Questions we get on every first call.

What is OCINT?

OCINT is one investigative platform for digital asset crime. Agents built on years of casework connect omnisource data, follow the money, map the threat and build the case, under named human control. A case runs from a victim’s report or a live incident to a source-linked record and a drafted next step that a named investigator signs.

OCINT grew out of the casework of BlockchainUnmasked, where it is in daily use.

Is OCINT the same as OSINT?

No. OSINT is a discipline: intelligence from publicly available sources. OCINT is a company and platform for digital asset investigations. OCINT uses OSINT as one input, alongside on-chain activity, case evidence and authorized records, in what we call omnisource intelligence.

What is the relationship between OCINT and BlockchainUnmasked?

OCINT develops the platform. BlockchainUnmasked provides victim reporting and managed investigative services, and its investigators use OCINT in their casework. If you are an individual who has lost funds, start with our page for victims. If you are evaluating investigation technology for an organization, start with a demo.

Who is OCINT for?

Four audiences: law enforcement units receiving digital asset complaints; financial institutions, including exchanges, banks and fintechs, investigating fraud reports and suspicious activity; law firms pursuing recovery, litigation or due diligence; and victims, who report through BlockchainUnmasked. Each works from the same case record with its own permissions and outputs.

What does “omnisource” mean at OCINT?

Omnisource is OCINT’s term for the data an investigation draws on: open-source intelligence, blockchain data, the evidence submitted with the case, and authorized records. Every item keeps its source, collection date, method and confidence, so a reviewer can see what supports each finding. It does not mean every source that exists; coverage depends on the case and on authorized access.

What are OCINT’s agents built on?

OCINT’s agents act on procedures, playbooks and typologies developed over years of real casework and a large evidence base, rather than on a general-purpose model alone. That is why the output is a prepared case file rather than a chat answer, and why an investigator can trace every conclusion back to its evidence.

What can OCINT do?

In use today: investigative agents for intake, tracing, destination-of-funds analysis and reporting; cross-chain tracing with wallet clustering, laundering-pattern detection and endpoint attribution; analyst-led open-source intelligence linked to the trace; and case files with evidence schedules and drafted requests, approved by a named investigator. In development: orchestration from approved playbooks, machine-assisted infrastructure analysis, automated monitoring and proactive threat hunting. See incident response and adversary intelligence.

Does OCINT replace our analytics or OSINT tools?

No. OCINT is built on analytics and OSINT tools, not instead of them. It connects what they produce into one case record and carries the case through to a drafted action.

Does OCINT trace cryptocurrency across chains?

Yes. The platform follows funds across supported chains, swaps and supported bridges to the service endpoints, flags laundering patterns and ambiguous transitions for investigator review, and produces a replayable evidence graph in which every claim carries its source and date.

What does an OCINT investigation workflow include?

Six stages on one record: intake, investigation, correlation with related cases, evidence building, action and monitoring. Guided intake, transaction tracing, destination-of-funds analysis, omnisource enrichment and case management produce a source-linked report with evidence schedules and request drafts. A named investigator validates the findings and approves anything sent outside the case.

How are the agents controlled, and does OCINT monitor wallets?

Agents prepare the work; a named investigator approves every consequential action, and every agent step is logged. Orchestration from approved playbooks with mandatory checkpoints is in development. Wallet monitoring is carried out by the investigation team today; automated monitoring that reopens a case when funds move is in development.

Which blockchains does OCINT support?

OCINT covers all the major EVM chains and the leading Layer 1s, including Bitcoin, Tron and Solana, and adds new chains as criminal activity moves to them. Swaps and supported bridges between those chains are traced as part of the same investigation.

How does OCINT trace stolen cryptocurrency?

A case starts from a report or a detected signal. Intake structures what the victim sent, the trace follows the funds across supported chains to the service endpoints, omnisource enrichment ties domains, accounts and infrastructure to the trace, and the result is a case file with an evidence schedule and a drafted next step. An investigator reviews it before anything is sent.

Can OCINT find other victims of the same scam?

Often, yes. Omnisource enrichment and illicit actor network mapping connect the wallets, domains, handles and infrastructure behind a case to related reports, so other victims who paid into the same scheme can be identified for the authorized team to contact. Cross-case connections respect each organization’s sharing permissions.

What is illicit actor network mapping?

It is the part of an OCINT investigation that links the wallets in a trace to the people, accounts and infrastructure operating them: shared domains, hosting, handles, phone numbers and payment destinations. Each link keeps its source and confidence, and a shared indicator stays a lead until the evidence supports a stronger conclusion.

Is the investigation done by AI?

Agents do the preparation: reading evidence, tracing, enrichment and drafting. They act on procedures and typologies built from years of casework, and they stop at every consequential step. A named investigator reviews the findings, decides what is a finding and what is a lead, and signs anything that leaves the case. No external action is taken by software on its own.

What does “a named investigator signs every conclusion” mean?

Every conclusion in a case file is attributed to a person who reviewed the evidence behind it. Unresolved questions and low-confidence findings are shown as such rather than presented as fact, and nothing is sent to an exchange, agency or court without that person’s approval.

What does an OCINT case file contain?

A summary for the decision-maker, a trace schedule of the transactions, the destination-of-funds analysis, exhibits, the omnisource evidence with sources and dates, open questions, and the drafted next step: a preservation or freeze request, a records request, or a referral. The technical record and the plain-language summary come from the same reviewed findings.

Can OCINT identify who owns a wallet?

OCINT can identify the service a deposit address belongs to, such as an exchange, and show the evidence and confidence behind that. A service endpoint is not an account holder’s identity. Who controls an account is established through the service’s records, obtained by the organization with authority to request them.

Does an exchange label prove who owns the funds?

No. A label says an address is associated with a service; it does not say who holds the account or who is entitled to the funds. OCINT keeps service labels, address roles and ownership conclusions as three separate claims, each with its own evidence.

How are commingled funds handled?

When stolen funds mix with other funds, OCINT applies a declared allocation method (for example FIFO, LIFO or proportional) and states it in the report, so counsel and the court can see the assumption and test it. Tracing stops at a justified custody boundary; what happens inside an institution is treated separately.

What should I do in the first 48 hours after a crypto theft?

Stop further loss by moving remaining funds to a new wallet on a clean device and revoking approvals. Record every address, transaction hash, time and amount. Preserve screenshots and messages. Notify each exchange where funds landed through its compliance channel, and file a report with law enforcement (in the US, the FBI’s IC3). Our hour-by-hour guide covers each step.

Can OCINT freeze my funds?

No one outside the exchange or service holding the funds can freeze them. OCINT traces the funds and prepares the preservation and freeze requests that exchange needs to evaluate; many act only on a law-enforcement or court request. A drafted request is not a freeze, and a freeze is not a recovery.

Do I need a police report?

It usually helps. Exchanges often ask for a law-enforcement reference before acting on a request. In the US, file with the FBI’s IC3 and your local police and keep the reference numbers.

I am an individual victim. Can OCINT help me?

Individual victims should start with our page for victims, which explains what to do first and has the report form. Reports are reviewed by BlockchainUnmasked, which provides victim reporting and managed investigations using OCINT technology. Filing a report does not by itself guarantee an investigation, a freeze or a recovery.

Is it too late after 48 hours?

Not necessarily. Funds often sit in intermediate wallets or at an exchange for days or longer. Tracing and monitoring can still establish where they went and flag when they move again.

Should I pay a recovery service?

Be careful. No legitimate service can guarantee recovery, and anyone asking for an upfront fee to “unlock” recovered cryptocurrency is very likely running a second scam. Never share a private key or seed phrase with anyone, including us.

How do I see OCINT in action?

Request a demo. We walk a redacted scenario, or our demonstration case, from intake through tracing, correlation and the finished case record to the drafted next step, show where a person decides, and discuss what is available to your team today.

Can our own investigators run OCINT?

Yes. Organizations can license the platform for their own investigators, or have BlockchainUnmasked run managed investigations on it.

Where is data hosted and who can see it?

Access is role-based and per organization, and evidence handling is documented throughout the case. Hosting, retention and security controls are covered in the demo and in our security documentation, provided on request.

Can OCINT’s reports be used in court?

Admissibility is for the court to decide. OCINT documents sources, methods, assumptions and limitations so the work can be examined and tested, and separates supported findings from leads and unresolved questions. Expert-witness reporting and testimony are provided through BlockchainUnmasked.

Do you provide expert witnesses?

Yes, through BlockchainUnmasked, which provides retained experts, expert-witness reporting and testimony for legal matters. OCINT provides the technology and the documented record those experts work from.

Can you serve a defendant who exists only as a wallet address?

Where a court allows it, service of process to a wallet is available through our legal service partner. See partners and the law firms page.

Does OCINT guarantee recovery?

No. OCINT traces funds and prepares the evidence and requests; exchanges, agencies and courts decide what happens to the assets. We prepare the work so the people with authority can act on it quickly.