Case Studies

The work
speaks for itself.

Representative engagements across blockchain forensics, whistleblower submissions, and AML investigation. Details anonymized to protect client confidentiality.

All cases are anonymized. Client identities, specific dates, and identifying case details are withheld in accordance with our confidentiality obligations.
Blockchain Forensics IRS Whistleblower HIGH RISK KNM-2025-001

Offshore Crypto Tax Evasion —
Multi-Jurisdictional Structure

A client with insider knowledge of a high-net-worth individual's offshore cryptocurrency holdings engaged Knemonik to assemble a whistleblower submission for the IRS. The subject had moved funds through a chain of Bitcoin and Ethereum wallets across five exchange platforms, using shell entities in two jurisdictions to obscure beneficial ownership.

Wallets Traced
47
Networks Analyzed
BTC · ETH
Total Funds Traced
$8.4M
Est. Tax Exposure
$3.1M+

What Knemonik Did

  • Traced 47 wallet addresses across BTC and ETH networks, mapping fund flows and identifying exchange interactions
  • Identified four wallet clusters controlled by the same entity using timing and amount correlation analysis
  • Cross-referenced exchange deposit addresses against known KYC-required platforms
  • Generated court-ready evidence package with full transaction timelines
  • Coordinated submission with a licensed IRS whistleblower attorney

Key Findings

  • Three offshore shell companies confirmed as pass-through entities via corporate registry research
  • No IRS reporting found for any of the 47 wallets despite cumulative holdings of $8.4M
  • Funds consistently moved within 24–72 hours of significant price events, indicating active management
  • Two wallet addresses matched OFAC monitoring lists (not SDN, but under enhanced scrutiny)
Submission Status
Submitted to IRS Whistleblower Office
Potential Reward Range
$465K – $930K
Case Status
Under IRS Review
Entity Mapping SEC Whistleblower HIGH RISK KNM-2025-002

DeFi Protocol Rug Pull —
Investor Fund Recovery Tracing

Investors in a DeFi protocol that abruptly ceased operations engaged Knemonik to trace the movement of approximately $11M in investor funds that disappeared following what investigators classified as a rug pull. The founders had marketed the project to US investors via social media and were therefore subject to SEC jurisdiction.

Investor Funds Traced
$11.2M
Chains Analyzed
ETH · TRON
Destinations Identified
12
SEC Jurisdiction
Confirmed

What Knemonik Did

  • Mapped complete flow of $11.2M from investor deposits through smart contract to developer wallets
  • Traced funds across ETH and TRON, identifying bridge transactions and cross-chain hops
  • Identified 12 destination wallets including three that interacted with US-regulated exchange accounts
  • Documented US investor solicitation evidence from public social media archives
  • Prepared SEC Form TCR submission package through coordinating securities law attorney

Key Findings

  • $4.3M traced to wallets with confirmed Coinbase interactions (US KYC exchange)
  • Developer wallets showed pre-planned exit structure — funds began moving 6 hours before protocol shutdown
  • TRON USDT transfers used to convert ETH positions before off-ramp
  • One developer wallet address matched an alias used in US-based forum posts
Submission Status
Filed with SEC Whistleblower Office
Potential Reward Range
$1.1M – $3.4M
Case Status
SEC Investigation Opened
AML Investigation Corporate Intelligence MEDIUM RISK KNM-2026-001

Shell Company Network —
Trade-Based Money Laundering

A compliance team at a mid-sized financial institution engaged Knemonik to investigate a counterparty that had flagged internally for unusual transaction patterns. The subject operated through a network of shell companies across three jurisdictions routing payments through trade finance instruments — a pattern consistent with trade-based money laundering (TBML).

Entities Mapped
23
Jurisdictions
3
Suspicious Volume
$18.7M
OFAC Match
Partial

What Knemonik Did

  • Mapped 23 corporate entities across three jurisdictions using public registry and OSINT sources
  • Identified beneficial ownership convergence — all 23 entities traced to two individuals
  • Screened all identified entities and individuals against OFAC SDN and Consolidated Sanctions lists
  • Documented TBML indicators: invoice discrepancies, round-trip transactions, fictitious trade routes
  • Delivered compliance-ready report and SAR filing recommendation to the client's compliance team

Key Findings

  • Partial OFAC match: one beneficial owner shared name and DOB with an SDN-listed individual (different passport)
  • $18.7M in transactions showed invoice values inconsistent with market prices for stated goods
  • Four entities shared registered addresses with known shell company formation agents
  • Client filed SAR within 7 days of receiving Knemonik report
Client Action
SAR Filed · Relationship Terminated
Regulatory Outcome
Under FinCEN Review
Turnaround Time
6 Business Days
OFAC Screening Sanctions Evasion DOJ Referral KNM-2026-002

Sanctioned Entity Crypto Transactions —
OFAC Evasion Pattern

An individual with knowledge of a cryptocurrency operation allegedly processing transactions for OFAC-designated entities engaged Knemonik to document the evasion methodology for potential submission to the DOJ and OFAC. The operation used TRON network USDT as a primary evasion vehicle, taking advantage of low fees and high speed.

OFAC Matches
3
Network
TRON (USDT)
Sanctioned Volume
$6.2M
US Nexus
Confirmed

What Knemonik Did

  • Traced TRON USDT flows from three OFAC-designated wallet addresses provided by client
  • Identified intermediary wallets used as pass-through layers to obscure sanctioned origin
  • Confirmed US nexus through interactions with US-accessible exchange platforms
  • Generated timeline of transactions correlated with known sanction designation dates
  • Coordinated submission with DOJ whistleblower program through licensed US criminal defense attorney

Key Findings

  • Three direct OFAC SDN matches confirmed on initial screening
  • $6.2M in USDT passed through US-accessible platforms post-designation dates
  • Consistent use of 2–3 hop pass-through structure between sanctioned source and exchange
  • One intermediary wallet active on ETH mainnet with ENS domain linking to public social identity
Submission Status
Referred to DOJ MLARS
Potential Recovery
$6.2M+ (plus penalties)
Case Status
Active Federal Matter

Your case could be next.

If you have knowledge of financial wrongdoing, our forensics team can build the evidence package that turns information into action.

Start a Confidential Inquiry