Engagements
How our services run
Every service is delivered as a staged case. Each stage explains what we are doing, what we need from you, and produces evidence you can download from your portal.
Blockchain investigation & transaction tracing
Clustering, heuristics and attribution data map every hop from the theft address to the cash-out point, producing an exhibit-ready trace report.
Stage 1 of 5
Intake & evidence capture
We record the incident timeline, wallet addresses and the transaction hashes involved, then snapshot on-chain state before it changes.
Submit the primary TX ID and any screenshots or messages from the counterparty.
Stage 2 of 5
Trace & attribution
Funds are followed hop by hop. Addresses are clustered and matched against exchange, mixer and sanctioned-entity datasets.
No action needed — analysts are working the graph.
Stage 3 of 5
Cash-out identification
We isolate the off-ramp: custodial deposit addresses, OTC desks or bridge endpoints where the assets surfaced.
Confirm any exchange accounts you personally control so they can be excluded.
Stage 4 of 5
Evidence package
Findings are compiled into a signed forensic report with graph exhibits suitable for law enforcement and exchanges.
Provide the jurisdiction and any case/report number filed with police.
Stage 5 of 5
Handover & follow-up
The report is delivered, exchange freeze requests are filed and we monitor the flagged addresses for further movement.
Download the analysis report from your case file.
Asset recovery
Recovery combines forensic tracing with freeze requests, bridge-side reclamation and legal pressure on identified counterparties.
Stage 1 of 3
Verification & scoping
We validate ownership of the affected wallet, confirm the loss on-chain and score realistic recovery probability.
Add the transaction ID of the outgoing transfer and upload proof of wallet ownership.
Stage 2 of 3
Tracing & freeze action
Stolen funds are traced to the receiving service. Freeze and hold requests are filed with the custodians holding them.
Upload your ID document and a signed authorisation so we can act on your behalf.
Stage 3 of 3
Recovery & settlement
Recovered assets are released to a wallet you control, with a final reconciliation statement of amounts returned.
Provide the destination wallet address for the returned funds.
Smart contract recovery & security audit
Manual review plus automated analysis of storage, upgrade paths and approval surfaces, with a remediation plan for each finding.
Stage 1 of 5
Scope & code intake
We collect contract addresses, source and deployment history, then reproduce the failure locally.
Provide the contract address and, if available, the repository or source files.
Stage 2 of 5
Audit & exploit analysis
Every external entry point, approval and upgrade hook is reviewed for recoverable value and live risk.
No action needed during analysis.
Stage 3 of 5
Recovery execution
Where value is recoverable we prepare and simulate the reclaim transaction before broadcasting.
Confirm the signer that will execute the reclaim transaction.
Stage 4 of 5
Hardening
Fixes, revocations and monitoring rules are applied so the same vector cannot be reused.
Approve the remediation plan attached to this stage.
Stage 5 of 5
Audit report
A full audit report with severity ratings and verification of each fix is issued.
Download the audit report from your case file.
RBF protocol monitoring
We watch the mempool for replacement transactions targeting your addresses and alert before a fraudulent replacement confirms.
Stage 1 of 5
Address enrolment
Your addresses are registered with our mempool watchers across monitored networks.
Submit the addresses and any pending TX IDs to monitor.
Stage 2 of 5
Live monitoring
Replacement attempts, fee bumps and conflicting spends are detected and logged as they appear.
Keep alert contact details current in your profile.
Stage 3 of 5
Incident response
When a replacement is detected we document it and coordinate counter-measures with the receiving service.
Acknowledge alerts so response can proceed.
Stage 4 of 5
Monitoring report
Periodic reports summarise detected events and residual exposure.
Download the monitoring report from your case file.
Stage 5 of 5
Prevention review
We tune confirmation policies and wallet settings to remove the exposure permanently.
Book the prevention review session.
Blockchain bridge recovery
We reconstruct the bridge message, locate the stuck or misdelivered leg, and re-route or reclaim it through our own bridge infrastructure.
Stage 1 of 3
Bridge transfer reconstruction
The source transaction, bridge contract and destination message are reconstructed to locate exactly where the transfer failed.
Add the source-chain TX ID and the bridge you used.
Stage 2 of 3
Proprietary bridge reclaim
Our bridge layer re-submits or reclaims the stranded message and validates the resulting balance change.
Provide the destination address and chain.
Stage 3 of 3
Delivery confirmation
Recovered assets are confirmed on the destination chain and reconciled against the original amount.
Download the reconciliation report from your case file.
Legal consultation
We work with investigators and counsel across jurisdictions so evidence is admissible and freeze orders land quickly.
Stage 1 of 3
Case review
Counsel reviews the forensic findings and maps the viable legal routes in your jurisdiction.
Upload any police report or exchange correspondence.
Stage 2 of 3
Filing strategy
We prepare the complaint package, preservation letters and subpoena targets.
Confirm your identity documents are on file.
Stage 3 of 3
Action & representation
Filings are submitted and progress is tracked against each counterparty.
Sign the engagement letter attached to this stage.
Education & risk prevention
Custody design, approval hygiene, signing policy and phishing resistance, delivered as workshops and written policy.
Stage 1 of 3
Risk assessment
We review custody setup, signing practices and approval exposure across your wallets.
List the wallets and services in scope.
Stage 2 of 3
Training delivery
Targeted sessions covering the exact attack patterns that apply to you.
Confirm attendees and preferred schedule.
Stage 3 of 3
Policy handover
A written security policy and monitoring checklist is issued and reviewed.
Download the prevention playbook from your case file.
Already a client? Your case stages, transaction IDs and reports live in the portal.