Live incidentT+00:41 · evidence set sealed
01
Intake and preservation
An investigator on a call within the hour, evidence frozen before it decays, and the loss scope agreed in writing on day one.
Incident desk open, response inside the hour
Blockchain security,investigations
End-to-end risk management for digital assets, from prevention through to incident response. We trace what moved, name who holds it, and harden the gap it left through.
CleanWatchFlaggedSevere
First-party coverage across 14 chains
- Bitcoin
- Ethereum
- Tron
- Solana
- BNB Chain
- Arbitrum
- Base
- Polygon
- Avalanche
- Optimism
- Litecoin
- Monero
- Cosmos
- Sui
“We had the transaction hashes on day one and no idea what they meant. Rolled had a named endpoint and a filed freeze request before the week was out.”
Why Rolled exists
One question should not cost you eleven open tabs
Explorers, screening vendors, sanctions lists, a spreadsheet nobody trusts and a half-written affidavit. The evidence is in there somewhere. Getting it out is the job we took off your desk.
Block explorer: 0x9f2A…0e17
Analytics platform / cluster view
Screening vendor: risk API
OFAC SDN list (PDF, 1,412 pages)
Sanctions ledger.xlsx
Evidence log: Notion
Affidavit draft v7.docx
Bridge indexer (rate limited)
Exchange compliance thread
Mempool archive query
Counsel call notes
Freeze request: outbox
One practice. From the first suspicious hop to a report your counsel can file.
What you get back
Evidence you can act on, not a dashboard to interpret
Screening, tracing, custody assurance and reporting run as one practice, so the finding that starts as a flag ends as something your counsel can file.
Counterparty exposure
Treasury wallet · 1,204 counterparties
18 flagged of 1,204 screened
Sanctioned mixer, indirect
OFAC2 hops · 340 ETH
Listed service, funds arrived via one intermediary
Unlicensed OTC desk
Flagged1 hop · 88 ETH
No registration in operating jurisdiction
High-risk exchange deposit
Flagged3 hops · 1,410 ETH
Weak KYC tier, account opened 9 days prior
Darknet-adjacent cluster
Watch4 hops · 12 ETH
Attribution medium, monitoring left open
Licensed custodian
CleanDirect · 6,200 ETH
Regulated entity, screening clear
Cluster attribution
We show the heuristics behind every merge, so opposing counsel can test the reasoning instead of just doubting it.
Demixing where it holds
Timing, value and gas analysis across mixer outputs, reported with a confidence figure and never as a certainty.
Cross-chain continuity
Bridges, wrapped assets and swap routers reconciled so value keeps its identity when the chain changes.
Standards implementation
CCSS, ISO 27001 and internal control frameworks taken from gap analysis through to evidenced remediation.
Litigation support
Expert statements, deposition prep and exhibits built to survive challenge on method, not just conclusion.
Continuous monitoring
Dormant hoards and reactivated clusters alert the moment they move, months after the matter goes quiet.
Graph intelligence
The whole flow, one layer at a time
Stack sanctions exposure, cluster attribution and bridge activity onto the same graph until the picture stops being a hunch and starts being a finding.
Entity resolution
Co-spend and behavioural heuristics
Addresses clustered1,284
Named entities6
Confidence, weightedHigh
Jurisdiction mapping
Every endpoint carries the jurisdiction that governs it, so you know which lever is realistically available before you spend on it.
Reproducible method
Each cluster merge and every demix inference is logged with its basis. Anyone competent can re-run the work and land where we did.
Alerting that outlasts the matter
Dormant hoards stay watched after the report ships. When a cluster reactivates months later, you hear about it in under a minute.
How a matter runs
From the first suspicious hop to a filed report
One team carries the matter end to end. Nothing gets handed to a stranger halfway through, and nothing gets lost in the handover.
5 hops62% attributed
02
Tracing and attribution
Hop by hop through peel chains, mixers and bridges until the value lands somewhere with a name attached to it.
Value at loss
$12.1M
Frozen at exchange$5.1M42%
Named, claim pending$3.4M28%
In dormant hoard$2.2M18%
Unrecovered$1.4M12%
03
Recovery position
Where the value actually sits, split by what is frozen, what is claimable and what has genuinely gone. No inflated recovery talk.
Exchange freeze
Filed · acknowledged
Civil claim
Counsel instructed
Criminal referral
Package delivered
04
The lever you actually have
Freeze, civil claim or criminal referral, chosen against the jurisdiction holding the endpoint rather than against wishful thinking.
Three ways in
Prevention, response and everything the regulator asks after
Most firms pick one. Doing all three is what lets the assessment learn from the investigation, and the investigation learn from the last assessment.
Investigation & intelligence
Asset tracing, exploit reconstruction and attribution work that stands up in front of an exchange, an insurer or a court.
Explore
Security assessment & implementation
CCSS-aligned custody reviews, contract and protocol assessments, and the engineering work to close what we find.
Explore
Compliance, consulting & advisory
Licensing, travel-rule and monitoring programmes designed by people who have run the investigations behind them.
ExploreDeliverables
A report your counsel can file, not a screenshot deck
Every engagement ends in one document: what happened, how we know, what it is worth pursuing and what to fix so it does not happen twice.
Matter RLD-2291: Findings
Unauthorised outflow, treasury multisig
Lead investigatorR. Adeyemi
ClientCustodial exchange
Issued14 May 2026
Value at loss
18,420 ETH
Attributed
62%
Hops traced
5
Endpoints named
6
F-01Signer key compromised via a malicious approval
SevereTwo signers approved an unlimited allowance to an attacker-controlled contract already seen in six prior matters.
F-02Two deprovisioned signers retained quorum weight
SevereOffboarding never propagated to the multisig, leaving the effective threshold below the documented policy.
F-03No screening on outbound destinations
FlaggedOutflows were not checked against sanctions or risk lists, so the first mixer deposit raised nothing internally.
The branch you skip is the one that ends the matter
A client came to us three weeks after a theft. They had done the obvious work. Hashes collected, exchange notified, a report filed with the local force. Everything the playbook said to do.
What nobody had done was follow the smallest branch. A single hop carrying under two percent of the value, split off early and written off as noise.
That branch paid a hosting invoice. The invoice carried a name. The name held the rest.
Three weeks of everyone chasing the big number, and the answer sat in the rounding error. So we follow every branch, including the ones that look like nothing, because the one you skip is the one that ends the matter.
Certified expertise
Credentials you can check, not adjectives you have to trust
Every investigator on the bench carries the certifications the industry actually recognises, and the practice re-certifies rather than coasting on the year it qualified.
Chainalysis Investigation SpecialistCIS
Chainalysis Ethereum InvestigationsCEIS
TRM Certified InvestigatorTRM-CI
Certified Financial Crime SpecialistCFCS
ISO/IEC 27032 Lead Cybersecurity ManagerISO 27032
BTA Certified Blockchain Solution ArchitectCBSA
CryptoCurrency Security Standard AuditorCCSSA
Certified Information Systems AuditorCISA
$412MTraced across live matters since 2019
230+Investigations and assessments delivered
14Chains under first-party coverage
31Jurisdictions worked with counsel
Answers
Questions worth asking before you hire anyone
Within hours. The first 24 hours decide how much is recoverable, so intake runs on a duty rota. You get an investigator on a call, a preserved evidence set and the first hop map before the funds finish their initial peel chain.
Constantly. We package findings in the formats agencies and compliance desks actually action: attribution memos, subpoena-ready cluster exhibits and freeze requests with the transaction evidence attached rather than summarised.
No firm can promise recovery, and any that does should worry you. What we do is establish where value went, who controls the endpoint and which lever is realistically open, whether that is an exchange freeze, a civil claim or a criminal referral. Recovery follows from that.
Assessments and advisory run on fixed scopes quoted after a short discovery call. Live incidents start on a retainer against an hourly rate, with the estimate revised the moment tracing tells us how deep the matter goes.
Never. Engagements run under mutual NDA by default, evidence sits in a per-matter enclave, and we will not publish, benchmark or reference your incident without written sign-off.
Yes. Compliance analysts, SOC teams and legal staff take the same curriculum our investigators do, on your own case data where you want it, ending in a graded practical rather than a slide deck.
Something moved that should not have
Tell us what happened. You get an investigator on a call, not a sales sequence, and the first hop map before the day is out.