Community-driven investigations into theft, fraud, and money laundering. Built on five years of public goods work.
Features & acknowledgements
Foundations, funds, and individuals who have donated to the public casework.
Five years of public casework, free for the victims who need it. Available to individuals, exchanges, protocols, and law firms.
Investigations that combine onchain analysis with OSINT to connect the wallets, infrastructure, and identities behind thefts, scams, and laundering operations.
Following stolen funds across chains, bridges, mixers, and exchanges, building the transaction record that holds up under scrutiny.
Working directly with exchanges and stablecoin issuers to freeze stolen assets before they can be cashed out.
Packaging evidence for civil and criminal legal cases and returning frozen funds to victims where possible.
These recent cases span theft, laundering, attribution, freezes, and recovery.
Undercover swaps mapped a $12M+ laundering network handling funds from the 2025 Bybit exploit attributed to DPRK's Lazarus Group; 442K USDT was frozen.
$41M tied to the DSJ Exchange and BG Wealth investment fraud schemes frozen after onchain tracing mapped victim deposits to a shared laundering network.
Two-part investigation attributing the theft of $46M in U.S. Government-held crypto to John Daghita, known online as “Lick.” An arrest and a large recovery of funds followed.
Analysis of a breach exposing an internal payment site used by DPRK-linked operators, offering a rare view into how sanctioned IT-worker earnings move.
Investigation into the $28M exploit of the Bittensor network, tracing the attacker’s consolidation and laundering path after the drain.
After attackers breached a service provider connected to the Central Bank of Brazil and moved proceeds into crypto, rapid tracing led to $5M frozen.
Investigation into $6.5M stolen through social engineering attacks attributed to Ronald Spektor, who was later criminally charged in Brooklyn.
Investigation into a violent UK home invasion in which victims were forced to transfer $4.3M in crypto, traced onchain and fully recovered.
Many cases start with an anonymous tip from the community and end in the public record. What happens in between follows a steady arc: the trail gets traced, funds get frozen where possible, and the evidence is built to hold up in court.
Most cases start with a victim report or community tip: an address, a name, a pattern that keeps repeating.
Onchain flows are mapped hop by hop and matched with offchain evidence until the picture is complete.
Exchanges freeze what can be frozen and attribution puts names on the operation.
Investigations are published openly with the receipts. Some before action is taken, some after, depending on the case.
No IP address or tracking metadata is collected, and contact details are optional. Every submission is read.
