Follow the value until it has a name
Tracing, exploit reconstruction and attribution worked to a standard that survives an exchange compliance desk, an insurer's adjuster and a courtroom.
- Median time to first investigator contact
- < 1 hr
- First hop map on live incidents
- 24 hrs
- Chains with first-party coverage
- 14
- Value traced across live matters
- $412M
What we take on
Most matters arrive as one of these. Several arrive as all of them at once, which is why the same team carries the whole thing.
Asset tracing
Following value through peel chains, mixers, bridges and swap routers until it reaches something with a name and a jurisdiction.
- Cross-chain continuity
- Cluster attribution
- Endpoint identification
Exploit reconstruction
Rebuilding the attack from the chain up: the approval, the call sequence, the state change and the exact moment control was lost.
- Transaction-level replay
- Root cause statement
- Attacker infrastructure map
Attribution & intelligence
Linking on-chain behaviour to off-chain identity through infrastructure reuse, timing patterns and open-source collection.
- Cluster-to-entity linking
- Repeat-offender matching
- Confidence stated, always
Fraud & misappropriation
Rug pulls, insider withdrawals, fake desks and long-con investment fraud, worked to the point where recovery becomes a decision.
- Victim-pool reconciliation
- Insider flow analysis
- Loss quantification
Litigation support
Expert statements, exhibits and deposition preparation from the people who did the tracing, not a summariser reading their notes.
- Expert reports
- Exhibit preparation
- Testimony support
Post-matter monitoring
Dormant clusters stay watched long after the report ships. Movement after twelve quiet months is still movement worth catching.
- Reactivation alerting
- Quarterly position updates
- Median alert under a minute
What actually happens after you call
No black box. You know what stage the matter is at, what it produced and what it costs to keep going.
- 01
Intake, inside the hour
A short call with an investigator, not an account manager. We establish what moved, when it was noticed and which credentials might still be live, because containment and tracing start together.
T+00:00 to T+01:00
- 02
Preserve before it decays
Transaction sets, logs, device artefacts and third-party records are captured and hashed straight away. Everything collected gets a custody entry, because evidence gathered casually is evidence argued away later.
T+01:00 to T+06:00
- 03
First hop map
The initial branch diagram of where value went, with severity attached to each path. Rough by design and delivered fast, so containment decisions are not waiting on a finished report.
Within 24 hours
- 04
Deep trace and attribution
Peel chains unwound, mixer outputs matched where the maths supports it, bridges reconciled and clusters resolved to entities. Every inference is logged with its basis so the work is reproducible.
Days 2 to 14, matter dependent
- 05
Actionable package
Freeze requests to the venues holding value, an attribution memo for counsel and a referral pack for the relevant agency, each in the format that recipient actually processes.
On attribution
- 06
Report and monitoring
The full evidence pack with method, limits and recommendations. Alerting stays on the named clusters afterwards, at no extra charge for the first year.
Close of matter
Confidence stated, never implied
The difference between a useful investigation and an expensive one is intellectual honesty. We separate what the chain proves from what it suggests, and we say which is which in writing.
- Every cluster merge records the heuristic that produced it
- Demixing results carry an explicit confidence figure
- Assumptions and limits are listed before conclusions
- Findings we could not support are reported as unsupported
Confidentiality is the default
Engagements run under mutual NDA, evidence lives in a per-matter enclave with named access only, and nothing about your incident is published, benchmarked or referenced without written sign-off. Most of our best work will never appear on this website.
What people ask before opening a matter
It varies enormously, and anyone quoting you a firm percentage is selling something. What matters more is speed and endpoint quality. Value that reaches a regulated venue while a freeze request is live behaves very differently from value sitting in a self-custodied hoard.
Rarely, but it changes what we can honestly claim. Timing, value and gas analysis often recover a majority of outputs at a stated confidence. We report that confidence plainly instead of presenting a probable link as a certain one.
Yes. Cold matters are slower and the containment window has closed, but attribution work does not expire. Funds sitting still are still traceable, and endpoints that have gone quiet still have owners.
That is what it is built for. Methodology is disclosed, heuristics are named, confidence is quantified and every conclusion traces back to a transaction hash. An opposing expert can re-run the work; that is the point.
The first day decides the rest of it
If value moved in the last twenty-four hours, stop reading and call. Containment and tracing run in parallel, and both get harder every hour.