ChainWitness
Investigations Report a scam
Crypto intelligence · Compliance · Evidence

Every crypto address leaves a trail. We keep the receipts.

ChainWitness finds where a crypto address was published — sanctions lists, exchange disclosures, research, paste sites, victim reports — and preserves the proof: dated, hashed and ready to show an investigator, a compliance officer or a court.

No card, no plan, no black-box score. Every claim links to its source.

Exhibit · Ethereum addressSanctioned
0x098B716B8Aaf21512996dC57EB0615e2383E2f96
Lazarus Group — Ronin Bridge exploiterListed by OFAC SDN · also in public attribution repositories
  • US Treasury · OFAC SDN14 Apr 2022
  • GraphSense TagPackspublic repository
captureWARC + screenshot + HTML
manifestSHA-256 of every file ✓
exposuretraced on-chain
An address ChainWitness tracks, as its report shows it.

ChainWitness in numbers

1M+attributed addresses, each with its source and date
100+sources: official lists, exchanges, vendors, research, repositories
5networks — Bitcoin, Ethereum, Tron, Solana, Cardano — plus USDT, USDC and LINK
7paste sites watched for bait wallets and scam drops

Figures of October 2026.

Why ChainWitness

Intelligence you can defend, not a score you have to trust.

Evidence, preserved the day it is seen

Every page where an address appears is captured on the spot: full-page screenshot, web archive (WARC), HTML and a manifest with the SHA-256 of each file. If the source changes or disappears, the original capture stays — and anyone can check the hash.

Confirmation counts origins, not copies

Three datasets repeating one tweet are one source. ChainWitness traces each label back to where it really came from and only calls an attribution corroborated when independent origins agree. When sources disagree, you see both.

Exchange wallets proven, not guessed

Wallets come from the exchanges' own proof-of-reserves — OKX, Binance, Bitfinex, HTX. Where the exchange signs each address, ChainWitness checks the signature. A wallet seen only in third-party lists is shown as a probable exchange, never as fact.

A person reviews what matters

Scam and bait findings from paste sites, and every report from a victim, are read by a person before they go public. Seed phrases and private keys are never shown. Anyone can request a review, and every decision is recorded next to the report.

How a finding is made

From a line on the internet to evidence in five steps.

  1. 01Collect

    Sanctions lists, exchange reserves, research, public datasets and paste sites, on a schedule.

  2. 02Validate

    Every address checked by format and checksum, on the network the source declares.

  3. 03Preserve

    Screenshot, WARC, HTML and SHA-256 manifest, stored and never edited.

  4. 04Corroborate

    Independent origins counted; conflicts surfaced, not hidden.

  5. 05Trace

    On-chain exposure to sanctioned and scam wallets, and to the exchanges where funds can be frozen.

Built for

The people who have to be sure.

Compliance & risk

Exchanges, banks and fintechs screening a counterparty before funds move — with a record of what was known, and when.

Investigators & courts

Police, expert witnesses and lawyers who need dated, verifiable evidence — exportable as PDF or JSON with every hash.

Victims & researchers

People tracing where their money went and warning the next person; journalists following scams, hacks and sanctions.

Made by forensic practitioners

Built the way evidence is judged in court.

Built from the demands of real cases involving crypto-assets, where chain of custody is non-negotiable and the ecosystem rarely makes it easy.

A lead, not a verdict

A finding links an address to published content, not to a person. It tells you where to look; you decide what it means. Read the full disclaimer.

Open about every source

Every list is named, dated and linked. Nothing is scored by a model you cannot inspect.

Free to check

Search any address without an account. A free account opens full reports, watched wallets and alerts.

Before you send, before you sign, before you testify — check the address.

Press, partnerships and data access: talk to us.