Methodology

How we analyze a case, and what we don't claim.

Every finding we publish should be checkable by you. This page names the sources we use, what each one actually contributes, how we state confidence, and the limits we hold ourselves to. We don't claim partnerships we don't have; we cite the public data we work from.

The data we work from

These are the sources behind our analysis. None of them is a partner or an endorser; they are public datasets and explorers that any investigator can consult, and that you can consult yourself to verify our work.

Source	What it is	What it contributes
TronScan / Etherscan	Public block explorers for TRON and EVM chains	The transaction trail itself: every transfer, wallet, timestamp, and contract method. This is the primary evidence in any trace.
OFAC SDN list	The U.S. Treasury's sanctions list, which includes designated cryptocurrency addresses	Sanctions screening. A hit means an address is tied to a designated entity, a hard fact, not a heuristic.
ChainAbuse	A public, community-reported database of scam addresses and domains	Whether an address or site has been reported before, and by how many people. We also contribute reports from our own cases.
MetaMask eth-phishing-detect	The open-source phishing blocklist MetaMask ships with	Known phishing domains targeting EVM wallets.
Phantom blocklist	The open-source blocklist Phantom ships with	Known phishing domains targeting Solana wallets.
DeFiLlama hacks feed	A public dataset of DeFi exploits and losses	Context on whether a protocol or token has a known exploit history.
Document metadata	The producer, creator, and timestamp fields inside PDFs and images	Metadata indicators, reported neutrally, e.g. “Document metadata identifies PyFPDF 1.7.2 as the generating software. This finding should be assessed alongside the document's claimed origin and other evidence.”

How the free check works

The free analyzer's pattern check runs in your browser. It reads what you paste against a library of 44 known fraud patterns plus a red-flag layer that catches the universal tells: guaranteed returns, urgency, wallet-connect lures, advance-fee demands, seed-phrase requests, and recovery pitches. It also detects wallet addresses, transaction hashes and URLs. The pattern check runs in your browser. Wallet addresses, transaction hashes and links we detect are sent to our server and checked against the sources listed on this page, some of which are third-party services; those services receive the address or domain being checked, not your message. Address and link screening uses: the U.S. Treasury OFAC sanctions list; public scam-address and phishing-domain lists; domain registration data (RDAP, via rdap.org) for domain age; and public blockchain nodes to look up transaction hashes. If you buy the $9.95 automated report or open a case, the text you submit is sent to our server to prepare it, and the report engine may query further third-party sources (for example token-security and certificate-transparency services). The only third-party script our pages load is Cloudflare Web Analytics, a cookie-free page-view beacon loaded from static.cloudflareinsights.com; the requests the free check makes go to blockchainfraud.org.

It produces a risk tier (Low, Suspicious, High or Inconclusive), a signal strength, the specific indicators found and why, and recommended next steps. It is deterministic: the same input always produces the same result, and every reason it gives points to something in your text.

How we state confidence

Every finding carries one of three labels, and we never blur them.

Automated signal

A pattern matched, or a heuristic fired. Useful and fast, but it is a signal, not proof. Everything the free check reports is this.

Confirmed evidence

A fact verified against a primary source: a transaction on a public explorer, a sanctions listing, a document's own metadata. Paid cases are built on this.

Inconclusive

We looked and could not determine. We say so. "No signal found" is reported as inconclusive, never as "safe" or "clean."

What a paid investigation adds

An analyst follows the funds on the public chain, hop by hop, to the exchange or off-ramp where they landed.
Exchange-attributed addresses are identified. Funds reached an address attributed to an exchange. Relevant account records may be obtainable through appropriate legal process.
Freezable balances are identified where a stablecoin issuer can act on a verified request.
Documents you were sent are reviewed for metadata indicators, for example: “Document metadata identifies PyFPDF 1.7.2 as the generating software. This finding should be assessed alongside the document's claimed origin and other evidence.”
The findings are organized into a report you can submit to IC3, the FTC and exchanges, or give to your attorney or the officer handling your report.

The limits we hold ourselves to

What we never claimWe never guarantee the recovery of funds. Recovery, when it happens, runs through courts, exchange compliance, and law enforcement, and depends on facts no investigator controls. We charge flat fees agreed in advance, never a share of anything recovered. Be wary of anyone who asks for an upfront "release", "tax" or "unlock" fee.

We provide blockchain risk analysis. We are not a law firm, a law-enforcement or government agency, or a bank; nothing here is legal advice.
We charge a flat fee or a monthly retainer, agreed before work starts. Never a percentage of recovery.
Absence of a signal is not evidence of legitimacy. New scams appear daily and platforms strip metadata on upload.
We do not name third parties as partners, endorsers, or custodians unless a relationship actually exists and they have agreed to be named.
Every published case is de-identified: no victim names, and the on-chain evidence is left intact so you can verify it on a public explorer yourself.

Report integrity

Every report, free or paid, carries a SHA-256 fingerprint of its contents and a timestamp. If a single character of the report changes, the fingerprint changes. It is a tamper-evidence measure, not a court certification, and we describe it as exactly that.