Every capability offered here was proven in public first: the investigations, freezes, and legal outcomes are on the record for anyone to check. ZachXBT is now taking on a limited number of paid engagements built on that same standard of work.
Incident response, investigation, threat intelligence, expert reports, recovery coordination, and advisory: each offered to a small number of counterparties at a time.
Tracing while funds are still moving: mapping stolen assets across chains, bridges, and mixers, notifying exchanges and issuers, and coordinating freezes.
Investigations that connect onchain flows with OSINT and offchain evidence (infrastructure, accounts, payment records) until the operators behind an incident are identified with confidence.
Monitoring and indicators drawn from active casework, covering laundering infrastructure, DPRK activity, The Com patterns, and drainer networks.
Evidence packages, declarations, and expert analysis built to the standard that has already held up in civil and criminal cases.
Turning freezes into returns: working with victims' counsel, exchanges, and issuers to get recovered funds back to the people who lost them.
Counterparty and protocol reviews, laundering-exposure assessments, and guidance on handling incidents before they become losses.
Engagements are structured so the findings stay independent of who is paying.
Engagements that would compromise active public-interest casework, or require sitting on findings the public should see, are declined.
A small number of engagements at a time, so every case gets the same depth as the published work.
Engagements buy time and expertise. The analysis follows the evidence wherever it leads.
Published investigations and victim recovery remain central to the work.
Outline the situation and the timeline. Conflicts are checked before anything is discussed in depth, and time-critical incidents with funds actively moving are prioritized.
