From a single input, follow the money automatically and produce the report
IMOZURU is an investigation agent. Give it one address (or transaction) and it runs the whole sequence itself: scan, ingest into the graph, search for endpoints, choose which node to follow next, decide whether to stop, and finally produce an investigation report PDF and an investigation case — with no operator in the loop.
The point is not that there are more detection rules. It is that the work an analyst repeats by hand on top of a tool — read the result, decide where to pivot next, abandon dead ends, and write up the trail — is performed by the product.
Recorded in August 2026, starting from the address-poisoning network of roughly 800 million JPY that we found and published ourselves.
Counts and elapsed time depend on the shape of the network, upstream data availability, and the budget you allow. The same input will not always yield the same counts.
Bitcoin, Ethereum, Polygon, BNB Smart Chain, Base, Arbitrum, Optimism, Avalanche, Kaia, and Solana — 10 chains. Auto infers the chain from the input format.
By default the run is budgeted to finish quickly. Deep mode raises all three ceilings — time budget, hop count, and scan count (10-minute budget, up to 5 hops, up to 100 scans) — so the trace reaches further and wider. A deep run can take around 10 minutes.
Steps appear in order while the investigation runs. Consecutive scan and ingest steps are grouped as a hop expansion, while decision steps (frontier selection, stop decision, report narrative) are always shown on their own line, with an AI badge where the decision was made by a model. If an individual operation times out it is badged as such, skipped, and the investigation continues.
The history at the bottom of the page reopens any past investigation with the same view. You can re-download the report PDF, jump to the case, or delete the investigation (deleting an investigation keeps the case that was created from it).
IMOZURU never blends what the machine observed with what the model wrote. Check that distinction before you read anything else.
The report has 8 sections, and every section heading carries either an AI-generated or a machine-extracted label (one more section appears when a common operator is identified).
Interpretive, for reference. It is written for readability — do not quote it as established fact.
Observed on chain (transaction hashes, addresses, hop distance). When the material is used in legal or regulatory filings, verify against these sections as the source.
| Section | Contents | Source |
|---|---|---|
| Investigation summary | Overall summary of the run | AI-generated |
| Timeline | Chronology of the hop-by-hop expansion | AI-generated |
| Fund flow narrative | How the funds moved | AI-generated |
| Trail genealogy (exploration path) | Fund flow diagram and parent-child discovery tree, including the network value table | Machine-extracted |
| Common operator attribution | Omitted entirely when nothing qualifies | Machine-extracted |
| Risk indicators | Indicators extracted from the run | AI-generated |
| Evidence transactions | The transactions each node was discovered through | Machine-extracted |
| Endpoints (terminal nodes) | Where the trace was stopped | Machine-extracted |
| Generation metadata | Who generated the narrative, model, prompt version, content hash | Machine-extracted |
When several addresses appear to belong to the same operator, the report adds a common operator section. Findings fall into two bands.
The report includes three fund-size measures. All three are lower bounds computed only from transactions that were actually observed. Paths that were never observed, and edges with no reliable amount, are excluded.
| Measure | Definition | Caveat |
|---|---|---|
| Seed throughput | Amount sent plus amount received by the seed address | Funds that came in and went out are counted twice |
| Observed edge flow | Sum of the flow across each edge (parent to child) in the genealogy | Double-counts funds that cross multiple hops; it is not net throughput |
| Terminal inflow | Amount that reached terminals such as exchanges and DEX routers | Read it as a lower bound on what was cashed out or parked |
We deliberately avoid the phrase "total damages" because it has no single definition. USD figures are approximate conversions at the time of the investigation, and assets that could not be converted are kept under their own names.
A branch stops when it reaches an exchange, a DEX router, or a bridge. Expanding a hub of that size would flood the investigation with unrelated traffic.
A terminal does not mean the funds disappeared there. Read it as a marker for who to ask next, or where to resume the trace.
On completion an investigation case is created automatically from the addresses that were found. Each address keeps its genealogy — which address it came from, at which hop, why it was picked up, and the transaction hash behind it — so the discovery path stays auditable afterwards.
IMOZURU is available on the Business plan and above.
| Plan | IMOZURU |
|---|---|
| Free / Starter / Pro | — |
| Business ($99.99/mo) | ✓ |
| Enterprise | ✓ |
The investigation loop an analyst runs by hand: choosing the next address to follow from a scan result, abandoning dead ends, and writing the trail up as a report. It runs that loop autonomously from a single input, rather than executing one detection rule.
IMOZURU is available on the Business plan and above. Each scan the investigation performs consumes one unit of your monthly scan quota, and scans that error or time out are not charged. An investigation cannot start when no quota remains.
An estimated finding is a synthesis of circumstantial evidence, not an assertion — treat it as a starting point for verification. Findings based on direct observation are labelled confirmed, and the confidence score is an internal measure of signal strength, not a probability.
Expanding hubs of that size would flood the investigation with unrelated traffic. Note that a DEX router is not a party you can serve a KYC inquiry on — the trace has to continue from the output that leaves the router.
No. All three measures are lower bounds computed only from observed transactions, and observed edge flow in particular double-counts funds crossing multiple hops. USD figures are approximate conversions at the time of the investigation.
Yes. Exploration is bounded by a time budget, a hop limit, and a scan limit at the same time, and individual operations carry timeouts. If every AI decision fails, the run falls back to rule-based decisions, finishes, and produces a report.
We have filed four patent applications covering insider-trading detection via pre-disclosure window analysis, the ML decision gate, and cross-chain fund tracing / common-operator inference. All four were filed in July–August 2026 and are pending examination.
© 2026 ChainAnalyzer. All rights reserved.