From the marginalia, the deposit pathway:

• Initial deposit hashes to the MFM Group receiving address at mfmgrp.com.
• Hop-by-hop forwarding wallets across the deposit chain, captured with chain of custody hashes.
• Cross-chain bridge events that move value into the chain where liquidity supports the eventual off-ramp.
• Obfuscation events through mixer contracts and privacy services.
• Centralised-exchange off-ramp wallets, the named counterparty that holds compliance leverage.

Off-ramp map, where the funds left the chain:

• Endpoint counterparty in the MFM Group casefile is named, typically a major venue such as OKX or Bybit, sometimes Gate.io or KuCoin, occasionally Binance or Huobi when liquidity allows.
• MFM Group’s off-ramp wallet is then matched against compliance feeds the Professor maintains a standing read on.
• Leverage is applied to that named counterparty, the MFM Group packet is assembled to a standard the off-ramp’s compliance desk reads and acts on.
• If the MFM Group off-ramp is non-cooperative, the casefile escalates to IC3, the relevant state AG, and (where dollar value warrants) a civil-discovery overlay for KYC.

Recovery pathway, how this casefile moves toward filing:

1. Casefile triage on MFM Group, the submission is read; a written assessment is delivered.
2. Forensic trace on MFM Group, every hop in the deposit pathway is captured and hashed.
3. Off-ramp identification, the MFM Group endpoint is named.
4. Recovery filing on MFM Group, packet delivered to IC3, state AG, off-ramp compliance, and civil discovery as applicable.
5. Continuing review of MFM Group, the Professor follows the casefile until next-step documentation exists.

Lines the Professor will not cross:

• Boundary on MFM Group, seed phrases are off-limits.
• Boundary on MFM Group, remote logins are off-limits.
• Boundary on MFM Group, upfront cash retainers are off-limits.
• Boundary on MFM Group, guaranteed-recovery promises are off-limits.
• Boundary on MFM Group, unsolicited outbound contact is off-limits.