The first 48 hours can decide the case.
When a hack or theft is live, speed matters. We triage, trace the funds while they're still moving, and prepare the preservation and freeze requests counterparties need to evaluate urgent action.
An engagement starts with scoped triage — we tell you quickly what is and isn't feasible. No freeze or recovery is ever guaranteed. Never share a private key or seed phrase with anyone, including us.
What we do in a live incident
From the first call to a monitored, documented case — with a named responder approving every external action along the way.
Rapid triage
Confirm the incident, the assets and chains involved, and the initial theft path — and begin time-sensitive tracing as fast as the engagement allows.
Follow the money live
Track funds toward bridges, swaps, and exchange endpoints while movement is still under way.
Preservation & freeze
Draft the preservation and freeze requests exchanges and counterparties need to evaluate action.
Counterparty coordination
Reach the right compliance contacts with a package they can move on quickly.
Evidence capture
Lock down a tamper-evident record while it's fresh, hashed, sourced, and timestamped.
Continuing watch
Monitor for later movement and reopen the case the moment funds shift again.