From a wallet address and a threatening message to a real name and location. Two trails run in parallel, both fully documented, and they hand off to the people with the power to act.
He demands payment to a USDT address, and he has to contact the victim to do it. That gives us two threads to pull, whether the address is old or brand new.
Identify the blockchain and pull the full transaction history. It's public and permanent, nothing can be hidden or deleted.
Map every hop, in and out, including the victim's payment. Laundering through several addresses stays visible on-chain.
Trace it until it lands at a regulated exchange to cash out.
However he reaches the victim (WhatsApp, Telegram, email) is a lead the coin can't hide.
A PDF or image with an invisible beacon. When he opens it, it quietly reports his IP, location, and device. Passive, not malware.
His number, username, and email get cross-referenced across platforms and data to build who he is.
Screenshots, the trace graph, the exchange touchpoint, the database hits, the canary results, all timestamped, with the method written out so it holds up.
They can freeze the funds, pull his identity from the KYC records, and move on him. We build the receipts, they make the arrest.
Do not actually pay him to trace it (you don't need to, and it just funds him and brings more demands). No vigilante moves. We gather evidence and route it to the authorities. That's what keeps you clean and makes them act.