We turn blockchain intelligence into evidence.
Bring what you already have — a report from any blockchain-intelligence platform, an exchange's subpoena return, a reviewer's spreadsheet — or trace it here with six forensic agents. It arrives as evidence: typed by source, hashed on receipt, custody from the moment you received it. It leaves as an exhibit: Bates-labelled, signed by a named examiner, and verifiable by the other side without an account.
Any intelligence in · Bates-labelled exhibits out · Custody from the moment your firm received it
What we are
Blockchain discovery & forensics.
The exhibit is the product.
Keep the intelligence platform you already pay for — we are the layer it hands off to, not the one it competes with. Its strength is knowing what an address is; ours is making what it knows produceable: received with custody, reconciled against the exchange's subpoena return, Bates-labelled, examiner-signed, and verifiable by the other side without an account. The platforms find the answer. We make it evidence.
Chain of custody
Every finding SHA-256 hash-linked into an append-only audit log. Tamper-evident across the matter lifecycle.
Examiner declaration
An examiner of record reviews, applies honest limitations, and signs the certification block.
FRE 902(13)/(14)
Packaged for self-authentication of electronically generated records — court-ready, never over-claimed.
Public verifier
Opposing counsel opens the seal in a browser, no account, and confirms it themselves.
Your matter already knows where the money went.
None of that knowledge is evidence yet.
In a crypto matter, what you know lives in three places: the intelligence platform's report, the exchange's subpoena return, and your own reviewer's spreadsheet. Discovery surfaces the wallet address; the tracing happens somewhere else; the answer comes back as a PDF somebody has to vouch for. The round trip never closes — and until it does, the matter is holding intelligence, not evidence.
Lost to crypto fraud in 2024 — reported to the FBI's IC3, up 66% in a single year. The matters are coming either way.
Where a matter's knowledge of the money lives today — a vendor's platform, an exchange's production, an analyst's working file. Each in its own format, none with custody.
What a court accepts: one produceable record — Bates-labelled, custody from receipt, checkable by the other side.
Closing that gap is the whole company. The workflow below is how.
Intelligence in.
Evidence out.
Four acts, in the order a matter runs them. Bring a vendor's report, an exchange's response, a government record, or your reviewer's own spreadsheet — or have our agents run the trace as one source among the rest.
Receive
It arrives as evidence, not as an upload — typed by source, hashed before anything parses it, custody recorded from the moment your firm received it, with privilege and licence captured.
Validate
Deterministic engines compute every load-bearing figure behind a published, versioned methodology. Where two sources disagree, the record states the disagreement rather than resolving it quietly.
Label
One exhibit, Bates-numbered, with a findings register anchored finding by finding and a limitations section that names what would have to be untrue for the conclusion to change.
Produce
The sealed exhibit, a hash manifest and a load file — the shape a production actually takes — plus a link the other side opens with no account to check it against our record.
Receive — the matter's intake register · Validate — every claim re-derived against the chain · Label — Bates + the exhibit register · Produce — sealed PDF, hash manifest, load file, public verifier
The ForensicBlock Protocol
Every source that enters this platform — a client's records, an exchange's subpoena return, an intelligence platform's export, or a trace we run ourselves — is put through one published method, and the method is the product. It is what makes two examiners, working the same material on different days, produce the same exhibit: the same custody record, the same figures, the same anchors, the same disclosed limits.
Custody begins at receipt
Nothing is held as a file. Every item is typed by source with the custodian who supplied it and the authority we hold it under, and its SHA-256 is computed on the original bytes before anything parses them.
Check it on the acquisition register
Numbers come from engines, never from a model
Every load-bearing figure in an exhibit is computed deterministically. Language models read and draft; they do not produce a number that reaches a court.
Check it on the derivation transcript
The method carries a version and a hash
The methodology in force is stated on the exhibit (v1.7.6), frozen by content hash, and changed only through a published changelog — so a record can be re-scored under the method that produced it rather than under today's.
Check it on the methodology stamp
Each finding carries its own anchor
A finding is admitted to the record only with an evidence anchor a reader can recompute from the inputs recorded beside it. An unanchored observation is disclosed as a diagnostic and excluded from scoring.
Check it on the findings register
A disagreement is stated, not resolved quietly
Where two sources conflict — a claimed figure against the chain, a catalog against a designation, one window against another — the exhibit reports both and names the delta. Silence is never used to make a record look cleaner than it is.
Check it on the concordance and the limitations section
A failed check is never a clean result
A lookup that could not run is recorded as not run. It is never rendered as an absence of risk, an empty list, or a zero — the one direction of error a forensic record cannot take.
Check it on every withheld figure on the exhibit
This is our published method, not an industry standard and not a certification — no body accredits anyone against it, ourselves included. We publish it so the derivation can be checked and re-run, not to imply an endorsement we do not have.
Not a black-box label.
Evidence you can defend.
The intelligence platforms sell the label. We seal the exhibit. Every finding is cryptographically anchored, methodology-versioned, and chained into an append-only audit log — independently checkable, FRE 902(13)/(14) ready. Opposing counsel verifies the packet in a browser without an account. That's the difference between an answer and evidence.
Numbers we publish, you verify. Every value above is independently checkable —read the raw feed ↗
What holds at any scale.
Not a catalog-size contest we would rather not have. These are properties of the method and the exhibit — open the matrix, the raw feed, or a sealed record and check any of them.
Proof, not claims
The incumbents gate their incident analysis.
We publish ours — check it yourself.
See the full registry Bybit Theft Proceeds (FBI PSA I-022625-PSA)
Bybit exchange theft, February 2025 (DPRK TraderTraitor / Lazarus Group)
Bybit Exploiter (DPRK / Lazarus Group)
Bybit cold-wallet theft — the largest crypto theft on record
KyberSwap Exploiter (alleged: A. Medjedovic)
KyberSwap liquidity-pool exploit
Euler Finance Exploiter
Euler Finance flash-loan exploit
Wormhole Bridge Exploiter
Wormhole token-bridge exploit
Poly Network Exploiter 1
Poly Network cross-chain exploit
Every entry cites the primary sources — FBI/IC3, court filings, Etherscan, Chainalysis, TRM — and states verbatim what the public record does and does not establish. Paste any of these addresses into the free checker and confirm it against the chain yourself.
Six forensic agents.
The chain of evidence, end-to-end.
When you’d rather we ran the trace than bring one — or the matter needs a record built from the chain itself — the fleet builds it in-house. Each agent contributes a step in the forensic record — not an investigation step, a custody step. Tracer reconstructs the fund flow. Sentinel authenticates sanctions hits. The Examiner attributes entities. Hunter maps the subpoena target. The Custodian watches it 24/7. The Sealer Bates-stamps the exhibit. You walk out with a sealed, FRE 902-packaged packet a court can verify.
Reconstructs the on-chain trail through mixers, bridges, and exchanges — a hop-by-hop record of custody.
OFAC + Tron/TRC-20 hits, each carrying its named source — attribution that holds on cross.
Clusters entities and detects layering / structuring — every cluster sources its heuristic. No black-box labels.
Maps subpoena targets and the deposit address you can name on a freezing-order application.
24/7 immutable monitoring — webhook the instant a watched address moves, sealed to the audit chain.
Bates-stamps the exhibit. SHA-256 sealed, FRE 902(13)/(14) packaged, opposing-counsel-verifiable.
Any chain your intelligence covers.
Traced in-house on 7.
Evidence production is chain-agnostic: whatever chain your vendor's report, the exchange's subpoena return, or your reviewer's working file concerns, it is received, hashed, held with its custody, and produced the same way. When you'd rather we did the tracing, our own six-agent trace runs on 7 networks today — Ethereum, Tron, Bitcoin, Arbitrum, Polygon, Optimism, Base — and sanctions screening reaches further still, across 22 networks. Stablecoins — USDT, USDC, DAI — are screened on every live EVM network.
OFAC + multi-authority sanctions, on every supported chain.
Verify a sealed report yourself. No account.
Opposing counsel, a court clerk, or a jury member can independently verify a ForensicBlock seal from a browser — Merkle root, hash chain, methodology version, anchor state. Paste a hash and check it now — no account, nothing to take on faith.
Paste a sealed report's Merkle root or evidence SHA-256, or use a sample. Open the verifier · Read the methodology
We never slap a “verified” badge on a record you haven’t checked. Each anchor renders its own honest state per report — SHA-256 sealed, RFC 3161 timestamped, and Bitcoin-anchored via OpenTimestamps — confirmable on the public verifier.
Seal your first court-ready record.
Free. Verifiable. Defensible.
Bring one address from a live matter. The forensic agent fleet produces the record — chain of custody, examiner declaration, FRE 902(13)/(14) packaging — and you walk out with a sealed packet opposing counsel can verify from a browser without an account.