BLOCKCHAIN FRAUD Forensic Intelligence
Blockchain risk analysis · Operated by UnyKorn LLC (Wyoming)

Check a crypto offer, wallet or website for known fraud indicators — before you send.

Paste a message, wallet address, transaction hash or link. Our free automated check compares it with documented fraud patterns and screens any addresses against the U.S. Treasury OFAC sanctions list and public scam and phishing lists. You'll see which indicators we found, how strong each one is, and what we could not check.

Run a free check How our scoring works
Narrator (AI voice)
Never paste a seed phrase (recovery words) or private key. Anyone who has them can empty your wallet. We will never ask for them.
Try a sample:
What the free check does not inspect: it does not trace wallet history, analyse token contracts or involve a human reviewer; every result shows what was and was not checked. Limit: 8,000 characters.
Free, no account needed. The pattern check runs in your browser; detected addresses and links are sent to our server, and on to the list sources named on our Methodology page, for screening. Never paste a seed phrase, private key or password. We will never ask for them. Privacy
The evidence promise

Every analysis checks three things

The free check compares your input with documented fraud patterns and screens addresses and links against public lists. Paid analyst work adds on-chain tracing and a documented report.

Language & tactics

The message is read for manipulation patterns — guaranteed returns, urgency, wallet-connect lures, advance-fee demands — ranked by how strongly each one matched.

Addresses & domains

Wallet addresses, transaction hashes and URLs are detected and sent to our server for free screening against the OFAC sanctions list and public scam and phishing lists; transaction hashes are looked up on public blockchains and both sides screened. The list sources receive the address or domain, not your message.

Signal strength, stated

Every finding is labeled as an automated signal, not confirmed evidence, with a signal strength (Strong, Moderate or Limited). Signal strength describes how much evidence supports the result; it is not a probability that fraud occurred.

Sample report

What an automated report contains

SAMPLE · illustrative data · not a real case Automated report
Summary of findings
Risk tier and the indicators behind it
Each indicator names its source

Every report lists the indicators we found and the source for each one, the status of every data source (including any we could not reach, which are marked "not checked" and left out of the result), recommended steps, and a downloadable PDF.

Document metadata, where provided, is reported as an indicator, not proof: for example: “Document metadata identifies PyFPDF 1.7.2 as the generating software. This finding should be assessed alongside the document's claimed origin and other evidence.”

Open the sample report →

Threat-intelligence library

Recognize the scam before it costs you

How a case works

From a stranger's message to an organized report

01

Intake

You submit the evidence — wallet, transaction, site, or the messages you were sent.

02

Analysis

Automated signals first; for paid work, an analyst follows the funds on public blockchains and reviews documents.

03

Report

A structured report: summary of findings, evidence trail, timeline and recommended actions.

04

Escalation

Prepared, organized information you can submit to IC3 and exchanges, or give to the police officer or attorney handling your matter (for example, to support a law-enforcement request to a stablecoin issuer).

Trust & methodology

How to read a finding

What we analyze

  • Message language against a 44-pattern fraud library and a red-flag layer
  • Wallet addresses, transaction hashes and URLs, screened against public sanctions, scam and phishing lists
  • For paid cases: public on-chain fund flow and document metadata

Limits, stated plainly

  • The free check reports automated signals, not confirmed evidence
  • A low or inconclusive result is not a clearance; new schemes often appear before any list records them
  • This is risk analysis, not legal advice, and we do not guarantee any outcome
  • Recovery, if it happens, depends on exchanges, stablecoin issuers, courts and law enforcement
  • A promise of guaranteed recovery, or a fee to "release" your funds, is a common warning sign of a recovery scam
Low Suspicious High Inconclusive
Services and fees

Every engagement starts free.

Every engagement starts free. If paid work would help, we confirm the scope and a fixed price in writing before you pay. Fees are never a percentage of any recovery, and paying us does not make recovery more likely. Recovery, when it happens, depends on exchanges, issuers, courts and law enforcement.

Automated Forensic Report
$9.95

A detailed, automatically generated report. Generated by software; not reviewed by an analyst. One-time.

  • Every indicator and its source
  • The status of each data source, including any we couldn't reach
  • Recommended steps and an IC3-ready transaction table
  • Downloadable PDF
Check something now
Trace Report
$750starting at

An analyst follows the funds on public blockchains and documents the path. Your fixed price is confirmed in writing after the free assessment, before any payment.

  • Analyst on-chain fund-flow trace
  • Exchange-attributed or issuer-controlled addresses where funds arrived
  • ChainAbuse reporting
  • PDF report · typically 2–5 business days
Request a free assessment Already assessed? Pay $750 →
Full Investigation
$3,500starting at

Everything in the Trace Report, plus cross-chain analysis and document review. 50% deposit when work starts; balance on delivery. Your exact fee is fixed in your engagement letter.

  • Everything in the Trace Report
  • Cross-chain and bridge/mixer analysis
  • Document-metadata review
  • An organized information package for IC3, the FTC, exchanges or your attorney · typically 1–3 weeks
Request a free assessment Already assessed? Pay the $1,750 deposit →
Litigation support & Enterprise
Custom

Documented on-chain analysis and source data to support your attorney, and blockchain security support for businesses and exchanges. Where testimony is needed, we will tell you whether we can provide it or refer you to a qualified expert.

  • Documented analysis to support your attorney
  • Source data and methodology notes
  • Exchange / protocol security advisory
  • Incident-response support and monitoring
Request a quote
Fixed fees stated in advance Never a percentage of recovered funds No guarantee of recovery Not a law firm or government agency
For business & exchanges

Blockchain security, by written agreement.

Ongoing wallet and transaction monitoring, sanctions screening feeds, incident-response support and periodic reviews for exchanges, funds and Web3 businesses, under a written service agreement with defined response times and remedies.

Security Retainer
$2,500/mo · from

Continuous blockchain-security coverage for your business, billed monthly.

  • Continuous wallet & transaction monitoring
  • Incident-response support with response times set in the written agreement
  • Analyst support
  • Quarterly security review & staff training
  • Sanctions screening feeds
Talk to us Start the retainer — $2,500/mo →
Annual commitments discounted. Custom scopes for exchanges.

Service commitments

✓
Fixed fees. Your price is set in writing before work begins and is never tied to recovery.
✓
No trace, no trace fee. If the free assessment finds nothing traceable, we will say so and not sell you a trace.
✓
On-time delivery. Your delivery date is set in your engagement letter; the remedy if we miss it is set out in our Refund Policy.
✓
Retainers. Retainers include a written service-level agreement. If we miss the response window set out in it, the remedy in the agreement applies.
✕
No recovery promises. We do not promise, estimate or imply that funds will be recovered. A promise of guaranteed recovery, or a fee to "release" your funds, is a common warning sign of a recovery scam.
For businesses / API

Screen addresses from your own systems

For exchanges, payment teams, law firms and analysts. Pay per call over x402: no account, no API key, no subscription. The price is shown in the HTTP 402 response before you pay.

Address screen · $0.25 per call

POST https://blockchainfraud.org/api/x402/screen with {"address":"…"}. Checks one address against the OFAC SDN list (as imported), our scam-address registry and format rules. Paid in USDC on Base via x402.

OpenAPI · x402 discovery

Free JSON check

POST https://blockchainfraud.org/api/check with {"text":"…"} returns the same automated result as the page, including the coverage list of what was and was not checked. Rate-limited to 40 calls per 10 minutes.

On-chain identity

Paid calls settle to the wallet of UnyKorn's Genesis402 x402 rail, which has a public ERC-8004 agent identity on Base: agent #95721 (view on BaseScan, public reputation record).

API results are automated signals from public data: not KYC, not a compliance determination and not legal advice. Do not rely on them as the only basis for a compliance decision. Need volume, monitoring or a written agreement? Email cases@blockchainfraud.org.

We're hiring

Work with us.

We work with contract case handlers and on-chain analysts. See the roles we are open to.

See open roles →