On-chain & OSINT investigations
Ancient patience.
Modern forensics.
On-chain tracing and OSINT investigations. We follow funds through wallets, mixers and exchanges to attribution — and hand you a report you can act on.
On-chain tracing
Follow funds through hops, bridges and mixers to the exchange.
OSINT investigations
Connect wallets, handles and infrastructure to real identities.
Evidence reports
A clear, sourced report for exchanges, lawyers and police.
Services
Intelligence.
Diligence.
Attribution.
MAAHES runs OSINT investigations, counterpart due diligence, and on-chain tracing of stolen, frozen and lost crypto.
OSINT investigations
We connect wallets, handles, infrastructure and companies to real identities — and document every link.
Covers
- wallets
- handles
- infrastructure
- companies
Background checks
We vet counterparties before investment, partnership or hire: hidden affiliates, sanction exposure, prior schemes and on-chain footprints that standard diligence misses.
Covers
- hidden affiliates
- sanction exposure
- prior schemes
- on-chain footprints
On-chain investigations
We follow funds through hops, bridges, mixers and exchanges until the trail becomes an actionable freeze, claim or case file.
Covers
- hops
- bridges
- mixers
- exchanges
Methodology
A mixer is not the end of the trail.
It is a change of
method.
Most traces die at a mixer, a bridge or an OTC desk. Ours are built to continue past the point where a block explorer stops.
How we treat mixers
Custodial tumblers, CoinJoin and smart-contract pools break the visible link between deposit and withdrawal. The graph link disappears. Behaviour does not. We classify the mixer, study denominations, timing, entry/exit patterns, adjacent swaps and exchange touchpoints. Where one-to-one matching is impossible, we build a sourced probabilistic case and test it with OSINT.
Channels that make a trace usable
A perfect graph is worthless if there is nowhere to send it. We maintain working contacts with law enforcement across jurisdictions and established relationships with CEXs and exchangers — so freeze requests, KYC leads and evidence packs move while funds are still reachable.
Tools
We use the strongest available on-chain, de-mixing, clustering and OSINT stack — forensic platforms plus methods developed in-house. Tools accelerate a hypothesis. They do not replace the investigator.
Beyond the chain
Classical OSINT reports
MAAHES also produces classical OSINT reports with no on-chain component: proof of funds, proof of reserves and background checks.
We verify that claimed capital, companies and assets actually exist — banked, titled, controlled — and that the person or entity behind them is who they say they are. The work covers source of funds and source of wealth, beneficial ownership, hidden affiliates, sanctions and litigation exposure, prior schemes and the paper trail that a registry search alone will miss. You receive a sourced file built for counsel, compliance, a counterparty or a deal desk: what can be confirmed, what cannot, and where the story breaks.
Research
Practice you
can read.
MAAHES is built on the founder’s public body of work — not on agency slide decks.
Founder
Vladimir Sobolev, known as Officer’s Notes (OfficerCIA), is a threat researcher focused on OpSec, OSINT and on-chain investigations. He has published extensively on Web3 security, operational security and incident tracing. The core archive lives at officercia.medium.com, with further work on Mirror, Paragraph and open handbooks, including the Awesome On-Chain Investigations HandBook.
Why it matters
The methods we use were stress-tested in public: mixer analysis, hack post-mortems, victim-error studies, attribution tooling and recovery workflows. A MAAHES case file sits on that discipline.
Blog
Notes from the field.
Mission
We follow funds past the point where explorers stop. Through hops, mixers and silent wallets we restore the trail — then bind it to a name and deliver a file that can be acted on.
A public ledger is not a maze. It is a record. We read it until the record becomes a route, the route becomes identity, and identity becomes evidence.
The trail does not end
A mixer, a bridge or an OTC desk is a change of method, not a wall. We keep reading behaviour — timing, denominations, exits — until the graph becomes usable again.
Source first
Every hop is preserved before it is interpreted. Screenshots, raw traces and timestamps stay attached to the claim, so the file survives an exchange desk, counsel and a courtroom.
Bind it to a name
On-chain without identity is a map with no destination. We connect wallets, handles, infrastructure and companies until the last mile is documented.
FAQ
What we will and will not do.
01What does MAAHES actually do?
We run on-chain tracing, OSINT and counterpart diligence. We follow stolen, frozen or lost crypto through wallets, hops, bridges, mixers and exchanges — then connect that path to identity and deliver a sourced report that exchanges, counsel and police can act on.
02Can you recover the funds?
We do not take custody of assets and we do not promise a return. Recovery happens when a freeze, a claim or a legal process still has somewhere to land. Our job is to make that landing possible: a usable trail, attribution, and an evidence pack while the funds are still reachable.
03What if the funds went through a mixer?
A mixer is not the end of the trail. It is a change of method. Custodial tumblers, CoinJoin and contract pools break the visible graph. Behaviour does not. We classify the mixer, study denominations, timing, entry/exit patterns and adjacent swaps, then test the case with OSINT. Where one-to-one matching is impossible, we build a sourced probabilistic case and label it as such.
04Do you need my seed phrase or wallet access?
Never. We will not ask for a seed phrase, a private key, a screenshot of a recovery phrase, or for you to install remote-access software. If someone claiming to be us does — it is not us. We work from public chain data, the transaction hashes you already have, and open-source intelligence.
05What do I receive?
A written report with sources attached: addresses, hops, timestamps, clustering rationale, OSINT links and recommended next actions (freeze request, counsel, law enforcement). The file is built to be forwarded, not decoded.
06Do you work with exchanges and police?
Yes. A perfect graph is worthless if there is nowhere to send it. We prepare freeze-ready packs and work through established channels with CEXs and law enforcement where the jurisdiction and the facts support it. We do not impersonate law enforcement and we do not guarantee a freeze.
07Will you guarantee a result?
No. Anyone who guarantees recovery, a named suspect or a freeze is selling certainty the ledger does not give. We guarantee method: preserved evidence, a documented trail, labelled confidence, and a report you can hand to the next desk.
08Is the work confidential?
Yes. Case material stays with the engagement. Public write-ups happen only when you agree, or when the facts are already public and no client is exposed.
Order
Bring the trail. We take it from there.
Send the hashes, dates, chain and what you have already tried. We reply with scope, whether the trail is still alive, and how to proceed.