01
Orient the investigation
Frame the inquiry
Study a relevant incident, choose a sourced checklist, and record the authorized case title and examination scope.
Preparing your view
Checking the session, access policy, and current workspace data.
Blockchain investigation workspace
Study the breach.
Examine the chain.
Report the evidence.
ChainRadar brings incident research, step-by-step investigation playbooks, multi-chain public-data tools, source-qualified address intelligence, seed forensics, and integrity-bound reporting into one authenticated workspace.
6 blockchain profiler tools
11 investigation playbooks
3 seed forensic tools
Governed workspace
Specialist tool suite
Research · Observe · ReportAccess controlled
Built for disciplined public-ledger examination
Law enforcementDigital forensic teamsFinancial intelligence unitsIncident respondersCompliance investigatorsLaw enforcementDigital forensic teamsFinancial intelligence units
01 Operational workflow
Choose the right bounded tool for the evidence in front of you.
Select the network and source explicitly, inspect normalized public-ledger observations, retain acquisition context, and export a reviewable artifact where the tool supports reporting.
Entry point Protocol step Exit point
02 Investigation toolkit
Purpose-built modules for each stage of
the examination.
Each module has a defined network scope, source boundary, access decision, output format, and review path.
01
Blockchain Profiler
Inspect public addresses and transactions with six read-only tools spanning Bitcoin, major EVM networks, Solana, TRON, and local Monero address validation.
Open blockchain tools02
Seed Forensics
Generate standards-valid BIP39 material, derive and scan up to 40 selected-network public addresses, or recover exactly one missing word.
Open seed tools03
Address Intelligence
Separate chain facts from reviewed sanctions, exchange/custodian, and source-qualified abuse claims—without guessing ownership.
Search the directory04
Investigation Checklists
Follow 11 sourced, versioned playbooks with resumable task status and private notes for post-hack response, fraud, ransomware, wallet compromise, and more.
Open investigation playbooks05
Post-Hack Intelligence
Search a growing, administrator-reviewed incident library by year, chain, and attack pattern, with reported facts kept distinct from educational reconstructions.
Browse incident studies06
Technical Evidence Reports
Prepare supported transaction and seed-examination records with document control, source provenance, full identifiers, canonical exports, and SHA-256 manifests.
Review report workflow03 Post-Hack intelligence
Study reported attacks.
Know what still needs verification.
Search ChainRadar's imported research archive by target, year, chain, and attack pattern. Compare reported context, ordered attack sequences, contracts, root causes, and mitigations while keeping educational reconstructions clearly identified.
80+incident studies2016–2026archive coverage13attack patterns
Search the incident library Imported research records Local archive
01Wormhole BridgeBridge · signature verification202202Euler FinanceFlash loan · health-check bypass202303BybitSupply chain · access control2025 Reported facts and educational reconstructions are visibly separated.
04 Repeatable investigation path
Move from initial indicator to documented observation.
Use incident context, versioned playbooks, and bounded public-chain tools without losing the examination scope.
Open investigation playbooks02
Inspect public records
Acquire and analyze
Select the network explicitly, inspect the address or transaction, and keep provider limits and incomplete results visible.
03
Document the result
Review and export
Save checklist findings and missing work, verify integrity digests, and export a supported technical record for independent review.
Investigator review active
05 Analyst in control
Tool-assisted.
Investigator-reviewed.
ChainRadar structures public data and provenance; investigators set scope, corroborate source claims, document limitations, and approve conclusions.
- Chain facts separated from source claims
- Incomplete coverage remains explicit
- Human review before report finalization
06 Integrity-bound reporting
Make every observation traceable to its source.
Supported reports bind readable documents to structured acquisition records with source metadata, exact identifiers, examiner review, and SHA-256 integrity manifests.
Document controlReport, case, authority, custody, examiner, and reviewer references.
Acquisition provenanceNetwork, provider, timestamp, tool version, block position, and finality.
Integrity verificationSource response, normalized result, canonical report, and detached manifest.
Technical evidence package DIGESTS RECORDED
ILLUSTRATIVE MANIFESTREPORT / Public-chain examination
Provider responseSHA-256 recorded
Normalized observationSHA-256 recorded
Canonical reportSHA-256 recorded
SHA-256
5f8c…b91a 7e24…0c3dAcquired09:42:18Reviewed10:06:44Exported10:07:02
ChainRadar Governed investigator workspace
Begin with the evidence
you have.
Study a precedent, follow a sourced playbook, inspect a public-ledger identifier, or prepare a technical examination record from one authenticated workspace.