Run the whole investigation in one place.
Researchers and security teams piece together explorers, spreadsheets, and screenshots today. VikingIntel gives you the trace, the entity picture, the case record, and the evidence bundle — with every claim labeled for what it is.
Built around how investigations actually proceed.
Start from a signature or an address, expand to the surrounding structure, attribute what the evidence supports, preserve it, and keep watching.
Fund tracing
Forward and backward multi-hop traces that stop at known exchanges, bridges, and mixers — and say so when they truncate instead of implying an answer.
Wallet & entity analysis
Full behavioral profiles: funding lineage, counterparties, execution fingerprints, related wallets with the basis for each link, and composite risk scores with per-component evidence.
Bulk triage
Paste up to 1,000 addresses per job — a heist’s cashout set, a suspicious distribution — and rank them by exchange proximity with per-address hit detail. Pro includes 100 triage addresses/day; Enterprise includes 1,000/day.
Private labels
Your own researcher labels ride alongside the shared registry inside your traces — your attribution knowledge compounds instead of living in a spreadsheet.
Cases & evidence
Every wallet, note, decision, and finding under one case. Typed findings with provenance, append-only decisions, versioned reports, and snapshots — structured for review.
OSINT enrichment
Enrich an investigation with public-source evidence from project websites, domain infrastructure, repositories, and public identities — each piece carrying its source, timestamp, and confidence.
Monitoring ↗
Keep watching the wallets that matter after the report ships. New movement raises alerts (webhook, Slack, Discord, PagerDuty) tied to the same case file.
Structure without false merges.
Known infrastructure is discounted rather than clustered, so a shared deposit address doesn’t collapse hundreds of unrelated wallets into one suspect group. Relationships are labeled with the basis for the link — you decide what holds.
Conclusions that survive review.
Findings carry observed, derived, attributed, or inferred labels; deterministic facts outrank inference. Reports are stamped with the methodology version and a hash, so what you concluded is checkable later — by you or by anyone else.
- Investigation ID
- inv_8f3a2c
- Cluster ID
- sybil-cluster-0192
- Wallet count
- 41
- Classification
- Coordinated
- Confidence
- High
- Evidence families
- 3 / 4
- Entity exclusions
- 1 (Binance Hot Wallet)
- Methodology
- engine v1.2.0 · signal-family model
- Generated
- 2026-08-04T14:36:11Z
- Report hash
- sha256:9a41…e02c
- Data completeness
- Partial — 2 traces truncated
- Limitations
- 3 wallets unlabeled; no exchange hit claimed
Illustrative example — mock cluster, report hash, and Verified badge.
The loop closes. The attacker stays on the watchlist. New movement raises an alert with the evidence attached — the investigation continues from the same case file, not from zero.
Illustrative example — mock incident, amounts, and addresses.
The case file is ready when the money moves again.
Put the actor’s wallets under watch. New movement raises an alert with the evidence attached — pick up from the same case file, no restart from zero.
Give your next investigation a head start.
Free accounts include wallet lookups, Trace My Funds quota, and cases. Pro unlocks deep investigation and monitoring.