Trace the funds while they are still moving.
When a theft is live, you need an investigation team that moves as fast as the funds. OCINT triages the incident, follows the money across chains toward the venues that can hold it, preserves the evidence and drafts the freeze requests those venues need to evaluate.
Every engagement starts with scoped triage, and no outcome is guaranteed: the venues and courts decide. Individuals who lost funds: start here.
What OCINT does in a live incident.
Each capability is marked with how it is available today.
Funds followed through swaps and supported bridges across every major EVM network, Bitcoin, Tron and Solana. Peel chains, chain hopping and consolidation are flagged; ambiguous hops go to an investigator, not a guess.
Deposit addresses tied to the exchanges and services that hold them, with the source and confidence behind each attribution.
Transactions, addresses, screenshots and messages captured with source, collection time and hash while they are fresh, in a tamper-evident record.
One draft per venue: the transactions, the deposit addresses at that venue, the hop-by-hop path and what is being asked. Your counsel or law enforcement sends it.
Compliance desks on the path contacted with a package they can evaluate quickly. Every contact and response is logged in the case.
Attacker and hop addresses watched by the response team; new movement extends the trace and updates the request. Automated monitoring is in development.
In use running in casework today Managed run by investigators on OCINT as a managed engagement In development not yet available
How a response runs.
Five stages on one case record. The order is fixed; the pace depends on the chains and the venues on the path.
Triage
Confirm the incident, the assets and chains involved, the theft transactions and the attacker addresses. Agree what is feasible before work is committed.
Trace live
Follow the funds hop by hop toward bridges, swaps and exchange deposit addresses. Each hop keeps its transaction, amount, UTC time and confidence.
Preserve and request
Lock the evidence record, then draft preservation and freeze requests for each venue holding funds.
Coordinate
Send the package to the compliance desks on the path through the channel your counsel or law enforcement chooses, and record each response.
Watch and close
Keep the attacker and hop addresses watched and extend the trace when funds move. The case closes with the full file.
A named responder approves every external action.
What you receive.
Every finding carries its source, date and confidence, and evidence is kept apart from inference.
What happened, the assets and amounts involved, and where the funds are now.
Every hop with transaction hash, amount, UTC time, method and confidence.
The venues holding funds, with the deposit addresses at each and the basis for each attribution.
One per venue, ready for your counsel or law enforcement to review and send.
Each item with its source, collection time and hash, so the record can be tested later.
What is unresolved and what decision comes next, stated rather than buried.
| Finding | Source · date | Confidence | Type |
|---|---|---|---|
| Funds reached an exchange deposit address | On-chain trace · 12 Sep | High | Evidence |
| Domain shares a TLS certificate with known scam sites | Certificate lookup · 11 Sep | High | Evidence |
| Messaging handle likely operated by the same actor | Header analysis · 12 Sep | Medium | Inference |
| Operation linked to an earlier case cluster | Prior casework · 9 Sep | Medium | Inference |
| Next step: preservation request to the venue | Drafted by agent · pending | — | Awaiting review |
Each row links to its source, the agent step that produced it, and the reviewer’s decision.
Your response team, the moment funds move.
Three disciplines working as one investigation while the clock runs.
Keep up with the funds
Follow the theft hop by hop through swaps and supported bridges across every major EVM network, Bitcoin, Tron and Solana, toward the venues that can hold it.
See who you are up against
Link attacker wallets to infrastructure, accounts and earlier cases, so the response is aimed at the operation, not one address.
Get the requests out
Agents assemble the evidence log and draft one freeze request per venue while the trace is still running.
A named responder decides. Software prepares and drafts; every attribution, request and external contact waits for a named approval, and the record shows who approved what.
Six years of investigative experience. Now working at AI speed.
OCINT was not built by a software company guessing at how investigations work. It grew out of BlockchainUnmasked, the investigations firm behind it, where investigators have spent six years tracing stolen funds, mapping scam operations and preparing evidence for agencies, exchanges and courts.
That experience is what the agents work from. They follow the playbooks, typologies and review standards BlockchainUnmasked investigators use every day, not a general-purpose model alone. The output is a prepared case your people can check, not a chat answer.
For a live incident, it means the response follows playbooks already run on real thefts, so the first hours are spent tracing, not working out what to do.
BlockchainUnmasked casework to October 2026.
Software prepares. People decide.
These steps always wait for a named approval, and the record shows who approved what.
- Searches sources and pursues leads
- Traces and correlates in parallel
- Maintains the case record
- Drafts the next step
Every step logged.
- Identity attribution
- Legal framing
- Referral or filing
- Freeze or preservation request
- Any external submission
Approval before action.
- Who approved, when and why
- What was sent, and to whom
- The response from each venue
- Every source behind every finding
Audit trail from first input to final export.
What responders ask first.
And what a freeze request to an exchange has to contain.
Can OCINT freeze the funds?
No. Only the exchange or service holding the funds can freeze them, and many act only on a law-enforcement or court request. OCINT prepares the request and the evidence behind it. A drafted request is not a freeze, and a freeze does not by itself return funds.
Who does the work: your team or ours?
Either. A response can run as a managed engagement, carried out by BlockchainUnmasked investigators on OCINT, or your own investigators can run it on a licensed platform.
Which chains can be traced?
All the major EVM chains and the leading Layer 1s, including Bitcoin, Tron and Solana, with swaps and supported bridges between them traced in the same case. Coverage depends on the asset, chain, bridge and data source, and is confirmed during triage.
What should we send at the start?
The theft transaction hashes, the affected and attacker addresses, the time of the incident in UTC, and anything that shows how it happened: logs, contract addresses, messages. Never send a private key or seed phrase.
Is there a guaranteed response time?
No. Triage is scoped on first contact. How fast funds can be followed and requests answered depends on the chains involved and on the venues on the path.
Is a police report needed?
It usually helps. Exchanges often ask for a law-enforcement reference before acting. In the US, file with the FBI’s IC3 and keep the reference number.
Is it too late after 48 hours?
Not necessarily. Funds often sit in intermediate wallets or at an exchange for days. Tracing can still establish where they went, and the addresses can be watched for the next move.
Can OCINT identify who is behind the attack?
OCINT maps the wallets, infrastructure and accounts behind an incident and keeps evidence apart from inference. Identity attribution waits for a named investigator’s approval. For the operation behind repeated attacks, see adversary intelligence.
What a freeze request to an exchange should contain
- Who is asking, and on what authority. The requesting organization, a law-enforcement reference or counsel’s details, and a contact for follow-up.
- The transactions. Chain, transaction hashes, amounts and timestamps in UTC.
- The deposit addresses at that exchange. Each address that received the funds, and when.
- How the funds got there. The trace from the victim’s wallet to the deposit address, hop by hop.
- What is being asked for. Preservation of account records, a temporary hold, or both.
Report an active incident.
For organizations with a live theft. Fields marked * are required. Individuals who lost funds: report here instead.
Triage is scoped first, so you know early what is and is not feasible. No outcome is guaranteed; the venues and courts decide.
Incident received
Your reference is . Quote it in any follow-up.
- The response team reviews what you sent.
- They contact you to scope triage: what can be traced, what can be preserved, and what cannot.
- Meanwhile, move any remaining funds out of compromised wallets, revoke token approvals and do not contact the attacker.