The fifth proxy hop resolution had given Dylan the destination address of the Miller Global data siphon.
It had taken three additional days of ORACLE work to convert the destination address into something actionable — the address itself was a server cluster, not a person, and what Dylan needed was the person. But ORACLE's sustained analysis of the server cluster's operational patterns had produced a fingerprint: a usage pattern, a maintenance schedule, a specific way of interacting with the data it received that was as distinctive as a handwriting sample.
He compared the fingerprint against every known digital signature in ORACLE's database.
The match came back at eighty-seven percent confidence to a server management methodology that had appeared in three previous federal cybercrime investigations — all three connected to financial crime operations with Eastern European organizational links.
Not a conclusive identification of a person. But a conclusive identification of an operational method. And operational methods, used repeatedly, led to people.
Dylan expanded the search.
He had been at Nexus for eighteen hours when Maggie arrived at seven Wednesday morning with coffee and the expression she wore when she had something.
"The Nassau contact," she said.
He looked up from his screens. "The Cayman disclosure."
"They found something additional. Beyond the beneficial owner confirmation." She put a folder on his desk — she was printing things again, which meant they were important. "The Meridian Financial account has a co-signatory. A secondary authorized operator who was added to the account fourteen months ago."
Dylan opened the folder. He read the name.
He read it again.
"Agent Carl Ruiz," he said.
Maggie nodded. "The FBI agent on Sorokin's payroll. He's not just redirecting federal investigations. He's a beneficial co-operator of the financial infrastructure he's supposed to be investigating."
Dylan thought about what this meant. Ruiz wasn't just a corrupt agent protecting the network from law enforcement. He was inside the network's financial structure — which meant his corruption wasn't recent and wasn't peripheral. He had been integrated into the Phantom Syndicate's operation for at least fourteen months, probably longer.
"Walsh," Dylan said.
"Yes."
"This changes the nature of what Walsh needs to do about Ruiz. It's not just redirecting investigations. It's active criminal participation."
"The charges go from corruption to racketeering."
"Yes." Dylan pulled the co-signatory documentation into the ORACLE evidence package. "This is actually good news. A racketeering charge is harder to plea down than corruption. Ruiz has less leverage than he thinks he has."
"Is that how Walsh will see it?"
"Walsh is a very good agent. Yes. That's how she'll see it."
He called Walsh immediately. She answered on the second ring — she had been, he understood, operating on a compressed schedule since the interview had aired and the political and criminal pressure had begun to accelerate.
He gave her the Ruiz co-signatory information. She was quiet for three full seconds, which from Walsh was a significant pause.
"How solid is this?" she asked.
"Cayman regulatory disclosure. Obtained through a legitimate compliance verification request. Completely clean."
"I can use this."
"I know."
"Dylan. When I move on Ruiz — it has to be simultaneous with the other elements. If I take Ruiz down before Voss is exposed, Voss's people will know the financial infrastructure has been penetrated and they'll move assets before we can freeze them."
"Understood. How long do you need for the simultaneous operation?"
"Five days. Maybe four if the Voss Ethics filing happens on schedule."
"Sophia files Thursday. That's tomorrow."
"Then I can move on Ruiz Monday."
"Monday," Dylan confirmed. "I'll coordinate with Marc and James on the physical security picture."
He ended the call. He turned back to his screens.
The fifth proxy hop's operational fingerprint was still running its comparison search. ORACLE was patient — it didn't need encouragement or rest, and it didn't abandon threads because they were taking longer than expected.
At nine-seventeen Wednesday morning, the search produced a result.
The fingerprint matched, at ninety-one percent confidence, a known associate of the Sorokin Network's technical operations division. A man named GREGOR VASH, forty-four, Estonian, who appeared in international law enforcement databases as a technical specialist connected to three Eastern European cybercrime operations. He had not been prosecuted — he was skilled enough and careful enough to remain one step outside direct criminal attribution.
He was not careful enough for ORACLE.
Dylan documented the identification. He added it to the evidence package with the source methodology clearly noted — ORACLE's pattern-matching analysis of publicly observable server management behavior, cross-referenced against law enforcement database signatures.
Lang would review it. If Lang said it was admissible, Walsh would have the technical operator of the Miller Global data siphon.
He called Marc.
"The data siphon. I have the technical operator. His name is Gregor Vash. He's Sorokin's man."
Marc: "Direct connection to Sorokin."
"Yes. The siphon on Miller Global's financial systems was a Sorokin Network operation. Reyes provided the political cover through Voss. Sorokin ran the technical operation. Hargrove designed the architecture. Blake was the inside man."
"The full chain."
"The full chain."
A pause. "Dylan. That's everything."
"That's the financial chain, yes. The operational chain — the physical operations, the Newark facility, the trafficking routes — that's Kovalenko."
"Kovalenko's information combined with the financial chain gives Walsh everything she needs for the simultaneous operation."
"Yes."
"How long to prepare the Kovalenko extraction?"
"James says three days of planning. He wants to move on Thursday or Friday."
"Tell him Thursday. I want Kovalenko secured before Monday's operation."
"I'll tell him."
Dylan ended the call. He looked at his screens — the complete evidence package, assembled over three weeks of continuous work, representing the most comprehensive piece of intelligence analysis he had ever produced.
He thought about what it had cost. Not in terms of work — he was comfortable with the work. In terms of what the work had required him to know and to carry.
He thought about his mother's name in the network map. He thought about what it meant to build a system powerful enough to find the truth and to find a truth this particular.
He thought about the first morning he had sat in this server room and found the anomaly in Miller Global's data traffic — a deviation so small that any other system would have missed it. He thought about how different the world had looked from that point, and how different it looked now.
He thought: we're going to win.
Not in the way of someone who was certain of an outcome. In the way of someone who had done everything that could be done and understood that this was enough.
He turned back to the screens. There was still work.
There was always still work.
At eleven o'clock Wednesday night, ORACLE flagged something new.
Not a new threat — a new piece of intelligence from the communication pattern analysis on Voss. The senator's Phantom Syndicate communication channel had gone significantly more active in the past forty-eight hours — a sharp increase in traffic volume following Eleanor's interview.
Dylan read the traffic pattern. It was not panic — it was coordination. Multiple communication events with multiple Syndicate nodes, in a pattern that suggested a meeting rather than an emergency.
He ran the pattern against ORACLE's meeting signature database — the specific communication patterns that preceded in-person meetings between criminal network operatives.
The match was strong.
"ORACLE," he said. "Hypothesis: the increased traffic represents preparation for an in-person coordination meeting among Phantom Syndicate principals. Time frame?"
The system processed.
Estimated meeting window: 48–96 hours from current timestamp.
Dylan looked at the result. A Phantom Syndicate coordination meeting in the next two to four days. Voss, almost certainly. Reyes's representatives, probably. Sorokin's people, possibly.
He called Marc immediately. It was nearly midnight.
Marc answered on the first ring.
"The network is calling a meeting," Dylan said. "ORACLE puts it in the next two to four days. They're responding to Eleanor's interview."
Silence. Then Marc: "They're scared."
"They're organizing. Whether that's the same as scared depends on what they're organizing for."
"Can you identify the meeting location?"
"Working on it. The communication pattern suggests it'll be somewhere that isn't directly connected to any of the principals. A buffer location."
"I need to know where it is."
"I know."
"Dylan — if we know where they're meeting, we have an opportunity."
"An opportunity for what?"
A pause. When Marc spoke, his voice was careful and precise — the voice he used when he had thought something through completely. "To listen. Legally. In a way that Walsh can use."
"You want to surveil the meeting."
"I want Walsh to surveil the meeting. Legally. With the appropriate authorization."
"Walsh needs probable cause and a warrant for that kind of surveillance."
"The ORACLE communication pattern analysis plus the existing case documentation — is that enough for probable cause?"
Dylan thought about it. "With Lang's structuring of the application — yes. Probably yes."
"Then we need Lang and Walsh on the phone tonight."
"It's midnight."
"I know what time it is."
Dylan called Lang. Lang answered, because Lang answered at midnight when Dylan called, which was one of the many reasons Edward Miller had spent twenty-five years trusting Victor Lang with his most important matters.
"We need a warrant application," Dylan said. "Tonight."
Lang: "Tell me."
Dylan told him.
Lang was quiet for a moment. Then: "Get Walsh on the line."
Dylan added Walsh to the call.
The three of them worked through the night.