Where did the funds come from?
Trace the immediate counterparties. Keep transaction references close to the question you are trying to answer.
INDEPENDENT INTELLIGENCE. CONNECTED.
The signal before
the damage.
Follow the money. Understand the threat. Connect onchain exposure and offchain intelligence in a private desktop workspace built for the people protecting digital assets.
GROUNDTRUTH WORKSPACE / ILLUSTRATIVE INVESTIGATIONONE CONNECTED INVESTIGATION
groundtruth / investigation 001 PRIVATE WORKSPACE
ILLUSTRATIVE PRODUCT PREVIEW
COMMON SOURCE
01/03An unexpected connection.
Many networks. One connected investigation.Explore the workflow
EXPLORE THE PLATFORM
One workspace.
Four ways into the investigation.
01
Onchain investigations
Follow activity. Examine relationships.
Explore capability02
Threat intelligence
Connect financial and technical context.
Explore capability03
Casework & evidence
Give every finding a defensible record.
Explore capability04
Watchlists & review
Keep important investigations in view.
Explore capabilityTHE QUESTIONS BEHIND THE SIGNAL
More data is easy.
A clearer decision takes context.
What else is connected?
Look beyond an isolated address. Review contract relationships, infrastructure, and the intelligence sources relevant to the case.
Can someone else review the finding?
Preserve the evidence, record your reasoning, and give the next analyst a useful starting point.
THE INVESTIGATION WORKSPACE
A transaction is a fact.
A pattern is intelligence.
Move from raw activity to a structured investigation. Explore relationships, preserve the source context, and document what deserves a closer look.
DESKTOP WORKFLOW / SIGNAL DISCOVERYCONCEPT
Unusual patternFOCUS: CONNECTED ECOSYSTEMS
01
Give your attention a direction.
A focused queue of signals, with the context to decide what deserves a closer look.
A connected workflow, from the first observation to a reviewable evidence package.Explore the platform
THE INTELLIGENCE FOUNDATION
A wider field of view.
A precise starting point.
Begin with the public record. Expand the investigation through the relationships, source context, and analyst knowledge that give it meaning.
THE PUBLIC RECORD
Onchain evidence
Wallet activity, native balances, deployed code, and contract metadata. A reproducible snapshot at a specific block.
THE WIDER PICTURE
Threat context
An investigation model for connecting wallet leads with actor reporting, campaigns, and technical indicators from licensed sources.
THE HUMAN JUDGMENT
Analyst knowledge
Case notes, review status, saved watchlists, and evidence packages. Keep the reasoning with the record.
NETWORK COVERAGE
Five networks.
One investigation approach.
Direct network reads, public explorer context, and a consistent record across ecosystems.
Explore the coverage modelBUILT AROUND THE WORK
Different mandates.
The same need for clarity.
From the first suspicious transfer to a considered ecosystem review, give every investigation a method and every handoff a usable record.
SECURITY OPERATIONS / INCIDENT RESPONSE
Give an incident a clear evidence trail.
A suspicious address is a starting point. Capture its state, review the indexed activity, and turn the strongest leads into a case another analyst can pick up.
- THE STARTING POINT
- An address associated with a reported exploit or suspicious transfer.
INVESTIGATION PLAYBOOK / 01
- 01
Capture the address and relevant network snapshot.
- 02
Inspect counterparties, contract context, and source references.
- 03
Record the hypothesis, unresolved questions, and follow-up actions.
THE DELIVERABLE
Incident evidence brief
An incident brief with transaction references and a clear investigation scope.
Address → counterparties → source record
INTELLIGENCE YOU CAN EXPLAIN
The finding matters.
So does the reasoning.
When a case moves between teams, the context should move with it. GroundTruth keeps the source record, the analyst’s interpretation, and the next question together.
01
Observe
Capture what the source actually reports, with the network, block, and time that put it in context.
02
Interpret
Describe the relationship and record your hypothesis. Keep uncertainty and alternative explanations visible.
03
Review
Save the rationale, mark the case’s review state, and export a record the next person can examine.
GROUNDTRUTH / EVIDENCE RECORD
ILLUSTRATIVE CASE BRIEF
Treasury counterparty review
One record. Enough context for the next decision.
- Review scope
- Counterparty activity on Ink
- Evidence basis
- RPC snapshot + indexed activity
- Source references
- Network, block, transaction, timestamp
- Analyst record
- Hypothesis, rationale, open questions
- Review state
- Analyst reviewed
ANALYST NOTE
Review the funding relationship in context. A shared counterparty is an observation; the case records the evidence needed to assess its significance.
JSONCSVMARKDOWN
THE PARTNER PROGRAMME
Every ecosystem.
A wider
perspective.
Independent exchanges, asset services, and security teams see different parts of the same threat. GroundTruth brings those perspectives into a common investigation approach, shaped around each partner’s priorities.
Explore ecosystem partnershipsECOSYSTEM INTELLIGENCE
EXCHANGES / SERVICES / ECOSYSTEMS
EXCHANGES / SERVICES / ECOSYSTEMS
01
See the ecosystem as a whole.
Give the team a shared starting point for reviewing protocols, counterparties, and emerging patterns.
02
Bring context to the response.
Trace a lead from the first alert to a source-backed case the right team can act on.
03
Help good builders move forward.
Make diligence more repeatable, with evidence that can be checked and questions that can be answered.
ONE PLATFORM. MULTIPLE ECOSYSTEMS.
THE INTELLIGENCE ECOSYSTEM
Onchain. Offchain.
One connected case.
Follow the funds with blockchain intelligence. Understand the actors with threat intelligence. Bring the infrastructure and the evidence into the same picture.
INTELLIGENCE SOURCESChainalysisFlashpointRecorded FutureTRM LabsVirusTotal
Follow the exposure.
Chainalysis, TRM Labs, and Elliptic. Wallet screening, transaction context, and entity attribution, attached to the case that needs them.
Understand the adversary.
Flashpoint and Recorded Future. Bring deep and dark web reporting, threat-actor context, and indicator relationships into the investigation.
Commercial sources require appropriate API access and licensing. Data entitlements and network coverage vary by provider.
Explore all 11 integrationsFIT THE WAY YOUR TEAM WORKS
Your workspace.
Your environment.
Work with a local case store or connect the desktop app to a GroundTruth server in your environment. Choose the data boundary that fits the investigation.
THE ANALYST
GroundTruth workspace
Investigations · Notes · Evidence
THE INVESTIGATION LAYER
Private case store
Local or connected workspace
THE SOURCE RECORD
Network & explorer
Public data · Source references
FROM THE FIELD LIBRARY
Build the practice
behind the investigation.
Incident response / 5 min read
The first review of an onchain incident
A practical sequence for turning a reported address into a scoped, reviewable investigation.
Read the playbookCounterparty diligence / 5 min read
Build a counterparty review someone else can follow
A structured approach to reviewing a public address without losing the business context behind the question.
Read the field guideIntelligence practice / 4 min read
Confidence belongs to a claim, not a dashboard
Keep observations, source assessments, and analyst conclusions distinct throughout an investigation.
Read the methodologyTHE PRACTICAL DETAILS
Evaluate with
the right questions.
Which investigations is GroundTruth designed for?
GroundTruth supports address and contract investigations, incident triage, counterparty reviews, and ecosystem diligence. Begin with a public address, inspect the available evidence, and preserve the reasoning behind your next decision.
Which networks can my team investigate?
Address investigations cover Ink, Ethereum, Base, Arbitrum, and Optimism. GroundTruth combines a block-specific network snapshot with available explorer context. Indexed activity, source coverage, and provider limits are kept in context so your team can assess the evidence appropriately.
How does GroundTruth keep a finding reviewable?
A case keeps the address, network, snapshot context, source references, and analyst notes together. Observed relationships remain separate from your conclusions. Review status and exported briefs help the next analyst understand both the evidence and the open questions.
Can we work with our own intelligence sources?
Integration scope starts with your existing provider licenses, API access, and operational requirements. Blockchain analytics, threat-actor reporting, infrastructure intelligence, and security operations tools each contribute a different kind of context. Data entitlements and coverage are assessed source by source.
How do we hand an investigation to another team?
Export a structured JSON evidence package, a CSV transaction worksheet, or a Markdown case brief. The saved analyst notes and source references travel with the relevant case export, giving reviewers a record they can inspect in their own workflow.
Can GroundTruth fit our own operating environment?
Use a local workspace with a case database on your Mac, or connect to a GroundTruth server with account-scoped access. The Security page explains the storage, session, and network boundaries so your team can evaluate the deployment against its requirements.
THE NEXT CONNECTION IS THE ONE THAT MATTERS.
MANY ECOSYSTEMS / ONE CONNECTED PICTUREConnect the dots.
Own the investigation.
A wider view of the threat.
A clearer next move.