Automated Crime Detection

Crypto-crime investigation is a first-responder business. When an exchange gets hacked, a bridge gets exploited, or a ransomware group becomes a target, a bounty goes out and the firm that gets to the case first usually gets the work. The problem is that those bounties are scattered across X posts from protocol teams, security researchers, government accounts, and journalists, mixed into a feed that's mostly noise. By the time a case has made it onto Decrypt or The Block, the engagement has been booked.

The client was finding cases the same way everyone else was manually scanning X, asking around in private channels, hearing about big incidents on the news. That meant they were perpetually reacting, and they were missing the smaller cases entirely. They needed a system that watched continuously, separated the signal from the noise, and told them what was worth their attention before the rest of the market saw it.

Ten8.City built Bounty Hunter as an AI-driven intelligence feed that runs every hour, on the hour, and pushes new bounty cases into the client's Slack as structured alerts.

The system casts a wide net across X covering protocol exploits, exchange hacks, ransomware bounties, law enforcement rewards, and community-funded recovery efforts and pulls every recent post that touches the territory. Then AI does two passes that no human team could keep up with at scale. The first pass is filtering: an LLM reads every tweet and discards the noise generic crypto news, software bug bounties, airdrop hype, anything that isn't a real reward attached to a real crime. The second pass is grouping: the same model clusters the surviving tweets into distinct cases, pulling out a title, a 2–3 sentence summary, the bounty amount, and the case status (Active, Claimed, or Unknown).

The output lands in Slack as formatted case cards, ready for the team to triage with a glance — bounty size, status, summary, and source tweets, one click away. A web dashboard mirrors the same view for on-demand searches when the team wants to scan beyond the hourly cycle. A built-in memory layer ensures the same case is never reported twice, even if the underlying tweets keep multiplying.

The result is a private intelligence advantage that compounds with use. The client knows about every bountied crypto crime as it surfaces. Their competitors are still reading the news.