🛠️ On-Chain Forensic Investigation & FinCEN SAR Narrative Pack

Target Incident: Lazarus Group / Ronin Bridge Exploit ($625M)
Primary Target Address: 0x098B716B8Aaf21512996dC57EB0615e2383E2f96 (OFAC SDN List)
Focus Areas: Blockchain Forensics, Peeling Chains, Data Parsing, Sanctions Compliance, & SAR Narrative Drafting

---

📌 Executive Summary

This repository contains an end-to-end blockchain forensic investigation and regulatory reporting suite analyzing the laundering patterns executed by the DPRK-sponsored Lazarus Group following the March 2022 Ronin Bridge exploit.

Using raw on-chain transaction data extracted via the Etherscan V2 API, this project isolates high-value transfers, filters smart contract approval noise, maps primary fund dispersal destinations, and generates an institutional-grade Suspicious Activity Report (SAR) narrative compliant with FinCEN guidance.

---

🛠️ Repository Structure

Crypto-OnChain-Forensic-SAR-Pack/
│
├── data/
│   └── raw_txs.csv                 # Raw on-chain dataset (429 transactions)
│
├── scripts/
│   ├── fetch_trace.py              # Etherscan API V2 data extraction script
│   └── analyze_data.py             # Forensic analytics & volume aggregation engine
│
├── reports/
│   └── SAR_Narrative_Case_2026_01.md # Institutional FinCEN SAR Narrative draft
│
└── README.md                       # Project overview & key findings