Every wallet you exclude,
you can defend.
AlphaFlow clusters coordinated wallets before you distribute — and shows the signatures, fee-payer overlaps and timing deltas behind every call. A cluster only reaches high confidence when two independent signal families agree, after exchange and bridge withdrawals are removed.
- Two independent signal families required for high confidence
- Exchange and bridge withdrawals excluded before linkage
- Every exclusion carries its own evidence, approved by a human
- Precision tracked against who actually got funded
Investigating on-chain activity today is a collection of disconnected tools.
Data lives in explorers, wallet tools, tracing utilities, spreadsheets and monitoring systems — none of which talk to each other. An investigation-first workflow connects them.
Explorers, wallet tools, tracing utilities and spreadsheets that never line up into one picture.
Clicking hop by hop through explorers, hoping the trail doesn’t split.
A suspicious wallet — but no evidence of whose wallet it is or why it matters.
Screenshots and notes that fall apart the moment someone else reviews them.
Trace. Detect. Investigate. Evidence. Decide. Monitor.
Six stages, one engine, every answer carrying its evidence. Victims start at Trace; investigators and compliance teams live across the whole set.
- 01
Trace
Follow funds and activity through the chain.
- 02
Detect
Surface suspicious behavior and coordinated wallets.
- 03
Investigate
Connect wallets, transactions and entities — enriched with public-source evidence.
- 04
Evidence
Preserve findings with provenance and confidence.
- 05
Decide
Weigh the evidence and reach a human conclusion.
- 06
Monitor
Keep watching after the first finding.
Built for investigation, not just exploration.
Running a protocol? The full incident lifecycle — Monitor → Detect → Triage → Investigate → Verify → Respond → Watch — is covered on how it works.
The same engine powers three surfaces.
Investigate beyond the blockchain.
Blockchain activity tells you what an address did. Public-source evidence can provide context around who, what, and where that activity may connect. AlphaFlow brings both into the same investigation workflow — while keeping observed facts, attributed evidence, and inference clearly separated.
- 01
Wallet
Start with an address or transaction.
- 02
On-chain activity
Trace the funds and map the behavior.
- 03
Public sources
Project websites, domains, repositories.
- 04
Evidence
Each finding carries its source and type.
- 05
Correlation
Independent evidence connects the dots.
- 06
Investigation
A case built on layered, sourced evidence.
Trace passes through a known exchange — signal cut, not counted.
Compromised wallet and 6 downstream wallets share an uncommon fee-payer sequence.
Splitting window of 90 seconds across 84 addresses.
- Observed — 12.4M USDC left treasury_1 at 14:32:04Z, authority was intact.
- Attributed — the destination matches a verified exchange entity in the registry. Shown, not assumed.
- Inferred — the 84 split addresses may share an operator. Awaiting confirmation.
An alert becomes a case file, not a dead thread.
AlphaFlow keeps everything connected under one case: transaction evidence, wallet relationships, findings with confidence, citations, snapshots, and monitoring. A structured investigation stays reviewable — defensible because the provenance travels with every claim.
Blockchain facts and analytical inference are never confused.
Every finding is labeled for what it is — observed on-chain fact, derived computation, attributed identity, or inference awaiting confirmation. AlphaFlow tells you what the chain shows, what the system calculates, and what remains uncertain.
12.4M USDC transferred from treasury_1 at 2026-08-04T14:32:04Z.
Deterministic. Never argued away.
Funds hop treasury_1 → 8qLm…2kDe → CEX deposit.
Reproducible, stamped with method and version.
CEX deposit address matches a verified exchange entity in the registry.
Only used when the link can be shown, not assumed.
The address set is likely operated by a single actor.
Never overrides facts. Never persisted unconfirmed.
AlphaFlow distinguishes these levels in every finding. An inferred conclusion is labeled inferred — it is never presented as a verified fact, and it never overrides deterministic evidence.
When evidence is missing, exhausted, or ambiguous, the answer is unknown — stated plainly, never papered over with a guess. Unlabeled means unchecked; truncated means truncated.
The investigation doesn’t stop at the first finding.
A trace often ends somewhere worth watching — a cashout wallet, an exchange deposit, a funding source. Put those addresses under watch and AlphaFlow keeps checking them; when they move again, you get a webhook alert with the evidence attached, and the same case file is ready to continue.
The loop closes. The attacker stays on the watchlist. New movement raises a webhook alert with the evidence attached — the investigation continues from the same case file, not from zero.
Turn a suspicious transaction into an evidence-backed investigation.
Start with the transaction, follow the evidence, and keep the investigation connected.