Find the network before the next transaction.
Digital asset counterintelligence for authorized teams. OCINT links the wallets, transactions, domains, hosting, accounts and behavior behind a scam or an attack into one evidence-backed picture of the operation, and keeps that picture current as the operation moves.
Parts of this capability are in development and offered as early access to selected law-enforcement, exchange, legal and security teams. Each capability below is marked with its status.
A wallet rarely tells the whole story.
Operations span chains, exchanges, domains, hosting, messaging accounts, phone numbers, email and the replacement infrastructure they move to. OCINT puts those indicators in one case-linked record, where on-chain findings and off-chain intelligence are correlated and scored.
- Money flows linked to the domains, accounts and infrastructure around them
- Every link keeps its source, collection date, method and confidence
- Conflicting evidence is flagged, not averaged away
- Facts, assessments, leads and hypotheses kept apart
What OCINT connects.
Each capability is marked with how it is available today.
Likely common control from provider clustering data, on-chain heuristics and metadata, with the supporting evidence attached. An investigator reviews before any cluster is attributed.
Peel chains, mixers, chain hopping and consolidation flagged; deposit addresses tied to exchanges, gambling sites and darknet markets, with source and confidence.
Domains, hosting, handles, phone numbers and email linked to the trace by investigators using approved open-source intelligence. Machine-assisted entity resolution is in development.
Evidence-backed packages for exchange action, preservation requests, referrals and law-enforcement coordination, with every claim sourced.
Favicon hashes, site templates, TLS certificates and hosting compared across sites at scale, and reuse detected across cases, so a new report joins the operation it belongs to.
Wallets, infrastructure and identities watched for reactivation or migration, and agents working from casework to surface new infrastructure before it is reported.
In use running in casework today Managed run by investigators on OCINT as a managed engagement In development not yet available
From one indicator to the operation behind it.
A suspicious site, wallet or report is a starting point. Each pass through the cycle adds to the picture and is kept for the next case.
- Detect. A report, a flagged wallet or a suspicious site becomes the seed.
- Collect. Authorized sources only; collection is scoped and logged.
- Connect. Shared wallets, accounts and infrastructure link the seed to related sites and cases.
- Assess. Each link is labeled fact, assessment, lead or hypothesis, with its confidence.
- Monitor. The mapped network is watched for new activity, reactivation or migration.
- Act and learn. Packages go to the party with authority; verified findings feed the next detection.
Illustrative. Links rest on shared technical indicators and prior-case evidence, each with source, date and confidence.
What the intelligence looks like.
Written for the investigator who acts on it and the reviewer who tests it.
The wallets, infrastructure, accounts and behavior attributed to the operation, each with source and confidence.
A replayable graph from the seed indicator to linked wallets, sites and cases.
Facts, assessments, leads and hypotheses separated, so nothing weak reads as fact.
What the operation is, how it moves money and what changed since the last brief.
Preservation requests, addresses flagged for venues, takedown request drafts and referrals.
What the evidence does not yet support, and what would settle it.
Authorized matters. Documented control.
Collection, monitoring and any external action follow these rules. OCINT does not conduct unauthorized access.
Each matter has documented authority and a defined scope before collection starts.
Approved sources only, with the method recorded for every finding.
Attribution, referral and any external action wait for a named approval.
Role-based access per organization, and a complete log of who saw and did what.
Every link keeps its source, collection date and confidence.
A shared indicator stays a lead until the evidence supports more.
What teams ask first.
Five questions from every first call.
Does OCINT identify the person behind a wallet?
It can identify the service a deposit address belongs to and link wallets to infrastructure and accounts, with the evidence and confidence for each link. Who controls an account is established through the service’s records, obtained by an organization with the authority to request them. Identity attribution always waits for a named investigator’s approval.
Which sources are used?
On-chain data, the evidence in the case, approved open-source intelligence and records an authorized party provides. OCINT does not conduct unauthorized access.
Who can use it?
Vetted law-enforcement and government teams, exchanges, legal teams and enterprise security teams working on authorized matters.
What is available now, and what is in development?
In use today: tracing, wallet clustering, laundering-pattern detection, endpoint attribution, analyst-led infrastructure and account analysis, and evidence-backed reporting. In development and offered as early access to selected organizations: infrastructure fingerprinting at scale, campaign and cross-case linking, watchlists and proactive hunting.
How is this different from incident response?
Incident response follows one theft while the funds move. Adversary intelligence follows the operation behind it, across cases and over time. See incident response.
Six years of investigative experience. Now working at AI speed.
OCINT was not built by a software company guessing at how investigations work. It grew out of BlockchainUnmasked, the investigations firm behind it, where investigators have spent six years tracing stolen funds, mapping scam operations and preparing evidence for agencies, exchanges and courts.
That experience is what the agents work from. They follow the playbooks, typologies and review standards BlockchainUnmasked investigators use every day, not a general-purpose model alone. The output is a prepared case your people can check, not a chat answer.
For adversary intelligence, six years of casework is the head start: operations that reuse wallets, templates and hosting have often been seen before.
BlockchainUnmasked casework to October 2026.
Related solutions.
Where adversary intelligence connects to the rest of OCINT.
Develop the network, not just the transaction.
OCINT is shaping this capability with selected organizations. Tell us the operation or case type you work on.