Intake standard v 4.2 · Apr 2026
Coverage 100+ chains · multi-stack
Posture Verified-truth-only
Response 24h initial review
Evidence-first intake

Blockchain Forensics & Asset Tracing

If digital assets were moved without authorisation, the first requirement is a traceable record of movement and a conservative decision on what can be verified.

One intake standard for victims, counsel, and compliance: traceable facts, documented movement, and explicit verification boundaries.

Initial review starts from traceable facts only
Audience routing 03 ROUTES · 01 PIPELINE

Choose your intake route

One intake standard, three route variants. High-resolution trace data via the same core pipeline.

Individual incident intake

Preserve evidence, verify first-hop movement, and separate viable matters early.

For victims who need an immediate, conservative read on whether on-chain movement can still be documented and escalated.

Operating posture Compliance & capability
OFAC SDN compliance
Sanctions screening
Chainabuse network member
Cross-platform reporting
IC3 (FBI) submission registered
Federal channel
GDPR-compliant intake
EU/UK data posture
100+ blockchains
Multi-chain coverage
AEGIS Protocol
Verified-truth-only
AEGIS
0x4f3a8c2e1b9d7a6f5e4c3b2a190876d5e4c3b2a1
0x8a7b6c5d4e3f2918273645546372819aabbccdd
0xc9b8a7968574635241302f1e0d0c0b0a09080706
0x1e2d3c4b5a6978899a8b7c6d5e4f3a2b1c0d0e0f
0xf0e1d2c3b4a596877665544332211002f4e5d6c7
§ II · Method & Credentials

How we work — disclosed before the engagement begins.

DOC · CLW-MTH-002
REV · 2026.04
PAGES · 03 / 03
A · Methodology

AEGIS Protocol

Verified-truth-only

Outputs distinguish observed movement from inference. Every claim is tagged with the verification standard that supports it. No guaranteed recovery, no speculative attribution — what is verified is verified, and what isn't is named explicitly.

Standard AEGIS v 4.2 Output Forensic record Posture Conservative
B · Infrastructure

Multi-chain forensic stack

100+ blockchains under coverage

Tracing across EVM, Bitcoin and UTXO chains, Solana, Tron, Lightning, and major L2 rollups. Cross-stack reconciliation for bridge hops, mixers, and exchange off-ramps. Methodology disclosed at the engagement boundary so counsel can re-derive findings.

Coverage 100+ chains Surfaces L1 · L2 · UTXO Disclosure Method-open
C · Operators

Operator background

Counsel-grade reporting

Operators with prior experience producing forensic records for civil action, exchange compliance, and federal-channel escalation. Submission registered with IC3 (FBI), Chainabuse network member, OFAC SDN screening on inbound flows. GDPR-compliant intake for EU/UK matters.

Channels IC3 · Chainabuse Screening OFAC SDN Data posture GDPR

Services

Scoped to case facts, jurisdiction, and counterparty response speed. We do not promise recovery outcomes.

Enterprise
Exchange Hack Investigation
Comprehensive forensic analysis for institutional security incidents and post-exploit attribution.
Recovery
Individual Asset Recovery
Professional tracing services for fraud victims and stolen funds. Verified movement, no speculation.
Compliance
AML / CTF Compliance
Transaction monitoring, sanctions screening, and regulatory compliance reporting for digital asset businesses.
Legal
Expert Witness Services
Blockchain expertise for legal proceedings, civil action, and arbitration. Chain-of-custody documentation prepared for counsel.
What Clients Receive

24–72h Delivery Window

Deliverables are scoped to case facts, jurisdiction, and counterparty response speed.

4–24h
Rapid Triage Memo
Initial traceability assessment, immediate preservation actions, and escalation route recommendations.
Forensics
Fund Trace Report
Multi-hop flow map, typology observations, and prioritised counterparties for next action.
Interdiction
Freeze Coordination Pack
Counterparty-ready packet with wallet set, transaction references, chronology, and supporting exhibits.
Legal
Counsel / LE Referral Pack
Chain-of-custody declaration, evidence index, and technical appendix prepared for secure handoff.
Timelines vary by chain visibility, data quality, and third-party cooperation.
TRINITY 3.1 GOLD

Institutional-Grade Operating Capabilities

Public-safe summary. Full methodology and sensitive workflow details are disclosed only under engagement.

Graph-based fund flow analysis and case linkage
24/7 monitored watchlists and movement alerts
Multi-chain tracing across major L1/L2 ecosystems
Sanctions and exposure screening integrated into triage
Chain-of-custody-ready evidentiary documentation
Counterparty coordination workflows (exchange / issuer / counsel)
0x9f8e7d6c5b4a3928172635445566778899aabbcc
0x2a3b4c5d6e7f8091a2b3c4d5e6f70819abcdef01
0x7e6d5c4b3a2918073645546372818faabb112233
0xcdef0123456789abcdef0123456789abcdef0123
Verified Investigations

Case Portfolio

Real investigations. Verified on-chain. Identities redacted for client confidentiality.

$25M Traced
2026 | Ethereum
Exchange Hack: $25M Dormant ETH
Identified 9,154 ETH from an insider exploit dormant for 181+ days. Mapped full laundering chain through Tornado Cash and relay wallets. Delivered CEX freeze coordination playbook.
MONITORING
$149M Mapped
2026 | TRON
Terrorist Financing: IRGC TRON Cluster
Mapped 21 addresses in an OFAC-sanctioned IRGC network (ZEDCEX Exchange, Entity #56865). Traced $149M in USDT flows including a $95M unattributed OTC desk.
OFAC DESIGNATED
573 ETH Traced
2026 | Multi-chain
DeFi Exploit: Cross-Chain Bridge
Traced 573 ETH from a cross-chain bridge exploit across 3 chains. Identified attacker consolidation patterns and alerted exchanges before conversion. Evidence delivered to LE.
CLOSED
Start Here

Choose Your Lane

Use the direct lane if you already have wallets, TXIDs, or a known cluster. Choose the route that matches your role.

Victim
Victim Trace Lane
Single incident, scam platform, or wallet already identified. We map the first-hop and assess traceability.
Open Trace Lane
Professional
Professional Intake
Counsel, exchange, compliance, or multi-trace case material. Structured intake with methodology disclosure.
Open Professional Lane
Verified
Known Cluster Alert
Case matches Bidatabox, Lazarus/Bybit, CrossCurve, or 1xBet indicators. Check active cluster alerts.
Open Verified Alerts

Qualified cases above $25,000 may be scoped under contingency; smaller matters may require an assessment fee. Choose the lane that matches your role. We do not guarantee fund recovery.