Your stolen
crypto has a
paper trail.

ChainWatch is a blockchain-forensics platform that traces stolen cryptocurrency across chains — from the initial theft transaction to where the funds come to rest — and documents the result as tamper-evident, chain-of-custody evidence.

What ChainWatch does

Starting from a single seed — a theft transaction hash or a victim wallet — ChainWatch automatically identifies the theft, then follows the funds hop by hop across the chain. Along the way it:

• Classifies every address as a wallet, contract, exchange deposit, mixer, bridge, or DEX, with a plain-language, glass-box reason for each label and OFAC screening built in.
• Decodes DEX swaps and cross-chain bridges to recover the onward trail where a naïve trace would dead-end — resolving swap-output recipients and bridge destinations so the money keeps leading somewhere.
• Detects laundering and attack patterns — peel chains, mixer behavior, velocity bursts, timing clusters, token substitution, flash-loan signatures, vanity-address clusters, and address-poisoning / homoglyph token spoofs.
• Correlates across cases to surface shared infrastructure, group related incidents into campaigns, and build attacker profiles that sharpen with every investigation.
• Surfaces other victims of the same operation — from a single seed, ChainWatch identifies additional wallets harmed by the same attacker infrastructure, revealing the full scope of a campaign by surfacing other affected parties and anonymously submitting them as linked co-victims.
• Values the loss at the price prevailing at the moment of theft, with a fully documented derivation rather than a black-box figure.

Every time we assist a victim, investigator, or law enforcement, we're not just helping one victim — we're attempting to dismantle the criminal organization behind it, to the best of our ability.

Built for evidence

Every data request, classification, and conclusion is written to a tamper-evident, hash-chained audit log, giving each case an unbroken chain of custody. ChainWatch produces both an investigator-facing report and a law-enforcement referral package formatted for IC3 / FBI submission. By design, it never presents a heuristic as a fact or a tooling limitation as a confirmed dead-end — open leads are surfaced as open leads, so an analyst always knows exactly what is established and what still needs confirmation.

Chain coverage

ChainWatch natively traces Flare and the major EVM networks — Ethereum, Arbitrum, Base, BNB Chain, Polygon, Optimism, Avalanche, and more — following assets seamlessly as they bridge from one chain to the next.

Coming soon: Bitcoin, Solana & Tron
Support for Bitcoin, Solana, and Tron is in active development, extending ChainWatch beyond the EVM ecosystem to three of the largest non-EVM destinations for illicit flows. Today, ChainWatch already detects and flags when stolen assets bridge off-EVM — for example, to Solana or Tron — and surfaces the destination as an open lead. The upcoming integrations will follow those funds onward natively, across Solana's account model, Tron's high-throughput account graph, and Bitcoin's UTXO graph, closing the gap where cross-ecosystem laundering currently breaks the trail.

Coming soon: Live movement alerts
Real-time webhooks that watch the resting locations of traced funds and notify the victim, the investigator, and law enforcement the moment those assets move again — so a dormant wallet waking up, or a deposit landing at an exchange, triggers action while there is still time to freeze or seize. Every alert is filtered through the same forensic mechanics that drive the trace, and hardened against the spoofing, dusting, and address-poisoning the actors themselves use to throw investigations off — so a notification reflects a genuine movement of the victim's funds, never a decoy planted to bury the signal in noise.