// SIGNAL INTELLIGENCE //OBSERVATORY · COMPOSITE FEED
9 CHAINS · 24/7 · LIVE
Operational TelemetryVol. III · MMXXVI
Observatory Online--:--:--Z
Signal Intelligence·9 Chains·Live

WRAITH

Global financial crime observatory.
Nine chains. Real-time classification.

WRAITH watches every block on every chain we cover. Signals are classified at the moment of emission — exploits, sanctions, mixers, bridges, exchange exits — and surfaced to operators with attribution intact and provenance preserved.

Enter Operations CenterRead the Doctrine
SIGINTComposite FeedNYC · ZRH · SGP
In Operation With
Financial Intelligence UnitsSanctions EnforcementCEX ComplianceInvestigative JournalismOn-Chain Forensics
§ I · The Watch

An observatory does not blink.

Block by block, chain by chain, signal by signal — for as long as the network exists. WRAITH is not a tool you query. It is a presence that watches and tells you what it sees.

Most platforms in this space ingest on a schedule, classify on a schedule, surface on a schedule. The lag between a transaction confirming and an analyst learning of it is measured in minutes — sometimes hours. By then the funds have moved, the wallet has hopped, the trail has cooled.

WRAITH operates on a different principle. Every block on every covered chain enters classification at the moment of confirmation. Signals surface in the same minute they emit. The observatory never closes. The composite feed never breaks. When you log into the Operations Center at 03:14 local on a Sunday, the system has been watching for you continuously since you last left it.

WRAITH classifies. WRAITH surfaces. WRAITH does not confirm attribution — that work belongs to the operator. We supply the signal, you supply the judgment.

The product is the continuity. Anyone can build a query interface to a chain. Building an observatory that holds for years, across nine networks, with classification taxonomy intact and provenance preserved — that is the product.

§ II · The Taxonomy

Nine signal classes. Each with its own evidence standard.

WRAITH does not emit “alerts.” WRAITH emits classified signals — each tagged to a class with a defined detection rule, evidence threshold, and severity tier.

§ 2.1 · Critical
Active Exploit
Protocol hack in progress. Reentrancy, oracle manipulation, governance capture, flash-loan composition. Detected pre-confirmation where possible.
Severity · Critical
§ 2.2 · Critical
OFAC Sanctioned
Wallet address present in US Treasury SDN list. Inflow, outflow, or counterparty interaction surfaces with full provenance to source.
Severity · Critical
§ 2.3 · High
Privacy Mixer
Tornado, Railgun, Wasabi, Aztec. Deposit patterns, anonymity set fills, withdrawal timing. Tracked across the obfuscation layer.
Severity · High
§ 2.4 · High
Scam Wallet
Pig butchering, romance scams, honeypots, approval drainers. Behavioural signature plus victim-graph propagation.
Severity · High
§ 2.5 · Elevated
Cross-Chain Bridge
Stargate, Hop, Synapse, Celer, deBridge, Wormhole. Egress and ingress with full destination resolution.
Severity · Elevated
§ 2.6 · Elevated
Governance Alert
Tainted voter wallets, flash-loan governance, proposal capture sequencing. DAO-layer surveillance.
Severity · Elevated
§ 2.7 · Notable
Whale Transfer
Single moves above one million USD equivalent. Cold-wallet activations, vesting unlocks, treasury rotations.
Severity · Notable
§ 2.8 · Notable
Exchange Deposit
Inflows to Binance, Coinbase, OKX, Kraken, and twenty-three other tracked exits. Off-system surfacing.
Severity · Notable
§ 2.9 · Baseline
Large Transfer
Above fifty thousand USD, unclassified. Surfaced for context, not for action. The noise floor against which the signal is read.
Severity · Baseline
§ III · The Telemetry

What an analyst actually sees.

Drawn from the live composite feed. Every field below is real-time, exportable, and traceable to source. The Operations Center renders this at higher density.

A WRAITH signal is not a notification — it is a structured object with classification, provenance, severity, and counterparty graph. Below is the canonical shape an analyst inspects.

SIGNAL · σ-7F3A9C2ELIVE · CLASSIFIED
ClassCRITICAL · OFAC sanctioned · § 2.2
Wallet0x7f3a···d4e2 · first seen 2024-11-08T14:22:01Z
ChainETH · block 19,847,221 · tx 0x9c2e···4f3a
Inflow84,200 USDC · from Tornado Cash 100-ETH pool
Funding chainTornado < Bridge (Stargate) < CEX deposit · KYC unknown
ProvenanceUS Treasury SDN list · 2024-11 update · entry #4729
SeverityCRITICAL · immediate operator review
Counterpartiesgraph: 14 wallets · 3 contracts · cluster ID WR-CL-2207
ExportJSON · CSV · evidence package · STIX 2.1 compatible
§ IV · Operators

Built for the rooms that read signals for a living.

Where attribution is not entertainment. Where a signal must survive a regulator, a court, a cross-jurisdictional review. Where missed signals are measured in dollars stolen and victims unprotected.

§ 4.1 · Public Sector
Financial Intelligence Units · FIUs
National AML/CTF agencies. Sanctions enforcement bodies. SAR-ready signal exports with provenance to source. Operates under existing data-handling regimes.
§ 4.2 · Exchange & Custodial
CEX Compliance Desks
Pre-deposit screening. Withdrawal-side risk scoring. Counterparty graph at the moment of inflow. Built to integrate with existing transaction monitoring stacks.
§ 4.3 · Investigative
Forensic & Investigative Press
For the rooms that need provenance to publish. Evidence packages signed at emission. Methodology auditable. Source preserved across the editorial review cycle.
§ 4.4 · Strategic
On-Chain Analytics & Treasury
Counterparty diligence at scale. Treasury risk surfacing for protocols and DAOs. Composite feed integration for downstream products.
Operations Center · By Account

The observatory is online.
Step into the room.

The Operations Center renders the composite feed at full density. Filter by class, chain, wallet, cluster. Export evidence packages. Watch the room work.

Enter Operations Center
// SIGNAL INTELLIGENCE //OBSERVATORY ONLINE
SESSION TLS 1.3