AMLBot Blog

A compliance system receives an Ethereum TXID. The top-level from address belongs to a Bundler — an infrastructure operator that submits transactions to the network. The top-level to address is EntryPoint — a shared contract that coordinates smart-wallet execution. Gas is paid through a Paymaster — a separate entity sponsoring the transaction fee. Inside the bundle are UserOp...

An exchange publishes its reserve wallet addresses. The balances match the reported snapshot. An auditor or verification provider confirms control of the selected wallets. Customers can verify their inclusion in the liabilities structure through a Merkle Proof. The company announces that its reserves are transparent and fully backed. But none of this shows whether the assets ...

A verified customer adds an external withdrawal address to their account. The platform asks the customer to sign a challenge message with the corresponding private key. The signature is valid. The address is whitelisted as "customer-owned." Months later, an investigation reveals that the wallet is a company treasury controlled by a multisig, the customer was an employee with ...

An investigator finds the transaction that moved stolen funds from a victim's wallet. They save a screenshot from a block explorer, copy the transaction hash into a report, build a fund-flow graph, and send the file to the client. Months later, the case reaches a lawyer or law enforcement. The analyst is asked: which data source was used? What labels were available at the...

A crypto business plans to add DEX routing to its product. The protocol is well known — it has a website, multiple security audits, substantial TVL, and a recognizable brand. The compliance team screens the protocol's main contract address and finds no sanctions match. The integration proceeds. Six months later, a customer deposit routed through the protocol triggers a compli...