Risk Scoring Methodology

Seeding-origin floor. When a subject's SEEDING funding — its first observed inbound transfer AND the dominant share of its capitalization window (inflow up to first outflow) — is attributed to a catalogued illicit entity (theft, hack, exploit, ransomware, sanctioned, and the related categories), that origin floors the verdict: HIGH for an illicit-catalog funder, SEVERE for a sanctioned one, graded by the shared entity-risk classifier. The floor is deliberately narrow: it applies only to seeding, never to incidental receipt. An exchange deposit address that receives from a designated entity, a victim wallet receiving returned funds, and an unsolicited above-dust transfer into an already-funded wallet are all excluded, because in each the illicit inflow is neither the first funding nor the dominant share. The floor is disclosed as a statement about the wallet's origin, not a determination that the subject itself is designated; the earlier funding-source signal (an origin lead, not a floor) is unchanged for non-seeding cases.

Authorship and evaluability disclosure. Text-pattern classification into the STRONG evidence tier now requires the finding to carry high or critical severity, matching the bar already applied to the highest tier. A finding authored by the analytical model itself — a disclosed model diagnostic — can no longer be classified above the lowest evidence tier by text pattern; typed evidence produced by a deterministic engine remains the authoritative path and is unaffected. Where subject-linkage could not be evaluated for a finding because it carries no typed address, the finding remains floor-eligible (conservative) and the report states that linkage was not evaluated for it rather than presenting a linkage determination. Where a categorical floor rests on findings that carry no evidence anchor, the report states the anchor state alongside the floor: a designation is never withheld on a bookkeeping ground, and the exhibit no longer asserts one exclusion rule while applying another.

Affirmative-evidence text classification. Text-pattern evidence-tier classification requires affirmative, non-negated language: a finding whose prose negates the matched term (for example, "no sanctioned addresses identified") is treated as a disclosure of a clean result, not as a hit. High-tier text classification additionally requires the finding to carry high or critical severity. Typed evidence attribution (entity category, factor tier) remains the authoritative classification path and is unaffected.

Evidence-grade linkage. The subject-linkage fund-flow analysis traverses native-value edges only; token-denominated transfers contribute undirected graph-proximity context but never a verdict floor. When a traced graph is evaluated, attributions that cannot be located within it are treated as contextual intelligence rather than verdict drivers. A conservative unscoped mode applies, and is disclosed, when no traced graph is available.

Verdict floors (sanctions / mixer / illicit-entity) now apply only to SUBJECT-LINKED exposure — attributions with a directed fund-flow path to or from the investigation subject. Peripheral attributions elsewhere in the traced graph render as contextual intelligence with hop distance, never as a verdict override. Published risk bands reconciled to the engine's canonical thresholds (Low 0–39, Medium 40–69, High 70–89, Critical 90–100).

Finding hygiene ahead of scoring: pattern-class deduplication (corroboration raises confidence, not count), unanchored findings excluded from scoring, unattributed structural/mixer findings capped at STRONG — "potential X" never counts as "X confirmed".

Tiered evidence-weighted scoring: every finding classified HARD / STRONG / SOFT before aggregation. HARD evidence floors the verdict at SEVERE; SOFT evidence alone can never reach HIGH. Methodology version + SHA-256 content hash stamped on every scored result.