We turn blockchain intelligence into evidence.
Bring what you already have — a report from any blockchain-intelligence platform, an exchange's subpoena return, a reviewer's spreadsheet — or trace it here with six forensic agents. It arrives as evidence: typed by source, hashed on receipt, custody from the moment you received it. It leaves as an exhibit: Bates-labelled, signed by a named examiner, and verifiable by the other side without an account.
Any intelligence in · Bates-labelled exhibits out · Custody from the moment your firm received it
What we are
Blockchain discovery & forensics.
The exhibit is the product.
Keep the intelligence platform you already pay for — we are the layer it hands off to, not the one it competes with. Its strength is knowing what an address is; ours is making what it knows produceable: received with custody, reconciled against the exchange's subpoena return, Bates-labelled, examiner-signed, and verifiable by the other side without an account. The platforms find the answer. We make it evidence.
Chain of custody
Every finding SHA-256 hash-linked into an append-only audit log. Tamper-evident across the matter lifecycle.
Examiner declaration
An examiner of record reviews, applies honest limitations, and signs the certification block.
FRE 902(13)/(14)
Packaged for self-authentication of electronically generated records — court-ready, never over-claimed.
Public verifier
Opposing counsel opens the seal in a browser, no account, and confirms it themselves.
Your matter already knows where the money went.
None of that knowledge is evidence yet.
In a crypto matter, what you know lives in three places: the intelligence platform's report, the exchange's subpoena return, and your own reviewer's spreadsheet. Discovery surfaces the wallet address; the tracing happens somewhere else; the answer comes back as a PDF somebody has to vouch for. The round trip never closes — and until it does, the matter is holding intelligence, not evidence.
Lost to crypto fraud in 2024 — reported to the FBI's IC3, up 66% in a single year. The matters are coming either way.
Where a matter's knowledge of the money lives today — a vendor's platform, an exchange's production, an analyst's working file. Each in its own format, none with custody.
What a court accepts: one produceable record — Bates-labelled, custody from receipt, checkable by the other side.
Closing that gap is the whole company. The workflow below is how.
Intelligence in.
Evidence out.
Four acts, in the order a matter runs them. Bring a vendor's report, an exchange's response, a government record, or your reviewer's own spreadsheet — or have our agents run the trace as one source among the rest.
Receive
It arrives as evidence, not as an upload — typed by source, hashed before anything parses it, custody recorded from the moment your firm received it, with privilege and licence captured.
Validate
Deterministic engines compute every load-bearing figure behind a published, versioned methodology. Where two sources disagree, the record states the disagreement rather than resolving it quietly.
Label
One exhibit, Bates-numbered, with a findings register anchored finding by finding and a limitations section that names what would have to be untrue for the conclusion to change.
Produce
The sealed exhibit, a hash manifest and a load file — the shape a production actually takes — plus a link the other side opens with no account to check it against our record.
Receive — the matter's intake register · Validate — every claim re-derived against the chain · Label — Bates + the exhibit register · Produce — sealed PDF, hash manifest, load file, public verifier
Not a black-box label.
Evidence you can defend.
The intelligence platforms sell the label. We seal the exhibit. Every finding is cryptographically anchored, methodology-versioned, and chained into an append-only audit log — independently checkable, FRE 902(13)/(14) ready. Opposing counsel verifies the packet in a browser without an account. That's the difference between an answer and evidence.
Numbers we publish, you verify. Every value above is independently checkable —read the raw feed ↗
Numbers you can verify, not numbers we made up.
Every value is fetched from a public endpoint when this page renders.
Proof, not claims
The incumbents gate their incident analysis.
We publish ours — check it yourself.
See the full registry Bybit Theft Proceeds (FBI PSA I-022625-PSA)
Bybit exchange theft, February 2025 (DPRK TraderTraitor / Lazarus Group)
Bybit Exploiter (DPRK / Lazarus Group)
Bybit cold-wallet theft — the largest crypto theft on record
KyberSwap Exploiter (alleged: A. Medjedovic)
KyberSwap liquidity-pool exploit
Euler Finance Exploiter
Euler Finance flash-loan exploit
Wormhole Bridge Exploiter
Wormhole token-bridge exploit
Poly Network Exploiter 1
Poly Network cross-chain exploit
Every entry cites the primary sources — FBI/IC3, court filings, Etherscan, Chainalysis, TRM — and states verbatim what the public record does and does not establish. Paste any of these addresses into the free checker and confirm it against the chain yourself.
Six forensic agents.
The chain of evidence, end-to-end.
When you’d rather we ran the trace than bring one — or the matter needs a record built from the chain itself — the fleet builds it in-house. Each agent contributes a step in the forensic record — not an investigation step, a custody step. Tracer reconstructs the fund flow. Sentinel authenticates sanctions hits. The Examiner attributes entities. Hunter maps the subpoena target. The Custodian watches it 24/7. The Sealer Bates-stamps the exhibit. You walk out with a sealed, FRE 902-packaged packet a court can verify.
Reconstructs the on-chain trail through mixers, bridges, and exchanges — a hop-by-hop record of custody.
OFAC + Tron/TRC-20 hits, each carrying its named source — attribution that holds on cross.
Clusters entities and detects layering / structuring — every cluster sources its heuristic. No black-box labels.
Maps subpoena targets and the deposit address you can name on a freezing-order application.
24/7 immutable monitoring — webhook the instant a watched address moves, sealed to the audit chain.
Bates-stamps the exhibit. SHA-256 sealed, FRE 902(13)/(14) packaged, opposing-counsel-verifiable.
Any chain your intelligence covers.
Traced in-house on 7.
Evidence production is chain-agnostic: whatever chain your vendor's report, the exchange's subpoena return, or your reviewer's working file concerns, it is received, hashed, held with its custody, and produced the same way. When you'd rather we did the tracing, our own six-agent trace runs on 7 networks today — Ethereum, Tron, Bitcoin, Arbitrum, Polygon, Optimism, Base — and sanctions screening reaches further still, across 22 networks. Stablecoins — USDT, USDC, DAI — are screened on every live EVM network.
OFAC + multi-authority sanctions, on every supported chain.
Verify a sealed report yourself. No account.
Opposing counsel, a court clerk, or a jury member can independently verify a ForensicBlock seal from a browser — Merkle root, hash chain, methodology version, anchor state. Paste a hash and check it now — no account, nothing to take on faith.
Paste a sealed report's Merkle root or evidence SHA-256, or use a sample. Open the verifier · Read the methodology
We never slap a “verified” badge on a record you haven’t checked. Each anchor renders its own honest state per report — SHA-256 sealed, RFC 3161 timestamped, and Bitcoin-anchored via OpenTimestamps — confirmable on the public verifier.
Seal your first court-ready record.
Free. Verifiable. Defensible.
Bring one address from a live matter. The forensic agent fleet produces the record — chain of custody, examiner declaration, FRE 902(13)/(14) packaging — and you walk out with a sealed packet opposing counsel can verify from a browser without an account.