Reproducible. Cited. Defensible.
A method built to survive the toughest reader in the room: opposing counsel.
Four commitments on every case.
Chain-of-custody first
Every artifact — screenshots, exports, wallet dumps — is timestamped and hashed on receipt, and stored in a version-controlled workspace preserved for the life of the case.
Confidence tiers, always disclosed
Every counterparty attribution carries an explicit confidence tier (High / Medium / Low) with the underlying signal disclosed — clustering, public attribution, exchange confirmation, or heuristic inference.
Facts before inferences
Observed on-chain facts are separated from analytical inferences in every report. A reader can accept our facts and reach their own conclusions.
Second-analyst review
No report leaves the firm without independent review by a second analyst who did not conduct the primary tracing.
What a Aegis report contains.
Plain-English narrative of what occurred on-chain — written for non-technical decision-makers.
Annotated flow of funds with every hash, timestamp, and counterparty label cited.
Identified services, exchanges, or clusters — with confidence tier and supporting signal.
Realistic legal and compliance channels the evidence can support. Not guarantees.
Every tool, dataset, and heuristic used, at what version, so findings can be reproduced.
Signed by primary and reviewing analyst, with qualifications and disclosures.
Chain of custody, from first byte.
Every artifact — a wallet export, a screenshot, an on-chain snapshot — is hashed on receipt, timestamped, and stored in an encrypted, version-controlled workspace unique to your matter. Access is logged. Retention aligns to your counsel's litigation hold.
The stack behind every report.
We combine commercial analytics platforms with in-house tooling and full-node access. Every finding declares which tool produced it, at which version — so nothing in a Aegis report is a black box.
Direct RPC access to Bitcoin, Ethereum, Tron, Solana, and major EVM L2s — no reliance on third-party indexers alone.
Enterprise licenses with two leading blockchain analytics providers, cross-validated on every attribution.
Proprietary clustering, deposit-address grouping, and drainer-signature libraries maintained internally.
Structured OSINT feeds for sanctions lists, exchange disclosures, and public counterparty attributions.
Malicious contract analysis performed in isolated environments — never on client infrastructure.
Every tool and dataset used is pinned by version and cited in the report's tooling manifest.
Written to be filed, not just read.
A Aegis report is drafted with a specific reader in mind: the judge, arbitrator, regulator, or insurance adjuster who will decide the matter. Every section is structured to support direct citation in pleadings and affidavits.
- Numbered paragraphs for cross-referencing
- Verbatim transaction hashes in the appendix
- Independent verification path for every finding
- Signed by both primary and reviewing analyst
Built against the standards courts actually apply.
A forensic report is only useful if it can be admitted, disclosed, and defended. We draft to the criteria that decide that question — and state our limitations rather than leaving them to be found in cross-examination.
The analyst's qualifications, training, and case experience are disclosed in the report and in any declaration.
Techniques are published, repeatable, and applied consistently across matters — not invented per case.
Conclusions rest on cited on-chain records and preserved artifacts, not on unverifiable third-party assertions.
Where a heuristic is used, the report names it, states its error modes, and lowers the confidence tier accordingly.
Artifacts are hash-verified at capture with a documented acquisition log supporting authentication.
Findings adverse to the instructing party are reported in the same terms as favourable ones.
Every report carries a limitations section: data gaps, unresolved hops, and where analysis stopped.
We do not opine on legal conclusions, criminal liability, or the likelihood of recovery.
Reports are versioned; any amendment is issued as a dated addendum, never a silent edit.
Bring us your hardest case.
We take on matters where on-chain evidence can materially advance a legal, regulatory, or insurance outcome — and we say so honestly when it can't.