
• Chain-analytics datasets cross-reference the SafeCaps off-ramp wallet against historical laundering throughput.
• The SafeCaps packet is delivered to the off-ramp compliance desk in a format the desk’s reviewers act on.
• Escalation pathways for SafeCaps, where needed: IC3, the relevant state AG, and a civil-discovery overlay for KYC on the off-ramp wallet.

Pathway to recovery — what happens after the trail is mapped:

1. Casefile triage on SafeCaps — the submission is read; a written assessment is delivered.
2. Forensic trace on SafeCaps — every hop in the deposit pathway is captured and hashed.
3. Off-ramp identification — the SafeCaps endpoint is named.
4. Recovery filing on SafeCaps — packet delivered to IC3, state AG, off-ramp compliance, and civil discovery as applicable.
5. Continuing review of SafeCaps — the Professor follows the casefile until next-step documentation exists.

Chains and off-ramps the Professor follows:

• Chains tracked on SafeCaps — Bitcoin and Ethereum at the deposit side; Tron USDT-TRC20 and BSC at the consolidation side; bridges crossed where the operator chases liquidity.
• Off-ramps tracked on SafeCaps — named exchange counterparties with public compliance contacts.
• Filings supported on SafeCaps — IC3, state AG, off-ramp compliance, civil discovery — selected by the dollar value and the off-ramp’s responsiveness.

Lines we never cross — by published policy:

• Boundary on SafeCaps — seed phrases are off-limits.
• Boundary on SafeCaps — remote logins are off-limits.
• Boundary on SafeCaps — upfront cash retainers are off-limits.
• Boundary on SafeCaps — guaranteed-recovery promises are off-limits.
• Boundary on SafeCaps — unsolicited outbound contact is off-limits.