🛡️

KYT Alert Training Guide

Mock alert scenarios with live KYT API integration • Register transfers, retrieve alerts, and link directly into KYT

⚠️ TRAINING MATERIAL ONLY — Addresses and hashes are mocked. Replace with real transaction data to generate actual KYT alerts. Each scenario includes editable fields so you can customize before registering.
🔑 KYT API Configuration
Not connected
SEVERE ALERT #KYT-2026-04821 ⬆ SENT
⛔ Direct Outbound — Customer Sent Funds to OFAC Sanctioned Entity
Network
Bitcoin
Asset
BTC
Amount
0.4823 BTC ($30,226)
Rule
Direct exposure to Sanctioned Entity ≥ $0
📋 Transaction Details
Transaction Hash
a3f7c0e91d284b6e5f832c47d19a0e6b7834f2c1a9e06d5b8c42f7a10389de5c
Our Company — Customer Wallet
bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh
Sanctioned Counterparty
bc1q5shngj24323zshmkqnpddrvg3rl7pdfm3eq47m
🔗 Fund Flow
🏢 Our Company
Customer Wallet
bc1qxy2k…0wlh
0.4823 BTC
Jul 18 14:32
⛔ OFAC Sanctioned
Garantex
bc1q5shn…q47m
🕐 Timeline
Jul 18 — 14:28 UTC
Customer initiates withdrawal of 0.4823 BTC
Jul 18 — 14:30 UTC
Transaction broadcast to Bitcoin mempool
Jul 18 — 14:32 UTC
⛔ KYT ALERT — Direct Sanctions Exposure (SENT)
Jul 18 — 14:41 UTC
Confirmed in block 903,217
📸 KYT Alert Screen
📸
KYT Alert Screenshot
Insert screenshot of the KYT alert detail view
🔬 Reactor Graph
🔬
Reactor Investigation Graph
Insert Reactor graph showing the fund flow
🔍 Investigation Playbook

Confirm Attribution in Reactor

Verify the Garantex cluster and OFAC SDN designation is active.

Freeze Customer Account

Direct sanctions = mandatory freeze. No threshold, no discretion.

File OFAC Blocked Property Report

Submit within 10 business days with full transaction details.

File SAR/STR

Include Chainalysis attribution evidence and tx details.

SEVERE ALERT #KYT-2026-04902 ⬇ RECEIVED
⛔ Direct Inbound — Received Funds from OFAC Sanctioned Entity
Network
Ethereum
Asset
USDT
Amount
18,200 USDT ($18,200)
Rule
Direct exposure to Sanctioned Entity ≥ $0
📋 Transaction Details
Transaction Hash
0x7e3a1b9c4d2f8e0a5c7b9d1f3e5a7c9b0d2f4e6a8c0b2d4f6a8e0c2d4f6a8b0c
Sending (Sanctioned)
0xDe1f2A3b4C5d6E7f8A9b0C1d2E3f4A5b6C7d8E9f
Our Company — Customer Deposit
0x4E2f8c1A9b3D5e7F0a2C4d6B8e0F1a3C5d7E9b1A
🔗 Fund Flow
⛔ Sanctioned
Garantex
0xDe1f…8E9f
18,200 USDT
Jul 19 08:14
🏢 Our Company
Customer Deposit
0x4E2f…9b1A
🕐 Timeline
Jul 19 — 08:12 UTC
Transaction broadcast from Garantex hot wallet
Jul 19 — 08:14 UTC
⛔ KYT ALERT — Direct Sanctions (RECEIVED)
Jul 19 — 08:16 UTC
Auto-hold: customer withdrawals blocked
📸 KYT Alert Screen
📸
KYT Alert Screenshot
Insert KYT alert for direct-received sanctions
🔬 Reactor Graph
🔬
Reactor Investigation Graph
Insert Reactor graph showing Garantex → Our Company
🔍 Investigation Playbook

Hold Deposited Funds

Sanctioned funds on our platform = blocked property. Block all withdrawals.

File OFAC Blocked Property Report + SAR

OFAC report within 10 business days. Consult legal on fund disposition.

HIGH ALERT #KYT-2026-05193 ⚡ FAST — 4 HRS
⚠️ Indirect Sanctions — Rapid Multi-Hop (Likely Same Actor)
Network
Ethereum
Asset
USDT
Amount
25,000 USDT
Indirect
38.2% to Tornado Cash
🔗 Fund Flow — ⚡ Rapid Layering
⛔ Sanctioned
Tornado Cash
0x910C…f3A2
100 ETH
05:10
Hop 1 · 18m
Fresh Wallet
0xB4a1…8c3D
Swap→USDT
05:28
Hop 2 · 42m
Fresh Wallet
0xC7e2…4f1A
Split
06:10
Hop 3 · 3h
Fresh Wallet
0x7a3B…8A0C
25K USDT
09:12
🏢 Our Company
Customer Deposit
0x4E2f…9b1A
⚡ HIGHLY SUSPICIOUS — 4-hour transit, fresh wallets, 38.2% exposure. Treat as near-direct. Freeze + SAR.
📸 KYT Alert Screen
📸
KYT Alert Screenshot
Insert KYT view for fast indirect sanctions
🔬 Reactor Graph
🔬
Reactor Investigation Graph
Insert Reactor graph showing rapid 3-hop chain
HIGH ALERT #KYT-2026-05301 🐢 SLOW — 74 DAYS
⚠️ Indirect Sanctions — Slow Multi-Hop (Possibly Different People)
Network
Ethereum
Asset
USDT
Amount
9,800 USDT
Indirect
12.3% to Tornado Cash
🔗 Fund Flow — 🐢 74 Days
⛔ Sanctioned
Tornado Cash
0x910C…f3A2
10 ETH
May 10
Day 8
DeFi Trader
0xA1b2…c3D4
→
→
Day 31
NFT Collector
0xE5f6…7g8H
→
→
Day 58
Freelancer
0xI9j0…k1L2
9,800 USDT
Jul 22
🏢 Our Company
Customer Deposit
0x4E2f…9b1A
🐢 LOWER SUSPICION — 74 days, established wallets, 12.3%. Apply EDD, risk-based SAR decision.
⚖️ Fast vs. Slow — Analyst Cheat Sheet
⚡ Fast (Same Actor)🐢 Slow (Different People)
TransitMinutes–hoursWeeks–months
WalletsFreshly created, no historyEstablished, independent activity
Exposure %High (>30%)Low (<20%)
ActionFreeze + SAREDD + document
📸 KYT Alert Screen
📸
KYT Alert Screenshot
Insert KYT for slow indirect sanctions
🔬 Reactor Graph
🔬
Reactor Investigation Graph
Insert Reactor graph showing 74-day chain
SEVERE #KYT-2026-06340 ⬆ SENT
💣 Direct Outbound — Sent to Terrorist Financing Campaign
Network
Bitcoin
Asset
BTC
Amount
0.1247 BTC ($7,818)
📋 Details
Tx Hash
e7b2c4a19f3d8e60a5c1b9d72f4e8a6c3b5d0f1e2a4c6b8d0e2f4a6c8b0d2e4f
Our Company
bc1q9h5yjqma3vf0hp35l8xrz2cf5c8dvmgjz0082
Terror Finance
bc1qr4dl5v62euf7njgxn9ffz3dpg80crku5aaw8tl
🔗 Flow
🏢 Our Company
Customer
bc1q9h5y…0082
0.1247 BTC
Jul 21
💣 Terror
Al-Qassam Campaign
bc1qr4d…w8tl
Consolidated
Jul 21
Treasury
Campaign Treasury
bc1q3m8…v2k7
🕐 Timeline
Jul 21 — 03:42
Customer initiates withdrawal
Jul 21 — 03:47
⛔ KYT ALERT — Direct TF (SENT)
Jul 21 — 03:52
Confirmed block 903,891 → consolidated into treasury
📸 KYT Alert Screen
📸
KYT Alert Screenshot
Insert KYT alert for direct-sent TF
🔬 Reactor Graph
🔬
Reactor Investigation Graph
Insert Reactor graph: wallet → terror → treasury
SEVERE #KYT-2026-06401 ⬇ RECEIVED
💣 Direct Inbound — Received from Terrorist-Linked Wallet
Network
Tron
Asset
USDT (TRC-20)
Amount
5,200 USDT
📋 Details
Tx Hash
c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
Terror Finance
TVx8K3nM7pQ2rS4tU6vW8xY0zA1bC3dE5f
Our Company
TK9a2bR4eD7fG1hJ3kL5mN8pQ0rS2tU4vW
🔗 Flow
💣 Terror
TF Network
TVx8K…E5f
5,200 USDT
Jul 21
🏢 Our Company
Customer Deposit
TK9a2…4vW
📸 KYT
📸
KYT Alert Screenshot
Insert KYT for direct-received TF
🔬 Reactor
🔬
Reactor Graph
Insert Reactor: TF wallet → Our Company
HIGH #KYT-2026-06512 ⚡ FAST — 6 HRS
⚠️ Indirect TF — Rapid DEX Laundering (Same Network)
Network
Ethereum
Asset
USDC
Amount
14,000 USDC
Indirect
27.5% TF
🔗 Flow
💣 TF
Terror Network
0xF1e2…d3C4
8 ETH
02:10
22 min
DEX Swap
0xA5b6…c7D8
→USDC
02:32
5 hrs
Fresh Wallet
0xE9f0…a1B2
14K USDC
08:05
🏢 Our Company
Customer
0x4E2f…9b1A
⚡ TREAT AS NEAR-DIRECT TF
📸 KYT
📸
KYT Alert Screenshot
Fast indirect TF
🔬 Reactor
🔬
Reactor Graph
Rapid TF laundering chain
HIGH #KYT-2026-06590 🐢 SLOW — 92 DAYS
⚠️ Indirect TF — Slow Dispersal (Possibly Different People)
Network
Bitcoin
Asset
BTC
Amount
0.32 BTC ($20,051)
Indirect
8.7% TF
🔗 Flow
💣 TF
TF Campaign
bc1qx7…m2n3
2 BTC
Apr 22
Week 2
P2P Trader
bc1qa4…b5c6
→
→
Month 2
Merchant
bc1qd7…e8f9
0.32 BTC
Jul 23
🏢 Our Company
Customer
bc1q9h5…0082
🐢 LOWER SUSPICION — 92 days, 8.7%. EDD + document rationale.
📸 KYT
📸
KYT Alert Screenshot
Slow indirect TF
🔬 Reactor
🔬
Reactor Graph
92-day TF dispersal
SEVERE #KYT-2026-07102 ⬆ SENT
🔴 Direct Outbound — Sent to CSAM Vendor
Network
Bitcoin
Asset
BTC
Amount
0.0089 BTC ($557)
📋 Details
Tx Hash
f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2
Our Company
bc1qm34z7y9u5v2c8d1e0f3a4b5c6d7e8f9g0h1j2k
CSAM Vendor
bc1q8f3a2c4d6e7b9a1c3d5e7f9a2b4c6d8e0f2a4c
🔗 Flow
🏢 Our Company
Customer
bc1qm34…1j2k
0.0089 BTC
Jul 19
🔴 CSAM
Dark Web Vendor
bc1q8f3…2a4c
📸 KYT
📸
KYT Alert Screenshot
Direct-sent CSAM
🔬 Reactor
🔬
Reactor Graph
Customer → CSAM vendor
SEVERE #KYT-2026-07155 ⬇ RECEIVED
🔴 Direct Inbound — Received from CSAM Operation (Possible Distributor)
Network
Ethereum
Asset
USDC
Amount
2,100 USDC
📋 Details
Tx Hash
a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3
CSAM Operation
0xB1c2D3e4F5a6B7c8D9e0F1a2B3c4D5e6F7a8B9c0
Our Company
0x4E2f8c1A9b3D5e7F0a2C4d6B8e0F1a3C5d7E9b1A
🔗 Flow
🔴 CSAM
CSAM Marketplace
0xB1c2…B9c0
2,100 USDC
Jul 20
🏢 Our Company
Customer
0x4E2f…9b1A
📸 KYT
📸
KYT Alert Screenshot
Direct-received CSAM
🔬 Reactor
🔬
Reactor Graph
CSAM marketplace → Our Company
HIGH #KYT-2026-07288 ⚡ FAST — 8 HRS
🟠 Indirect CSAM — Fast Laundering (Same Actor)
Network
Tron
Asset
USDC (TRC-20)
Amount
3,400 USDC
Indirect
31.4% CSAM
🔗 Flow
🔴 CSAM
Marketplace
TJ7x3…qR9s
4,200 USDC
02:00
1 hr
Fresh
TN4f8…8yA
3,400
03:05
7 hrs
Fresh
TP2q3…r4S5
3,400 USDC
10:10
🏢 Our Company
Customer
TK9a2…4vW
⚡ TREAT AS NEAR-DIRECT CSAM
📸 KYT
📸
KYT Alert Screenshot
Fast indirect CSAM
🔬 Reactor
🔬
Reactor Graph
Rapid CSAM laundering
HIGH #KYT-2026-07310 🐢 SLOW — 68 DAYS
🟠 Indirect CSAM — Slow Dispersal (Different People)
Network
Bitcoin
Asset
BTC
Amount
0.15 BTC ($9,402)
Indirect
9.8% CSAM
🔗 Flow
🔴 CSAM
Vendor
bc1qv8…w9X0
1.5 BTC
May 16
Wk 2
P2P
bc1qy1…z2A3
→
→
Mo 1
Merchant
bc1qb4…c5D6
0.15 BTC
Jul 23
🏢 Our Company
Customer
bc1qm34…1j2k
🐢 INVESTIGATE — 68 days, 9.8%. EDD; consider LE if red flags.
📸 KYT
📸
KYT Alert Screenshot
Slow indirect CSAM
🔬 Reactor
🔬
Reactor Graph
68-day CSAM dispersal
SEVERE #KYT-2026-08455 ⬆ SENT — VICTIM
🎣 Direct Outbound — Customer (Victim) Sent to Pig Butchering Scam
Network
Ethereum
Asset
USDT
Amount
47,500 USDT
📋 Details
Tx Hash
0x2c4e6a8b0d1f3a5c7e9b0d2f4a6c8e0a1b3d5f7a9c1e3b5d7f9a2c4e6b8d0f2a
Our Company (Victim)
0x1A2b3C4d5E6f7A8B9c0D1e2F3a4B5c6D7E8f9A0B
Scam Platform
0x9F8e7D6c5B4a3F2E1d0C9b8A7f6E5d4C3b2A1f0E
📈 Escalating Pattern
#DateAmountNote
1Jun 12500Test
2Jun 192,000After fake profits
3Jun 285,000Escalating
4Jul 615,000Major
5Jul 1547,500THIS ALERT — Total $70K
🔗 Flow
🏢 Our Company
Customer (Victim)
0x1A2b…9A0B
47,500 USDT
Jul 15
🎣 Scam
Pig Butchering
0x9F8e…1f0E
Consolidated
Jul 16
Layering
Scam Hub
0xC3d4…7b8A
~$280K
Jul 17
Cash-Out
HTX
0xE5f6…9c0D
📸 KYT
📸
KYT Alert Screenshot
Scam victim escalating pattern
🔬 Reactor
🔬
Reactor Graph
Victim → scam → consolidation → exchange
SEVERE #KYT-2026-08520 ⬇ RECEIVED — MULE
🎣 Direct Inbound — Received Scam Proceeds (Money Mule)
Network
Tron
Asset
USDT (TRC-20)
Amount
28,000 USDT
📋 Details
Tx Hash
d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6
Scam Wallet
TL8m9n0P1qR2sT3uV4wX5yZ6aB7cD8eF9g
Our Company (Mule?)
TVj2K8dB7z4Aq3rF1eN5gH9jL2mP4oR6tU
🔗 Flow
143+ Victims
Multiple
Various
$3.2M
Jun–Jul
🎣 Scam
Pig Butchering
TL8m9…F9g
28K USDT
Jul 18
🏢 Our Company
Customer (Mule?)
TVj2K…6tU
📸 KYT
📸
KYT Alert Screenshot
Scam received — mule
🔬 Reactor
🔬
Reactor Graph
Victims → scam → mule (Our Company)
HIGH #KYT-2026-08630 ⚡ FAST — 3 HRS
⚠️ Indirect Scam — Rapid Layering (Same Network)
Network
Ethereum
Asset
USDT
Amount
19,000 USDT
Indirect
44.2% Scam
🔗 Flow
🎣 Scam
Pig Butchering
0xF2e3…d4C5
45K
14:00
40m
Split
0xA6b7…c8D9
19K
14:40
2.5h
Fresh
0xE0f1…a2B3
19K USDT
17:05
🏢 Our Company
Customer
0x4E2f…9b1A
⚡ NEAR-DIRECT SCAM — 3hrs, fresh wallets, 44.2%.
📸 KYT
📸
KYT Alert Screenshot
Fast indirect scam
🔬 Reactor
🔬
Reactor Graph
Rapid scam layering
HIGH #KYT-2026-08701 🐢 SLOW — 45 DAYS
⚠️ Indirect Scam — Slow Dispersal (Different People)
Network
Tron
Asset
USDC (TRC-20)
Amount
6,200 USDC
Indirect
14.1% Scam
🔗 Flow
🎣 Scam
Romance Scam
TQ4r5…s6T7
50K
Jun 8
Wk 2
OTC Desk
TU8v9…w0X1
→
→
Wk 6
Sender
TC6d7…e8F9
6,200 USDC
Jul 23
🏢 Our Company
Customer
TK9a2…4vW
🐢 LOWER SUSPICION — 45 days, 14.1%. EDD + risk-based SAR.
📸 KYT
📸
KYT Alert Screenshot
Slow indirect scam
🔬 Reactor
🔬
Reactor Graph
45-day scam dispersal
HIGH #KYT-2026-09700 ⬆ SENT
🎰 Direct Outbound — Sent to Unlicensed Gambling Platform
Network
Tron
Asset
USDT (TRC-20)
Amount
5,000 USDT
📋 Details
Tx Hash
a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
Our Company
TVj2K8dB7z4Aq3rF1eN5gH9jL2mP4oR6tU
Gambling
TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t
🔗 Flow
🏢 Our Company
Customer
TVj2K…6tU
5,000 USDT
Jul 22
🎰 Unlicensed
CryptoRoll Casino
TR7NH…Lj6t
📸 KYT
📸
KYT Alert Screenshot
Direct-sent gambling
🔬 Reactor
🔬
Reactor Graph
Customer → CryptoRoll
HIGH #KYT-2026-09712 ⬇ RECEIVED
🎰 Direct Inbound — Received from Unlicensed Gambling (Round-Trip)
Network
Tron
Asset
USDT (TRC-20)
Amount
8,750 USDT
📈 Round-Trip
DateDirAmountRunning
Jul 1Sent2,000-$2K
Jul 3Recv1,200-$800
Jul 8Sent5,000-$5.8K
Jul 14Sent3,500-$9.3K
Jul 22Recv8,750-$550
🔗 Flow — Round-Trip
🏢 Our Company
Customer
TVj2K…6tU
$10,500 →
Jul 1–14
🎰 Casino
CryptoRoll
TR7NH…Lj6t
← $9,950
Jul 3–22
🏢 Our Company
Customer
TVj2K…6tU
📋 Details
Tx Hash (This Alert)
b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3
📸 KYT
📸
KYT Alert Screenshot
Gambling received — round-trip
🔬 Reactor
🔬
Reactor Graph
Customer ↔ Casino round-trip
HIGH #KYT-2026-09801 ⚡ FAST — 5 HRS
⚠️ Indirect Gambling — Casino Used as Mixer (Same Actor)
Network
Ethereum
Asset
USDT
Amount
22,000 USDT
Indirect
65.3% Gambling
🔗 Flow — Casino-as-Mixer
Illicit Origin
Darknet Market
0xH1i2…j3K4
25K
10:00
🎰 Casino (Mixer)
CryptoRoll
TR7NH…Lj6t
22K
12:30
2.5h
Fresh Wallet
0xL5m6…n7O8
22K USDT
15:00
🏢 Our Company
Customer
0x4E2f…9b1A
⚡ CASINO AS MIXER — ML through gambling.
📸 KYT
📸
KYT Alert Screenshot
Casino-as-mixer pattern
🔬 Reactor
🔬
Reactor Graph
Darknet → casino → fresh → our platform
MEDIUM #KYT-2026-09880 🐢 SLOW — 55 DAYS
ℹ️ Indirect Gambling — Slow Dispersal (Licensed Casino)
Network
Bitcoin
Asset
BTC
Amount
0.08 BTC ($5,014)
Indirect
11.2% Gambling
🔗 Flow
🎰 Licensed
Stake.com
bc1qs8…t9U0
0.5 BTC
May 29
Wk 2
Trader
bc1qv1…w2X3
→
→
Wk 8
Sender
bc1qb7…c8D9
0.08 BTC
Jul 23
🏢 Our Company
Customer
bc1q9h5…0082
🐢 LOW RISK — Licensed, 55 days, 11.2%. Standard EDD.
📸 KYT
📸
KYT Alert Screenshot
Slow indirect gambling
🔬 Reactor
🔬
Reactor Graph
55-day licensed casino dispersal
📌 Reminders: All data is mocked. Replace hashes with real transaction data to generate actual KYT alerts. Insert actual KYT & Reactor screenshots into placeholders. Follow your institution's compliance policies.