Loading ForensicBlock
Preparing your blockchain forensics platform...
Preparing your blockchain forensics platform...
Glass-box tracing. Sealed evidence. Behavioral typologies — poisoning, peel-chain, layering, wash — that label-only tools miss. The deliverable lands at the subpoena target.
Recovery is a legal action. We are the technical investigative arm that turns an on-chain trail into a defensible target for your counsel's subpoena, freezing order, or disclosure motion.
Ethereum, Polygon, Arbitrum, Optimism, Base, Avalanche, and Tron. Funds that hop chains via bridges are followed; the bridging events become evidence.
When stolen funds arrive at a custodial venue, we surface the deposit address, the timestamp, the amount, and the venue identity — the subpoena target.
Address poisoning, peel chains, layering, wash trading. Patterns a label-only tool misses because they aren't about a label — they're about behavior on the chain.
Send the seed address(es) and a one-paragraph matter context. We run a fast scan, return feasibility within 24 hours.
The full agent fleet runs: Tracer + Analyst + Hunter. Cross-chain, mixers paused honestly, every hop recorded.
When funds arrive at a custodial venue we attribute via OFAC SDN, OpenSanctions, and on-chain heuristics — every label sourced.
Court-ready PDF + JSON evidence bundle. Your counsel takes it to the venue, the court, the freezing-order application.
The incumbents win on label coverage of known venues. We win on the BEHAVIOR — patterns that signal laundering or theft regardless of whether the address has been labeled yet.
Adversary mints a near-identical address (same prefix + suffix) into the victim's transaction history, hoping a future copy-paste sends funds to the impostor. We detect the dust transaction, flag the lookalike pair, and document the attempt as evidence.
Funds peeled into many small transactions to obscure the principal. We cluster the peel by timing + amount + downstream consolidation and reconstruct the parent flow.
Multi-hop reshuffling across wallets to break a forensic trail. We follow through the layering depth, document each hop's tx hash + block, and identify the consolidation back to a single beneficial owner.
Self-dealing on DEXes / OTC to fabricate volume or obscure provenance. We flag the closed-loop pattern and surface the venue + counterparty.
Funds bridged cross-chain to break the forensic trail. We surface the canonical bridge event, the destination address on the target chain, and continue the trace on the other side.
When funds enter Tornado Cash or a similar privacy mixer, the trace pauses — and we say so. Where post-mixer probabilistic re-attribution is possible, we surface it as a stated-confidence finding, never as certainty.
What we promise — and what we don't.
How we package for self-authentication — and the explicit line that authentication is not admissibility.
Deterministic methodology, versioned and content-hashed — same address, same version, same result.
The self-hashed evidence envelope a defense expert can use to reproduce and challenge the work.
Send one address from the matter — we trace it and return a sealed, court-ready packet for free. Single-matter investigations are then scoped per matter on a Statement of Work, a fraction of the per-seat annual contract enterprise incumbents charge. We scope the fee in conversation, sized to the chains involved, the mixer hops, and the report scope.
Free preliminary trace, then scoped per matter on a Statement of Work — a fraction of the per-seat annual contract enterprise incumbents charge. Engagement fee set in conversation.
Free preliminary trace · scoped per matter after