The first 48 hours decide the case.
When a hack or theft is live, speed is everything. We triage fast, trace the funds while they're still moving, and coordinate the preservation and freeze requests that give recovery a chance.
What we do in a live incident
OCINT takes it from first report to a court-ready package, with a named human authorising every action along the way.
Rapid triage
Scope the incident, identify the theft transaction, and start tracing within the hour.
Follow the money live
Track funds toward bridges and exchange endpoints before they're cashed out.
Preservation & freeze
Draft the preservation and freeze requests exchanges and counterparties need to act.
Counterparty coordination
Reach the right compliance contacts with a package they can move on quickly.
Evidence capture
Lock down a tamper-evident record while it's fresh, hashed, sourced, and timestamped.
Continuing watch
Monitor for later movement and reopen the case the moment funds shift again.