drop victim wallet + theft txid · trace + label counterparties + clustering + exchange notice · runs locally
wallet · txid · cluster export · local only
heuristic screener · vendor schema varies · not definitive proof