Forensics API for crypto investigations

Trace stolen funds
across 6 chains in 50 ms.

1F is a forensics-first API. Cross-chain investigation primitives — bridge tx pairing, fund-flow tracing, mixer correlation, behavioral fingerprinting — that return in single-digit milliseconds. Used by compliance teams, on-chain investigators, and crypto fund risk desks.

See a live exploit traced → Read API docs

Live demo: trace a famous bridge exploit

Paste a hack tx hash. Watch 1F identify the bridge, find the destination on the other chain, score the confidence — in under 100 ms. Then run it against your own investigations.

Open the live demo →

What you can ask 1F

GET /api/cross-chain/follow/{txHash}

Bridge tx pairing

Source tx → bridge contract → destination tx on the other chain. Per-bridge windows (LayerZero 3 min, Wormhole 30 min, Plasma 7 days). Confidence-scored.

GET /api/forensics/trace/{addr}

Cross-chain fund-flow trace

BFS forward across all chains. Highlights bridge hops. Ranks counterparties by risk. Returns a tree the dashboard renders as an animated d3 graph.

GET /api/forensics/mixer-correlate/{addr}

Tornado deposit ↔ withdrawal correlation

Probabilistic deanonymization. Matches deposits and withdrawals by denomination tier and timing window. Honest "investigative lead, not evidence" labeling.

GET /api/forensics/similar/{addr}

Behavioral fingerprinting

"Find me 20 wallets that behave like this Lazarus address." 16-dim feature vector + cosine ANN. New unflagged wallets surface automatically.

POST /api/forensics/screen

Bulk address screening

1,000 addresses per call. Returns OFAC/UN/EU sanctions, CEX deposit detection, mixer flag, MEV flag, hacker flag. Drop-in for exchange deposit gates.

POST /api/simulate/preflight

Pre-flight risk check

"Before this user sends, is the destination safe?" Detects sanctioned counterparty, bridge crossing, fresh address, sanctioned proximity. Verdict in 0.4 ms.

GET /api/timeline/replay/{addr}

Time-series playback

Bucketed cross-chain activity frames. Animate "tectonic" liquidity flow across ETH, BSC, Polygon, Arb, Base, Op in one timeline.

GET /api/cases/{id}/export

HMAC-signed chain-of-custody

Investigation case → JSON export with SHA-256 + HMAC-SHA-256 signatures. Court-admissible. Survives audit.

POST /api/watchlist

Watchlists with smart triggers

Webhook-fire only when valueTier ≥ X, or only when address surfaces on a chain it's never been on. HMAC-signed delivery, retry, dead-letter.

Oh, and the RPC works too

If you also need standard JSON-RPC, swap your Alchemy URL for https://1f.ai/v2/<key>. Sub-millisecond cache hits, all 6 chains, drop-in compat for the top 30 methods. Docs. We won't lead with this — but it's free.