Where suspicious wallets get what they deserve—analysis AND attitude.

The AML Engine scans Ethereum for suspicious patterns. Then it roasts what it finds. Real data. Real detections. Real attitude.

By The Numbers

Lazarus Group — North Korea State-Sponsored

Risk Level: 🔴 CRITICAL Amount: $725M+ stolen

The Roast: “Nice try rotating through 15 mixer contracts in 4 hours. The blockchain remembers even if your government pretends it doesn’t.”

Analysis: State-sponsored thefts from Ronin Bridge ($625M) and Horizon Bridge ($100M). Signature pattern: rapid chained mixers, high-frequency consolidation, geolocation outside US jurisdiction. Multiple rule hits across liquidity patterns and AML indicators.

Tornado Cash Power Users

Risk Level: 🔴 CRITICAL Amount: 50+ usage instances

The Roast: “Using Tornado Cash once is privacy. Using it 50 times in a week is a confession.”

Analysis: Pattern: systematic obfuscation through repeated mixing contracts. Each address shows high-frequency deposits to Tornado, followed by delayed consolidation. The timing signature alone triggers multiple detection rules—structuring detection flags the transaction sizes and intervals.

Ronin Exploit — The Repeat Offender

Risk Level: 🔴 CRITICAL Amount: $625M exploit funds

The Roast: “193 flags across our system. At this point, the engine flags you out of muscle memory.”

Analysis: Address flagged 193 times across independent runs. Root cause: direct receipt of exploit proceeds, followed by systematic movement through second-layer protocols. Each consolidation attempt triggers multiple rule sets: high-velocity transfers, suspicious contract interaction patterns, and geolocation anomalies.

Wormhole Bridge Exploit

Risk Level: 🔴 CRITICAL Amount: $320M extracted

The Roast: “You found a smart contract vulnerability. Congratulations. Now you’re famous—in every compliance database on Earth.”

Analysis: Smart contract exploitation pattern. Characteristic signature: abnormal contract function calls, followed by immediate high-volume transfers to exchanges. The exploit’s directional flow (source → intermediate mixing → exchange) matches known bridge vulnerability patterns. Multiple rule triggers on contract interaction anomalies.

The $82B Problem

Risk Level: 🔴 CRITICAL Amount: Global crypto AML gap

The Roast: “$82 billion a year in crypto gets flagged for AML. This is the scale problem nobody talks about publicly.”

Analysis: Systemic pattern across thousands of wallets. Most crypto laundering follows a three-step signature: deposit from crime source → rapid layering through mixers and bridges → final consolidation at exchange for fiat. The AML engine detects each step independently, creating a statistical profile of likelihood rather than certainty.

Systematic Layering Pattern

Risk Level: 🟠 HIGH Amount: $47M cumulative

The Roast: “You thought spreading it across 47 wallets with 6-hour delays would fool a system that analyzes billions of wallets? Creative. Not effective.”

Analysis: Structuring detected through cross-wallet correlation. Pattern: identical transfer amounts ($50k), identical timing intervals (6 hours), and convergent consolidation points. The engine correlates these transactions across the entire address cluster, revealing the underlying scheme despite intentional obfuscation attempts.

How The Engine Works

1. Scan

Real-time Ethereum wallet monitoring. Every transaction analyzed against 28 rules covering mixing behavior, consolidation patterns, bridge exploits, and AML red flags.

2. Analyze

Professional compliance-grade risk scoring. Risk level, rule matches, and transaction velocity analysis produce a comprehensive AML report.

3. Roast

The personality layer. Real analysis + attitude. Every detection gets a comment that acknowledges what actually happened—because compliance doesn’t have to be boring.

Try The Engine

Want to see what the AML Roaster finds? The live demo is running now on Ethereum wallets. Upload a transaction CSV or load the sample Wormhole/Ronin/Lazarus dataset. Watch 28 rules fire in real time. See every flagged wallet, every rule that triggered, every score.

No install. No setup.

The full codebase is open. Every rule, every version, every case study documented. If you’re building in this space, it’s yours to learn from.