Trace Wallets. Map Identities.

Paste a BTC or ETH address and instantly map every wallet it transacted with, ranked by volume and direction — rendered as a live money-flow graph, not a wall of hex.

Follow funds across several hops (victim → thief → intermediary → exchange) automatically, so an entire laundering path becomes one connected graph.

Counterparties are labelled against the live US Treasury OFAC sanctions list plus known mixers — so you instantly see when funds touch a red-line address.

The single most actionable signal in fraud: when traced funds reach an exchange or mixer, Aletheia flags it loud — because an exchange can identify the account holder under subpoena.

Find the social and forum accounts that publicly reference a wallet — the bridge from a pseudonymous address to a real human identity you can pivot on.

Resolve name.eth ↔ 0x address in both directions, turning a wallet into a human-readable handle to chase across social platforms.

Enumerate accounts for a handle across hundreds of platforms and discover the surrounding ecosystem of linked services.

Check an email against known public breach datasets to surface exposed credentials and the services it's registered to.

Find public Telegram channels referencing a target — where crypto fraud and scam operations actually coordinate (SerpAPI-powered).

Resolve names against public knowledge graphs, SEC EDGAR filings and the global GLEIF legal-entity registry for due-diligence leads.

Run reverse image search and facial cross-referencing on a subject photo, and extract EXIF metadata (time, GPS) from uploaded images.

Look up a plate, or upload a vehicle image to run AI-powered plate OCR and pull registry details.

WHOIS history, passive DNS, hosting and registrar footprints for any domain.

Enumerate real hosts from public CT logs — surfacing infrastructure that DNS brute-forcing and search engines never reveal.

A graded attack-surface report for a domain: email hygiene, subdomain sprawl, open ports and impersonation risk in one letter grade.

Geolocation, network ownership, open ports and CVEs, and scanner/threat reputation for any IP address.

Every identifier collapses into one canonical node across all your cases, so the same wallet or email found in five investigations becomes a single, correlatable entity.

Instantly see when an identifier in this case also appears in your other cases — the overlaps a spreadsheet would never catch.

Shortest-path between two entities ("how are these connected?"), hub detection via centrality, and automatic clustering of related entities.

Point the agent at a target and it plans, executes and pivots on its own across many steps — resumable and running in the background.

LLM synthesis turns raw findings into a structured, cited dossier, extracting typed entities and the relationships between them.

Every finding carries a corroboration-weighted confidence score, and events plot onto a chronological timeline and geospatial map.

Monitor a wallet, domain, email, username or IP on an hourly/daily/weekly cadence and get alerted only when something genuinely new appears.

Watch an address and be alerted when funds move to a new counterparty or a new account starts talking about it.

One screen showing every monitored target, its status and open alerts — built for teams and MSPs watching many targets at once.

Pipe alerts straight into Slack or Discord (auto-formatted) or any SIEM/SOAR endpoint via signed webhooks.

Organisations with per-case roles (owner / editor / viewer), so a team shares an investigation without sharing everything.

An append-only record of who viewed, exported or acted on what — the governance evidence enterprise and compliance buyers ask for first.

Every exhibit is SHA-256 hashed at ingestion, so any later tampering is detectable and the chain of custody holds.

Export a defensible, white-labelled dossier with per-exhibit hashes, capture timestamps and a chain-of-custody and methodology statement.