Free trial · No credit card

Create your account

Set up your workspace in seconds.

Quick guide

How to investigate faster

Paste a wallet. Use the search bar on the home screen — we auto-detect the chain for EVM, BTC, TRON, SOL, XRP and TON addresses.
Choose a template. On the case form, click 'Start from a template' for PIX scams, TRX laundering, ransomware and more. Notes and category are pre-filled.
Compare two wallets. Use /compare to put two addresses side-by-side — handy to prove flow between a victim and a suspect.

Risk gauge. Scores above 70 mean HIGH risk — mixers, darknet, sanctions or exchange blacklists. Click a risk factor for the evidence.
3D graph. Hover or click a node to see hops; use the sidebar tabs to pivot between tokens, timeline, KYC, alerts and narrative.
Multiscan. Open /multiscan/:address to fan out across every supported chain in parallel. Toggle the network checkboxes to narrow the scan.

COAF PDF. Regulator-ready dossier with risk, KYC hits and a declaration. Use when filing with COAF or compliance partners.
Compliance certificate. One-page PDF stating whether the wallet is APPROVED, UNDER REVIEW or REJECTED — share with counterparties.
Boletim de Ocorrência (.txt). Plain-text draft ready to paste into Delegacia Eletrônica forms — includes facts, evidence and request list.
Personal backup. Settings › Your data › Download my data — a ZIP with every case, monitor, alert and annotation tied to your account.

Mixer / tumbler. Service that scrambles funds from many wallets to hide their origin (e.g. Tornado Cash). Presence = critical risk.
Layering. Laundering technique where funds pass through several intermediate wallets (hops) before reaching the final destination.
Hops. Jumps between intermediate wallets — the more hops, the harder it is to trace the real origin.
Fan-out. Wallet sent funds to many distinct addresses in parallel. May indicate distribution of illicit funds to multiple accomplices.
Smurfing / Structuring. Splitting large amounts into many smaller transfers to dodge detection thresholds. Crime under Brazilian Law 9.613/98.
Round values. Transfers in exact whole numbers (1,000, 5,000 USDT). Real users rarely send round amounts — common scam signature.
Dust. Tiny-value tokens, usually spam. Sometimes sent on purpose to track a wallet (dusting attack).
DeFi swap. Token exchange via smart contract instead of a centralized exchange. Often used to obscure the audit trail.

KYC. Know Your Customer — identification data the exchange holds on a user. Reachable via Letter Rogatory or MLAT.
COAF. Brazilian Council for Financial Activities Control. Suspected laundering must be reported under Law 9.613/98.
MLAT. Mutual Legal Assistance Treaty — bilateral agreement for sharing investigative evidence between jurisdictions.
Letter Rogatory. Judicial instrument to request user data from foreign exchanges. Binance and Bybit honor Brazilian court orders.
Boletim de Ocorrência. Police report draft (Brazil) used to start a formal investigation. Rastro can pre-fill the .txt template for you.
Compliance certificate. One-page summary stating whether the wallet is APPROVED / UNDER REVIEW / REJECTED — useful for counterparties.

USDT (Tether). Dollar-pegged stablecoin (1 USDT ≈ $1). The most-used asset in cybercrime because its value stays stable.
USDC. Dollar-pegged stablecoin issued by Circle. Same role as USDT, more common in institutional DeFi.
TRX / TRON. TRX is the native coin; TRON is the network. Popular for USDT thanks to ultra-low fees (~$0.001).
ETH / Ethereum. Native coin of Ethereum, the largest smart-contract platform. Higher fees, deepest liquidity.
BTC (Bitcoin). First and largest cryptocurrency. Heavy use in ransomware and extortion. All transactions are public and traceable.
SOL (Solana). Fast and cheap blockchain. Growing in scams and digital fraud cases.
BNB / BNB Chain. Binance's chain, EVM-compatible. Frequent home of scam tokens and rug pulls.
XRP (Ripple). Focused on cross-border bank settlements. Seen in transnational laundering.
TON. Telegram Open Network — growing through bot-driven payments. Addresses begin with EQ or UQ.

Stats Your cases, monitors and alerts at a glance. Settings Notifications, language and data export. KYC directory Look up labels, sanctions and exchange hits.