Walkthrough
A complete example: creating an operation for crypto investment fraud, attaching evidence, adding participants, recording attestations, transitioning state, and generating an exchange escalation packet.
1. Create the operation
A victim reports a pig-butchering scam. The recovery team creates an operation to coordinate the response.
const operation = await md.operations.create({
type: "pig_butchering",
intent: "asset_recovery",
posture: "litigation_ready",
title: "BTC Recovery — Victim 2847",
});
// operation.state → "created"2. Add participants
The lead investigator and the victim's advocate are added with appropriate permissions.
const investigator = await md.participants.add(operation.id, {
type: "investigator",
name: "Jane Chen",
organization: "Recovery Partners LLC",
role: "lead_investigator",
permissions: ["read", "write", "transition", "attest"],
});
const advocate = await md.participants.add(operation.id, {
type: "advocate",
name: "Michael Torres",
role: "victim_advocate",
permissions: ["read", "attest"],
});3. Attach evidence
The victim provides wallet addresses and chat logs from the scam platform.
const wallet = await md.evidence.attach(operation.id, {
type: "wallet_address",
source: "victim_submission",
content: {
address: "bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh",
chain: "bitcoin",
label: "Scam deposit address",
},
});
const chatLog = await md.evidence.attach(operation.id, {
type: "chat_log",
source: "victim_submission",
content: {
platform: "WhatsApp",
date_range: "2024-09-01 to 2024-12-15",
message_count: 847,
},
});4. Transition to intake
await md.operations.transition(operation.id, {
to: "intake",
reason: "Victim evidence received, beginning review",
});
// operation.state → "intake"5. Verify evidence
The investigator confirms the wallet address on-chain and creates an attestation.
// Mark evidence as verified
await md.evidence.verify(wallet.id, {
method: "chain_analysis",
notes: "Confirmed 14 inbound transactions totaling 3.2 BTC",
});
// Record the attestation
const attestation = await md.attestations.create(operation.id, {
type: "verification",
claim: "Wallet bc1qxy... confirmed as scam deposit address via chain analysis",
evidence: [wallet.id],
});6. Transition to verified
await md.operations.transition(operation.id, {
to: "verified",
reason: "Evidence reviewed and confirmed by lead investigator",
proof: [attestation.id],
});
// operation.state → "verified"7. Add constraints
The operation is subject to Singapore MAS regulations and a 72-hour freeze window.
await md.constraints.create(operation.id, {
type: "jurisdiction",
description: "Subject to Singapore MAS Notice PSN02",
enforced: true,
metadata: { jurisdiction: "SG" },
});
await md.constraints.create(operation.id, {
type: "time_limit",
description: "72-hour freeze request window",
enforced: true,
metadata: { hours: 72 },
});8. Generate the packet
The investigator generates a freeze request packet for the exchange compliance team.
const packet = await md.packets.generate(operation.id, {
type: "exchange_escalation",
recipient: {
name: "Binance Compliance",
type: "exchange",
},
evidenceIds: [wallet.id, chatLog.id],
attestationIds: [attestation.id],
});
// packet.state → "generated"9. Send and escalate
// Mark packet as sent
await md.packets.send(packet.id, {
method: "email",
sentTo: "[email protected]",
});
// Transition to escalated
await md.operations.transition(operation.id, {
to: "escalated",
reason: "Freeze packet sent to Binance Compliance",
proof: [packet.id],
});
// operation.state → "escalated"Result
The operation now has a complete audit trail: who reported it, what evidence was collected, who verified it, what constraints apply, and what was sent to the exchange. Every action is recorded. Every transition has proof.