Chainalysis traced this monero transaction: e4f525b214ef7310b53dd2e81be42801c7ee1a7c259ac0a093d813b493a788a8
The sender was: 98c88d7d6cee177fdd675763a51c451f36a3de026607fa5d7d1ed1eded0f5a1d
The recipient was: 2e9598dc6d1af0907297b395e71ff4cc7f38818893ccc90f7ff40fbec6820699
They also identify the change-recipient: 838bdcee6c15000a259f9f58172794a1a1bd132750f29aee1ed33bd7de94c85b
Then they follow the change to this tx: a5202cb022921d624d0e9a40a9d7e0cdc4d9cfeb0be11501414fe5a9c0cdd2a8
They got the sender's ip address from the fact that (1) when spending the change output created by the above tx (a520…d2a8), the target forgot to use a VPN (2) his wallet broadcasted the resulting transaction via a chainalysis spy node.
Having obtained the target’s ip address, Chainalysis sent it to police in Columbia, who arrested the target, allegedly a drug dealer. You can view the trace from 34:55---36:51 of this video:
Super Testnet
npub1yx…c399s
2025-08-21 20:12:33 UTC
in reply to nevent1q…z4hd
Author Public Key
npub1yxp7j36cfqws7yj0hkfu2mx25308u4zua6ud22zglxp98ayhh96s8c399sSeen on
wss://relay.damus.ioPublished at
2025-08-21 20:12:33 UTCEvent JSON
{
"id": "8f1a7cc0770b2981f3ffbdf3b9965d59b609c2f0bb410aa9eafa1e50a24a1b9c",
"pubkey": "2183e94758481d0f124fbd93c56ccaa45e7e545ceeb8d52848f98253f497b975",
"created_at": 1755807153,
"kind": 1,
"tags": [
[
"e",
"716d350d060c02e864233aa028f7ef1c0ff71966f62843fff8b315b76c478714",
"",
"root"
],
[
"e",
"4389c04d99e431e7c5ac596679a8f919472f3b877854b8b3947958a07a16772e"
],
[
"e",
"d38f7a9c36e2759a8170b9ac1978deb2488c6c669d3a9090b7ecbd4aadf56b78",
"",
"reply"
],
[
"p",
"2183e94758481d0f124fbd93c56ccaa45e7e545ceeb8d52848f98253f497b975"
],
[
"p",
"df06d21eca7c19c89d054964b2d9e305a425ebde34403cb0e7966a872b23058f"
],
[
"p",
"62a6a41e2f0f8224586215bce21b8d4b1c7f418622e2d476e3978ddab12acb43"
],
[
"p",
"6e0a1f4852bc8fa42b8047d60a81930d88904ca3f2acdfb5b8413ab8c9f444e5"
],
[
"p",
"813cf5bbaf675abb1ef2869cb55f69809bc93eab778f8c42365ec65e14bb4ec1"
],
[
"p",
"813cf5bbaf675abb1ef2869cb55f69809bc93eab778f8c42365ec65e14bb4ec1"
],
[
"r",
"https://v.nostr.build/D4Nzp22vRF35IRnz.mp4"
]
],
"content": "Chainalysis traced this monero transaction: e4f525b214ef7310b53dd2e81be42801c7ee1a7c259ac0a093d813b493a788a8\n\nThe sender was: 98c88d7d6cee177fdd675763a51c451f36a3de026607fa5d7d1ed1eded0f5a1d\n\nThe recipient was: 2e9598dc6d1af0907297b395e71ff4cc7f38818893ccc90f7ff40fbec6820699\n\nThey also identify the change-recipient: 838bdcee6c15000a259f9f58172794a1a1bd132750f29aee1ed33bd7de94c85b\n\nThen they follow the change to this tx: a5202cb022921d624d0e9a40a9d7e0cdc4d9cfeb0be11501414fe5a9c0cdd2a8\n\nThey got the sender's ip address from the fact that (1) when spending the change output created by the above tx (a520…d2a8), the target forgot to use a VPN (2) his wallet broadcasted the resulting transaction via a chainalysis spy node.\n\nHaving obtained the target’s ip address, Chainalysis sent it to police in Columbia, who arrested the target, allegedly a drug dealer. You can view the trace from 34:55---36:51 of this video: https://v.nostr.build/D4Nzp22vRF35IRnz.mp4",
"sig": "fb4a98f156af6464ec66991903bffbcf3c9d6f8eee2efcf4055f69701480ca39cecf1e63d8db651055b71406ce1f02f64cf8a8b4d74733c975fe5a48fe7bffa2"
}