Intake standard Reviewed · May 2026
Coverage 30+ chains · cross-chain
Posture Verified facts only
Response 24h initial review
Evidence-first intake

Blockchain Forensics & Asset Tracing

If digital assets were moved without authorisation, the first requirement is a traceable record of movement and a conservative decision on what can be verified.

One intake standard for victims, counsel, and compliance: traceable facts, documented movement, and explicit verification boundaries.

Initial review starts from traceable facts only
Audience routing 03 ROUTES · 01 PIPELINE

Choose your intake route

Three entry routes, one conservative forensic standard.

Individual incident intake

Preserve evidence, verify first-hop movement, and separate viable matters early.

For victims who need an immediate, conservative read on whether on-chain movement can still be documented and escalated.

Operating posture Operational posture
Evidence-grade documentation
Chain-of-custody aware outputs
Sanctions-aware intake
Screening at first review
Cross-chain trace workflows
Major L1, L2, and UTXO surfaces
Counsel and exchange coordination
Counterparty-ready work product
English / Spanish intake
Email-first review
24h initial review
No video call required to open a matter
AEGIS
FLOW / ETH-TRON / HOP-01 / CONF-092
REVIEW / DEPOSIT-CLUSTER / NODE-04
ROUTE / COUNTERPARTY / TRACE-SET / A1
EVIDENCE / LEDGER-MAP / CASE-INDEX / B2
INTAKE / SANCTIONS-SCREEN / LINK-SET / C3
§ II · Method and Credentials

How the work is scoped before any engagement begins.

DOC · CLW-MTH-002
REV · 2026.04
PAGES · 03 / 03
A · Verification standard

Observed movement separated from inference

Conservative public posture

Outputs distinguish observed movement from inference. Every claim is tagged with the verification standard that supports it. No guaranteed recovery, no speculative attribution, and no ambiguity about what still requires outside confirmation.

Standard Evidence-first Output Forensic record Posture Conservative
B · Trace infrastructure

Multi-chain forensic stack

Major chains, L2s, and exchange-routing workflows

Tracing across EVM, Bitcoin and UTXO chains, Solana, Tron, and major L2 environments. Cross-stack reconciliation is used for bridge hops, mixer proximity, and exchange off-ramp review when the available facts support deeper tracing.

Coverage 30+ chains Surfaces L1 · L2 · UTXO Disclosure Scoped to matter
C · Team and reporting

Lead investigator background

Counsel-aware work product

Lead Investigator: Antonio Martinez. Background: Criminology, Universidad de Valencia; MSc Cybersecurity, UCJC Madrid. Focus: multi-chain tracing, counsel coordination, and evidence documentation suitable for counterparties and legal review.

Lead Antonio Martinez Focus Tracing · exhibits Contact Email-first

Who is behind CyberLeakWatch

Public-facing credentials are kept narrow and verifiable. Sensitive operational background is not disclosed on the website.

Lead investigator
Antonio Martinez
Criminology, Universidad de Valencia. MSc Cybersecurity, UCJC Madrid. Focused on multi-chain tracing, counsel coordination, and evidence documentation.
Working posture
Email-first intake and verified outputs
Initial review is handled by email. Work product is scoped to traceable facts, counterparties, and the evidentiary needs of the matter.
Guardrails
No wallet custody, no remote access
CyberLeakWatch does not request private keys, seed phrases, wallet approvals, or remote device access during intake or review.

Services

Scoped to case facts, jurisdiction, and counterparty response speed. We do not promise recovery outcomes.

Enterprise
Exchange Hack Investigation
Comprehensive forensic analysis for institutional security incidents and post-exploit attribution.
Victim matters
Victim asset tracing
First-hop mapping, multi-hop tracing, and counterparty packages for matters with viable technical signal.
Compliance
AML / CTF Compliance
Transaction monitoring, sanctions screening, and regulatory compliance reporting for digital asset businesses.
Counsel
Counsel support and technical exhibits
Chronologies, trace exhibits, and chain-of-custody-aware documentation prepared for legal review and counterparties.
What Clients Receive

24–72h Delivery Window

Deliverables are scoped to case facts, jurisdiction, and counterparty response speed.

4–24h
Rapid Triage Memo
Initial traceability assessment, immediate preservation actions, and escalation route recommendations.
Forensics
Fund Trace Report
Multi-hop flow map, typology observations, and prioritised counterparties for next action.
Interdiction
Freeze Coordination Pack
Counterparty-ready packet with wallet set, transaction references, chronology, and supporting exhibits.
Legal
Counsel / LE Referral Pack
Chain-of-custody declaration, evidence index, and technical appendix prepared for secure handoff.
Timelines vary by chain visibility, data quality, and third-party cooperation.
Operational capabilities

Institutional-Grade Operating Capabilities

Public-safe summary. Full methodology and sensitive workflow details are disclosed only under engagement.

Graph-based fund flow analysis and case linkage
24/7 monitored watchlists and movement alerts
Multi-chain tracing across major L1/L2 ecosystems
Sanctions and exposure screening integrated into triage
Chain-of-custody-ready evidentiary documentation
Counterparty coordination workflows (exchange / issuer / counsel)
MATTER / DEFI-ROUTE / EXHIBIT-A
MATTER / CONSOLIDATION / EXHIBIT-B
MATTER / EXCHANGE-TRACE / EXHIBIT-C
MATTER / CHRONOLOGY / EXHIBIT-D
Selected matters

Selected matters and trace outcomes

Real matters, described conservatively. Client identities remain redacted and public claims stay within what can be stated safely.

$292M Traced
2026 | Ethereum / TRON
DeFi exploit response
Large-value exploit traced across multiple hops with attacker routing documented and escalation-ready evidence prepared for counterparties.
EVIDENCE DELIVERED
$190M Mapped
2026 | TRON / Ethereum
Pig-butchering network mapping
Multi-jurisdiction fund tracing across scam wallets, consolidation nodes, and exchange-facing routes. Matter remains active and client identities are withheld.
ACTIVE INVESTIGATION
$32.8M Traced
2026 | Ethereum
Exchange compromise response
Deposit routing and related wallet exposure documented for counterparty review, with a freeze-ready chronology and supporting exhibits prepared.
FREEZE PACK PREPARED
Contact and case intake

Choose your route and start by email

Use the route that matches your role. Initial review is handled by email and starts from the minimum traceable facts.

Victim
Victim trace lane
Single incident, scam platform, or wallet already identified. We map the first-hop and assess traceability.
Open Trace Lane
Professional
Professional intake
Counsel, exchange, compliance, or multi-trace case material. Structured intake with methodology disclosure.
Open Professional Lane
Exchange / Compliance
Institutional triage lane
Incoming exposure review, sanctions-aware triage, or counterparty coordination for a live matter.
Open Institutional Lane

Initial review is handled by email. No call is required to open a matter. CyberLeakWatch does not request private keys, seed phrases, wallet approvals, or remote device access.