- Shaded country
- The measure picked above. Grey means zero; the darkest grey means we have no data for that country at all.
- Small circle
- A place too small to shade at this resolution — Singapore, Hong Kong, Cayman, Seychelles. A lot of this dataset lives in them.
- Orange dot
- One OFAC-designated party, sized by how many addresses it holds, clustered at its country. Dim means we cannot read its balance. Hover for the name.
- Solid arc, pulses travelling
- Stolen funds. Runs from the victim's jurisdiction to a publicly attributed attacker, thickness by value. Only North Korea and the United States appear at the receiving end, because that is the whole of the public attribution record.
- Dashed arc, dashes crawling
- Affiliation, not money. An entity based in one country but sanctioned under another's program — Treasury saying it acts for that state. No transaction is being claimed between the two.
Not everything can be drawn. Thefts from DAOs and anonymous teams have no
location, and roughly 72% of all stolen value has no publicly attributed
attacker at all — none of that reaches the map. The incident feed also
covers DeFi and exchange exploits only, with no ransomware or darknet
markets. Full method and limits →