Trace it, expose it, document it
Five practices. Three of them are the kind of case you bring us; the other two run through every case we take.
Follow the money to wherever it actually stopped
Funds taken from a person or a protocol. We start at the theft transaction and work forward through swaps, bridges, mixers, peel chains and consolidation. The output is a path with a hash for every hop, not a picture of a graph.
Establish what the operation actually is
Scam operations look legitimate from the outside and near-identical to each other underneath. We map the wallets behind the front end, size the victim pool, trace who was paid to promote it, and set out how the thing works.
How the proceeds get washed, stage by stage
Laundering is a process with a signature: mixers, bridge loops, peel chains, swap cycles, OTC desks and P2P cash-out. We document the method and not only the destination, because the method is what makes the next case recognisable.
Who is behind the addresses
Chain data tells you where value went, never who moved it. Attribution comes from the mistakes people make around the edges: reused deposit addresses, recycled handles, names said out loud on calls, activity that lines up too neatly to be coincidence.
Written so it survives being checked
A trace is only worth what it can support later: a police report, a civil claim, an exchange escalation, an insurance file. We write for the person who will try to poke holes in it.
The surfaces a case actually touches
Tracing is one part. A case moves because the right people receive the right document.
Send us what you have
An address, a platform, a name, or just what happened. We will tell you what can be established, how far, and whether paying us is worth it.