IMOZURU: one input runs the whole investigation loop — and writes the report

ChainAnalyzer now ships IMOZURU. Give it one address (or transaction) and it follows the money on its own, all the way to an investigation report PDF and an investigation case. Available on the Business plan and above.

What changed — giving analysts their time back

Until now, an investigation meant a human running the same loop on top of a tool: scan an address, look at the graph, choose the next address to follow, back out of the dead ends, and finally write the trail up as a report. A single case can mean running that loop hundreds of times.

IMOZURU runs that loop for you. The point is not that there are more detection rules. What is new is the automation of the work that was still left to a person — deciding where to pivot next, deciding when a branch is not worth following, and turning the path taken into prose.

• Resolve the input → scan → ingest into the graph → search for endpoints
• Pick the addresses to follow next, and decide whether to stop
• Generate the investigation report PDF and create the case automatically

Related addresses on other chains are correlated and explored even when no bridge left a trace to follow.

A measured run

Recorded from a single seed address of the address-poisoning network of roughly 800 million JPY that we found and published ourselves.

• 71 addresses discovered autonomously in about 12 minutes
• Of those, 57 terminals (endpoints not followed further) and 5 infrastructure nodes
• 4 confirmed common-operator attributions

A branch stops automatically once it reaches an exchange, a DEX router, or a bridge. Expanding a hub of that size would flood the investigation with unrelated traffic. A terminal does not mean the funds disappeared there — read it as a marker for who to ask next, or where to resume the trace.

Note: counts and elapsed time depend on the shape of the network, upstream data availability, and the budget you allow. The same input will not always yield the same counts, and the figures above are not a guarantee of reproduction.

Reading the output

IMOZURU never blends what the machine observed with what the model wrote.

• Per-section labels — the report has 8 sections, and every heading carries either an AI-generated or a machine-extracted label. When the material is used in legal or regulatory filings, verify against the machine-extracted sections as the source.
• Confirmed vs estimated — common-operator attribution is reported in two bands: confirmed (directly observed) and estimated (a synthesis of circumstantial evidence, not an assertion). The confidence score is not a probability: a score of 80 does not mean an 80% chance of a common operator, it is an internal measure of how many signals lined up and how strongly.
• Fund sizes are lower bounds — all three measures in the report are computed only from transactions that were actually observed; paths that were never observed are excluded. We deliberately avoid the phrase "total damages" because it has no single definition.
• A case is created for you — on completion, the addresses that were found are collected into an investigation case. Each address keeps its genealogy — which address it came from, at which hop, why it was picked up, and the transaction hash behind it — so the discovery path stays auditable. On Enterprise, the case feeds the suspicious transaction report (STR) support package.

Plan and limits

• Available on the Business plan and above
• Each scan the investigation performs consumes one unit of your monthly scan quota (scans that error or time out are not charged)
• Exploration is always bounded by three guards at once: time budget, hop count, and scan count

Read more

• IMOZURU documentation — how to use it, how to read the output, deep mode, the 10 supported chains, FAQ
• The address poisoning network, two months later — the published investigation the run started from

Note: we have filed four patent applications covering insider-trading detection via pre-disclosure window analysis, the ML decision gate, and cross-chain fund tracing / common-operator inference. All four were filed in July–August 2026 and are pending examination.

Note: IMOZURU output is reference information for an investigation. Legal determination and reporting obligations remain with the user.