A world-class investigator on your desk. 24/7.
Give every officer the reach of an experienced financial crime team. OCINT follows the money across chains, connects it to the people and infrastructure behind it, and assembles the evidence your unit needs to act.
- Federal agencies
- State and local units
- Cyber and financial crime teams
Your investigators shouldn’t have to work alone against increasingly sophisticated financial crime.
- 01Complaints outrun capacity
IC3 referrals, local reports and tips arrive with partial transaction IDs and screenshots. Most are never read for lack of analyst hours.
- 02The trail leaves the chain
Funds reach an exchange, then the story moves to domains, hosting and handles. Every hop needs a different tool and a different specialist.
- 03One scheme, split across many cases
Related complaints sit in different queues, so nobody sees that one victim’s loss is part of a wider operation.
- 04Evidence goes stale
Exchange records and scam infrastructure disappear while requests are drafted by hand.
Meet your investigative capability.
Three disciplines that usually take three specialists, working as one investigation on one case record.
Follow the money
Trace funds across every major EVM network, Bitcoin, Tron and Solana, through swaps and supported bridges, to the exchange deposit address that holds the records.
Find who is behind it
Connect the wallets to the domains, hosting, certificates, handles and phone numbers operating the scheme, with the source and date on every link.
Build the case
Agents built on BlockchainUnmasked playbooks structure the complaints, join related cases, rebuild the timeline and draft the requests, then stop for your review.
Your investigators decide. Agents prepare the work. A named investigator approves every attribution, request and referral, and every step is logged.
An investigation in action.
From one suspicious wallet to a request your unit can serve.
A local unit receives an IC3 referral: one victim, one wallet address, two transaction hashes and a screenshot of a trading app.
- 1Lead
A suspicious wallet
The complaint becomes a case record. The wallet, hashes and app are resolved, and the evidence still missing is listed.
Case record - 2Trail
A transaction trail
Funds are traced hop by hop across chains and supported bridges. Ambiguous hops are flagged for an investigator, never guessed.
Trace schedule - 3Network
A connected network
The app’s domain is fingerprinted. Shared hosting and certificates reveal the operator’s other sites and wallets.
Network map - 4Leads
New investigative leads
Other complaints and prior casework share the same wallets, so a lone report becomes part of a wider scheme.
Linked cases - 5Action
Evidence, then action
Chronology, exhibits and a preservation request to the exchange are drafted for your investigator to review, sign and serve.
Evidence package
Illustrative scenario. What can be traced depends on the chain, the asset and the data available, and is confirmed for each case.
What your team can now do.
Each capability, described by what it changes for an investigator. Availability is marked.
Agents read complaints, resolve the identifiers, trace the first hops and rank cases by what is actionable.
Complaint triage In useOne trace across chains, swaps and supported bridges to the exchange that holds the records, with every hop sourced and timed.
Cross-chain tracing In useFind connected wallets and the relationships between them that would otherwise stay hidden.
Wallet clustering In useTie the trace to domains, hosting, handles and phone numbers, and develop attribution leads with the confidence stated.
Open-source research In useJoin complaints that share wallets, infrastructure or methods, under access controls.
Case correlation In useAgents that work from patterns across cases and infrastructure to surface replacement sites and reused wallets.
Proactive hunting In developmentFrom intelligence to action.
What lands on your investigator’s desk, ready to review, sign and serve.
Actionable complaints first, with the exchanges that hold records and the evidence still missing.
Every hop with transaction hash, amount, UTC time, method and confidence.
The wallets, sites and accounts behind the scheme, with what is established and what is still a lead.
Chronology, exhibits and source-linked findings, with chain of custody documented throughout.
Preservation and freeze requests, and referral reports, for the agency to review, sign and serve.
Expert-witness reporting and testimony through BlockchainUnmasked when the case goes to court.
OCINT never issues legal process. Requests are drafted for your agency to review and serve; enforcement decisions stay with you and the courts.
Six years of investigative experience. Now working at AI speed.
OCINT was not built by a software company guessing at how investigations work. It grew out of BlockchainUnmasked, the investigations firm behind it, where investigators have spent six years tracing stolen funds, mapping scam operations and preparing evidence for agencies, exchanges and courts.
That experience is what the agents work from. They follow the playbooks, typologies and review standards BlockchainUnmasked investigators use every day, not a general-purpose model alone. The output is a prepared case your people can check, not a chat answer.
BlockchainUnmasked casework to October 2026.
What agencies ask first.
Short answers from the investigations team. The full FAQ has the rest.
Does OCINT replace our investigators?
No. It gives them the research, tracing and case-building capacity of a much larger team. Agents prepare the work; your investigators decide what is a finding, what is a lead and what leaves the case.
What does “24/7” mean here?
The platform is available whenever your team works, and its agents research, trace and draft in parallel at any hour. It does not mean an analyst is staffing your case around the clock. Managed support through BlockchainUnmasked is scoped separately.
Does OCINT issue subpoenas or freeze orders?
No. OCINT prepares preservation and freeze request drafts and referral reports for the agency to review and serve. Legal process and enforcement decisions stay with the agency and the courts.
Can an agency’s own investigators run it?
Yes. Agencies can license the platform for their own investigators, or work with BlockchainUnmasked for managed investigative support and expert-witness reporting. It is built for any unit that receives digital-asset complaints, federal, state or local.
How is attribution handled?
Evidence is kept apart from inference, each with a confidence score. Identity attribution always waits for a named investigator’s approval, and a shared indicator stays a lead until the evidence supports a stronger conclusion.
Where agencies go next.
Other ways OCINT supports a case.
See OCINT investigate a case.
Bring a redacted complaint. We’ll walk it from a single wallet to a signed evidence package, and show where your investigator decides.
Individual victim? Report a scam or read what to do first.