Lynx User Manual

Blockchain tracing software by Chainbrium. A practical guide for investigators, compliance officers, and legal professionals. No cryptocurrency experience required.

1. Getting Started

What is Chainbrium?

Chainbrium is a blockchain forensics platform that helps you trace the movement of cryptocurrency between wallet addresses. Think of it as a visual map that shows where digital money has been sent and received.

When investigating fraud, money laundering, or other financial crimes involving cryptocurrency, Chainbrium lets you paste a suspect's wallet address and instantly see who they have transacted with. The tool identifies known entities like exchanges, DeFi protocols, mixers, and sanctioned addresses, and assigns risk levels to help you prioritize leads.

Supported Blockchains

Chainbrium currently supports tracing on the following blockchains:

• Bitcoin (BTC) — The original and most widely used cryptocurrency.
• Ethereum (ETH) — The second-largest blockchain, also used for tokens like USDT and USDC.
• Tron (TRX) — A blockchain commonly used for USDT transfers, especially in Asia.
• Solana (SOL) — A high-speed blockchain gaining popularity for various digital assets.
• EVM-compatible chains — Other blockchains that work like Ethereum (e.g., BNB Smart Chain, Polygon).

Logging In and Navigating the Interface

After logging in, you will see a sidebar on the left side of the screen. This sidebar is your main navigation tool. Here is what each button does:

• Dashboard — Your home page. Shows summary cards for active cases, recent traces, and risk alerts, plus a quick-trace search bar.
• Lynx — The core tracing tool. This is where you paste addresses and build visual graphs of fund flows.
• Cases — Create and manage investigation cases. Link addresses and traces to specific cases.
• Wallets — Browse and manage tracked wallet addresses.
• Upload — Bulk-import labeled addresses via CSV or manual entry.
• Reports — Generate legal-ready investigation reports (coming soon).
• Exchanges — Browse a directory of cryptocurrency exchanges with details on jurisdiction, licenses, and known deposit addresses.
• Jurisdictions — View regulatory information organized by country.
• Manual — This page. The user guide you are reading right now.
• Settings — Configure your theme, API keys, and account preferences.

The sidebar can be collapsed to save space by clicking the Collapse button at the bottom. Your collapse preference is remembered between sessions.

2. Lynx — Blockchain Tracer

Lynx is the core feature of Chainbrium. It takes a cryptocurrency wallet address and generates a visual graph showing all the addresses that wallet has sent money to or received money from.

Starting a Trace

1. Click Lynx in the sidebar, or navigate to the Lynx page.
2. Click the search bar in the top-left corner. It expands when you hover over or click it.
3. Paste a wallet address into the search field. You can get this address from a police report, a victim's transaction receipt, a blockchain explorer, or any other investigative source.
4. Chainbrium automatically detects the blockchain. A small badge (e.g., "BTC," "ETH," or "TRX") appears next to the input field to confirm which chain was detected.
5. Click the Search button or press Enter.
6. A progress bar appears at the top of the screen while the trace is running. Once complete, a graph appears showing the address and its counterparties.

Token Switching

Some blockchains carry multiple types of currency. For example, the Ethereum blockchain carries both ETH (the native currency) and tokens like USDT and USDC (digital dollars). Tron carries both TRX and USDT.

After you start a trace, token pills appear below the search bar. These small buttons let you switch between different currencies on the same blockchain:

• ETH chain: Toggle between ETH, USDT (ERC-20), and USDC (ERC-20).
• TRX chain: Toggle between TRX and USDT (TRC-20).

Click a pill to re-run the trace for that specific token. This is important because criminals often convert between tokens, and tracing the correct one can reveal different counterparties.

Understanding the Graph

The graph is a visual map of money movement. Here is how to read it:

Nodes (circles, hexagons, diamonds)

Each shape on the graph represents a wallet address or identified entity. The shape, color, and size tell you what type of entity it is:

• Circles — Regular wallet addresses, smart contracts, or scam/sanctioned addresses.
• Hexagons — Identified services: exchanges, bridges, or mining pools.
• Diamonds — Mixers or tumblers (services used to obscure the trail of funds).

Larger nodes have processed more transactions. The node label shows the entity name (if known) and a shortened version of the address.

Edges (arrows)

The lines between nodes represent transfers of funds. Arrows show the direction money flowed — from the sender to the receiver. Edge labels show:

• The amount transferred.
• F: followed by a date — the date of the first transfer between these two addresses.
• L: followed by a date — the date of the last transfer between them.

The Legend — Node Types and Colors

Each node type has a distinct visual style so you can quickly identify what you are looking at.

Entity Type	Shape	Color	Description
Target Address	Circle	Grey with cyan glow	The address you searched for. This is your starting point. It has a cyan glow to make it easy to find.
Exchange	Hexagon	Cyan	A known cryptocurrency exchange — a company where people buy, sell, or trade crypto (e.g., Binance, Coinbase, Kraken). Exchanges often require identity verification, so they may be able to identify the account holder if served with legal process.
Smart Contract / DeFi	Circle	Yellow / Gold	An automated program on the blockchain. DeFi (Decentralized Finance) protocols like Uniswap or Aave allow users to swap tokens, lend, or borrow without a company intermediary.
Mixer / Tumbler	Diamond	Red, with red glow	A service designed to obscure the trail of cryptocurrency by mixing multiple users' funds together. Funds that pass through a mixer are extremely difficult to trace further. Examples: Tornado Cash, Wasabi Wallet. The presence of a mixer is a significant red flag.
Bridge	Hexagon	Purple	A service that moves cryptocurrency from one blockchain to another (e.g., from Ethereum to BNB Smart Chain). Criminals sometimes use bridges to complicate tracing by hopping between blockchains.
Scam / Sanctioned	Circle	Red with thick border and red glow	An address flagged as high or critical risk. This may be a known scam address, an address on a government sanctions list (e.g., OFAC), or an address associated with theft or fraud.
Mining Pool	Hexagon	Green	A service where cryptocurrency miners pool their computing resources. If funds flow to or from a mining pool, it may indicate legitimate mining income, or it could be a laundering technique.
Unknown	Circle	Dark / Black	An address with no known label or entity identification. This is the default appearance for addresses Chainbrium has not yet classified.

Risk-Colored Borders

In addition to the node shape and fill color, nodes may have a colored border ring that indicates their risk level:

• Green — Clean. No known risk factors.
• Olive — Low risk. Minor or indirect risk indicators.
• Amber — Medium risk. Some suspicious activity or association.
• Red — High risk. Significant risk factors present.
• Dark Red — Critical. Known scam, sanctioned, or confirmed malicious address.

Solid vs. Dashed Borders

Borders can be either solid or dashed:

• Solid border — The label and risk level come from Chainbrium's built-in database of verified entities. These are system-confirmed.
• Dashed border — The label was uploaded by a user (through the Upload page). These labels have not been independently verified by Chainbrium and should be treated with appropriate caution.

Interacting with the Graph

Selecting Nodes

• Click a node to select it. A small "X" button appears, allowing you to delete that node from the graph.
• Right-click a node to open the Info Panel on the right side of the screen (see below).

Moving and Rearranging

• Drag a node to move it to a new position. If Pin Mode is on (the default), the node stays where you put it. If Pin Mode is off, the node will float back toward its physics-calculated position.
• Drag the background to pan the entire view.

Zooming

• Scroll wheel — Zoom in and out.
• Zoom buttons — Use the + and − buttons in the bottom toolbar.
• Keyboard — Press + to zoom in and - to zoom out.

Fit to View

Press F or click the Fit button in the toolbar to zoom and pan the graph so that all nodes are visible on screen.

Pin Mode

The Pin button (pin/thumbtack icon) in the bottom toolbar controls whether dragged nodes stay in place. When active (highlighted), nodes you drag will remain fixed at that position. Toggle it off to let the physics engine automatically arrange nodes.

Curved vs. Straight Edges

The Curved edges button in the toolbar toggles between curved and straight lines connecting nodes. Curved edges are easier to read when multiple connections exist between the same pair of addresses.

Deleting Nodes

Click a node to select it, then click the X that appears to remove it from the graph. This removes the node and all its connections from the current view.

The Info Panel

Right-click any node to open the Info Panel on the right side of the screen. This panel provides detailed information about the selected address.

Entity Header

At the top of the panel you will see:

• Type badge — The category of the entity (e.g., "Exchange," "Mixer/Tumbler," or "Address").
• Entity name — The identified name, if known (e.g., "Binance," "Tornado Cash").
• Risk level — The assigned risk rating, color-coded.
• Full address — The complete wallet address.

Stats Grid

Below the header, a grid shows key statistics:

• Sent — Total value sent from this address.
• Received — Total value received by this address.
• Volume — Total value of all transfers (sent + received).
• Transfers — Number of transactions in the graph.
• Deposits — Number of incoming transfers.
• Withdrawals — Number of outgoing transfers.

Tabs

The panel has four tabs:

1. Overview — Shows the activity timeline (a visual bar showing when the address was active), the blockchain, and first/last seen dates. Includes two action buttons:
   • Expand Node — Runs a new trace from this address and adds the results to your existing graph. Use this to follow the money trail further.
   • Copy Address — Copies the full address to your clipboard.
2. Counterparties — Lists all addresses that have sent money to or received money from this address. Each row shows the direction (IN or OUT), the address, and the total amount. Click an address to navigate to it in the graph.
3. Transfers — Shows individual transactions. Each row includes a + button you can click to add that counterparty to the graph if it is not already there.
4. OSINT — Open-Source Intelligence. Shows any publicly available information about this address from external databases, forums, or label sources. May include tags and links to external resources.

Keyboard Shortcuts

Multi-Address Tracing

You are not limited to tracing one address at a time. To build a combined graph:

1. Trace your first address normally.
2. Paste a second address into the search bar and trace it. The new results are added to the existing graph.
3. Repeat for as many addresses as needed.

If the same address appears in multiple traces, Chainbrium merges them into a single node, making it easy to see connections between seemingly unrelated addresses.

3. Exporting Your Work

Click the Export button in the top-right corner of the Lynx page to save your investigation. A dropdown menu offers three formats:

CSV Export (.csv)

Exports all addresses and transactions currently visible in the graph as a spreadsheet file. This is useful for importing data into other tools, creating tables for reports, or sharing raw data with colleagues.

Image Export (.jpg)

Saves a screenshot of the current graph view as a JPG image. This is ideal for including in court filings, investigation reports, or presentations.

Chainbrium Project (.cv)

Saves your entire investigation — including all nodes, edges, positions, and metadata — as a .cv file. This file can be opened later to continue your investigation exactly where you left off, or shared with a colleague who can import it into their own Chainbrium instance.

4. Importing & Continuing Investigations

The New Investigation Dialog

Click the + button in the Lynx sidebar (top-left) or press N to open the New Investigation dialog. You have two options:

1. Blank Graph — Clears the current graph and starts fresh. You can then paste an address to begin a new trace.
2. Import Project — Opens a file picker to load a previously saved .cv file. Click this option, then drop your .cv file into the drop zone or click to browse your files.

Drag and Drop

You can also drag a .cv file directly onto the graph area to import it.

Sharing with Team Members

To share an investigation with a colleague:

1. Export the investigation as a .cv file.
2. Send the file to your colleague (via email, shared drive, etc.).
3. They open Chainbrium, click + > Import Project, and select the file.

5. Bulk Address Upload

The Upload page lets you import labeled addresses into Chainbrium's database. These labels will then appear on the graph whenever those addresses show up in a trace.

CSV Upload

1. Navigate to Upload in the sidebar.
2. Drag a CSV file onto the drop zone, or click the drop zone to browse your files.
3. Chainbrium previews the first few rows of your file in a table. Verify the data looks correct.
4. Click Import to upload the addresses, or Cancel to discard.

CSV Template

Click Download Template below the drop zone to get a sample CSV file with the correct column headers. The columns are:

Column	Required?	Description
address	Yes	The wallet address.
chain	Yes	The blockchain: ETH, BTC, TRX, SOL, or auto.
label	No	A short name for the address (e.g., "Suspect Hot Wallet").
entity	No	The organization or person (e.g., "Binance," "John Doe").
entity_type	No	The type: exchange, contract, defi, mixer, bridge, mining_pool, or unknown.
risk	No	Risk level: clean, low, medium, high, critical, or unknown.

Quick Add (Manual Entry)

Below the CSV upload area, there is a Quick Add form for entering a single address manually. Fill in the address, select the chain (or leave on Auto-detect), and add a label. You can optionally set the entity name, entity type, and risk level.

How Uploaded Labels Appear on the Graph

When you trace an address that matches an uploaded label, the node on the graph will show:

• The label name as the node text.
• A colored border ring matching the risk level.
• A dashed border (as opposed to solid) to indicate that this label came from a user upload rather than from Chainbrium's verified database.

Recent Imports

The bottom of the Upload page shows a Recent Imports table listing all addresses you have recently uploaded, along with their chain, label, entity, risk level, and upload date.

6. Cases & Reports

Cases

The Cases page lets you organize your investigations. Each case has an ID, name, status, creation date, and last updated date.

To create a new case:

1. Navigate to Cases in the sidebar.
2. Click the New Case button in the top-right corner.
3. Enter a name for the case and any relevant details.

You can use cases to group related addresses and traces together. This is especially useful for complex investigations involving multiple suspects or multiple wallets.

Reports

The Reports section will allow you to generate formatted legal reports that summarize your findings, including graph snapshots, address summaries, and fund-flow timelines. This feature is coming soon.

7. Settings

Access settings from the Settings link in the sidebar, or from the gear icon in the Lynx tracer sidebar.

Theme

Choose your preferred color scheme:

• Dark — Deep navy background (default). Easiest on the eyes for long sessions.
• Semi-Dark — Slightly lighter dark theme.
• Warm — A warm-toned dark theme (available in Lynx settings panel).
• Light — Light background with dark text.

Graph Settings (Lynx)

In the Lynx tracer's settings panel (gear icon in the sidebar), you can toggle:

• Show edge dates (F/L) — Display first and last transfer dates on edges.
• Curved edges — Use curved lines instead of straight lines.
• Pin nodes on drag — Whether dragged nodes stay fixed or float back.

API Keys

For higher trace limits and more detailed results, you can enter API keys for third-party blockchain data providers:

• Blockchair API Key — For Bitcoin and general blockchain data.
• Etherscan API Key — For Ethereum and ERC-20 token data.
• Tronscan API Key — For Tron and TRC-20 token data.

After entering your keys, click Save Keys. Keys are stored locally in your browser.

Account

View your email address and role. Click Log Out to end your session.

8. Submitting a Scam Report

The Report a Scam page is a public-facing form that allows anyone — including victims — to submit information about cryptocurrency fraud. You can access it from the Lynx settings panel under "Report a Scam."

What to Include

The form asks for:

• Your contact information — Name and email (so investigators can follow up).
• Scam details — The type of scam (investment fraud, phishing, ransomware, etc.), the date it occurred, and the amount lost.
• Wallet addresses — The address(es) where you sent funds or that the scammer used. You can select the blockchain for each address. Click "Add Another Wallet" if multiple addresses were involved.
• Description — A free-text field to describe what happened in your own words.
• Evidence — Upload supporting files such as screenshots, transaction receipts, email correspondence, or chat logs.

What Happens After Submission

After you submit the form, the reported addresses are flagged in Chainbrium's database. This means that if another investigator traces one of those addresses in the future, they will see a warning that it has been reported as part of a scam. Your contact information is kept confidential.

9. Glossary

Blockchain

A public, permanent digital ledger that records every transaction. Think of it as a shared spreadsheet that anyone can read but no one can alter. Bitcoin, Ethereum, and Tron each have their own blockchain.

Wallet Address

A unique string of letters and numbers that identifies a "location" on a blockchain where cryptocurrency can be sent or received. Similar to a bank account number, but public. Example: 0x742d35Cc6634C0532925a3b844Bc9e7595f2bD38

Transaction (TX)

A transfer of cryptocurrency from one address to another. Every transaction is permanently recorded on the blockchain and visible to anyone.

Block Explorer

A website that lets you search and view transactions on a blockchain. Examples: Etherscan (for Ethereum), Blockchain.com (for Bitcoin), Tronscan (for Tron).

Exchange (CEX)

A Centralized Exchange is a company that lets people buy, sell, and trade cryptocurrency. Users must typically verify their identity (KYC). Examples: Binance, Coinbase, Kraken. Because they hold user identity data, exchanges are key partners for law enforcement.

DEX (Decentralized Exchange)

An exchange that operates via smart contracts rather than a company. Users trade directly from their wallets without identity verification. Examples: Uniswap, SushiSwap. DEXs do not hold user identity information.

Smart Contract

A program stored on a blockchain that automatically executes when certain conditions are met. Smart contracts power DeFi applications, token swaps, and automated trading.

DeFi (Decentralized Finance)

Financial services (lending, borrowing, trading) built on blockchains using smart contracts, without traditional banks or intermediaries.

Mixer / Tumbler

A service that takes cryptocurrency from many users, mixes it together, and sends out different coins of the same value. This breaks the trail between sender and receiver. Using a mixer is a strong indicator of intentional obfuscation.

Bridge

A service that transfers cryptocurrency from one blockchain to another. For example, a bridge might move tokens from Ethereum to BNB Smart Chain. Criminals may use bridges to complicate tracing by hopping between blockchains.

Token (ERC-20, TRC-20)

A cryptocurrency that runs on top of another blockchain rather than having its own. ERC-20 tokens run on Ethereum (e.g., USDT, USDC). TRC-20 tokens run on Tron (e.g., USDT). USDT is a "stablecoin" whose value is pegged to the US dollar.

UTXO

Stands for "Unspent Transaction Output." This is how Bitcoin tracks balances. Rather than keeping a running account balance, Bitcoin tracks individual "coins" (UTXOs) that can be spent. This is a technical detail — Chainbrium handles this automatically.

Gas

A fee paid to process transactions on Ethereum and similar blockchains. Every action on Ethereum costs a small amount of gas, paid in ETH.

Risk Levels

Chainbrium assigns risk levels to addresses: Clean (no known issues), Low (minor indirect risk), Medium (some suspicious indicators), High (significant risk factors), and Critical (confirmed malicious, sanctioned, or scam-linked).

Sanctioned Address

A wallet address that appears on a government sanctions list, such as the U.S. Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list. Transacting with sanctioned addresses may violate the law.

10. Frequently Asked Questions