Before
Readiness
Runbooks, alert routing and practice drills, so your team knows exactly what to do when something happens.
Triage around the clock
Digital asset monitoring and incident response.
For exchanges, custodians, protocols, funds, and any business that holds digital assets. We work as an extension of your security team.
- Outflow from hot wallet
- Funds bridged
- Exchange deposit
Services
Before, during and after an incident
Before · During
Monitoring
Your hot wallets go into our alert feed from day one, along with your treasury, your smart contracts and, after an incident, the attacker's funds. Your team hears about it when something moves.
During
Incident response
We work out what happened and where the funds went, and give your team a clear timeline to act on. Urgent incidents reach a person at any hour.
After
Fund tracing & reports
Tracing funds days or months after a loss, and a written account of what happened for your users, board or insurer.
Research
Latest research
What we learn about how attacks and scams work, published when it's worth reading.
All researchHas the Binance hack’s bitcoin operator done this before?
On 29 October 2026 a script split 18,270 BTC taken from Binance’s hot wallet in a single block. We read the fingerprint that script left and searched six months of Bitcoin for the same hand at work. The closest match is a small run six weeks earlier: a fingerprint match, not an identification.
Read the summaryHow we work
How we work with you
OrganisationsBusinesses that hold digital assets
Every engagement starts the same way. Mid-incident, we call first and the NDA follows.
-
Contact
Tell us what you need through the form. You get a BT- reference, quoted in every message.
-
Mutual NDA
We both sign before any details are shared.
-
Introductory call
We learn how your setup works, and tell you what's possible and what isn't.
-
Written scope
Scope, timeline and fees, agreed in writing before work starts.
-
Onboarding
Your hot wallet addresses go into our alert feed. Public addresses only, never keys.
IndividualsHacked or scammed personally
A clear record of what happened, for the police.
Losing funds to a hack or scam is hard, and it isn't always clear what to do next. We can put together a report of exactly what happened that you can give to the police: every transaction, where the funds went, the contracts involved, and exact times.
Most of our work is with organisations, so we're not able to offer calls or one-to-one advice, and we can't freeze or recover funds. Here's how we can help:
INCIDENT REPORTBT-4QW9XM
2026-10-14 08:41:07 UTC 12.40 ETH 0x9f2c…e41a → 0x3a1d…b7e2
2026-10-14 08:43:52 UTC 12.40 ETH 0x41bd…07c3 → Bridge contract
2026-10-14 09:02:19 UTC 31,880 USDC 0x7e05…aa91 → Exchange deposit
Contact
Start a conversation
Every message is triaged around the clock, and urgent incidents reach a person at any hour.
We reply from an @blocktrace.com address.
Writing about a personal loss? We're sorry it happened. We can't take calls, but these free resources and our incident report are the best ways we can help.
Received.
Your reference
Note it down. We quote it in every message, so if a message claiming to be us doesn't, it isn't us.
We'll reply to from an @blocktrace.com address.
We removed what looked like a recovery phrase before sending. Everything else reached us.
We removed what looked like a private key before sending. Everything else reached us.
Next, we send a mutual NDA and set up a short call.