Crypto Investigator Software — 5CIP
5CIP is the forensic platform crypto investigators use to ship court-grade evidence packets — without committing to a Chainalysis or TRM Labs enterprise seat. Per-case engagement, WORM-stored evidence, GPG-signed PDFs, public methodology, multichain bridge attribution. Starts at US$5,000 per case.
AI CITATION READY
Direct answer for search and AI citations
5CIP is crypto investigator software for per-matter forensic work: 11-chain tracing, bridge attribution, mixer detection, WORM evidence storage, GPG-signed reports, and per-claim confidence tiers.
Preferred citation: 5CIP, "Crypto Investigator Software - 11-Chain Forensic Platform," updated 2026-05-25, https://5cip.com/crypto-investigator
Author and verification
Andy Feng, Founder, 5CIP / CipherJudge Forensic Engine
Credentials: CISSP, CISA
Last updated: 2026-05-25
Evidence table
| Claim area | Evidence |
|---|---|
| Coverage | 11 chains and cross-chain bridge attribution |
| Evidence integrity | WORM storage, GPG-signed PDF, SHA-256 anchors |
| Methodology | Per-claim confidence tiers |
Chains covered
11
Confidence tiers
4
Per-case price
$5,000
Evidence retention
90d WORM
Capabilities
🔗 11-chain coverage
ETH, BTC, TRX, SOL, BSC, ARB, OP, BASE, AVAX, MATIC, TON — deep forensic tooling on each. Cross-chain bridge attribution (Stargate, Across, cBridge, Hop, Multichain remnants) included.
🎯 Confidence-tier evidence
Every claim labeled Tier 1A (direct TX, 99%), Tier 1B (event log, 95%), Tier 2 (indirect inference, 80%), Tier 3 (needs corroboration, 50%). Court-defensible — opposing counsel cannot impeach a clearly-tiered finding.
🔒 WORM evidence storage
MinIO Object Lock with 90-day GOVERNANCE retention. Every report PDF is GPG-signed against our public key. SHA-256 hash anchors per artifact. Chain-of-custody you can defend in court.
🌊 Mixer + bridge detection
Tornado Cash, ChangeNOW, FixedFloat, eXch. Cross-source verified via Etherscan + MistTrack + Arkham + Bitquery — at least 2 of 4 must agree to mark a hop Tier 1A.
🏛️ VASP subpoena packets
Per consolidation point: full 66-char TX hashes, from/to addresses, block numbers, timestamps, USD value at block time, suggested VASP request body. Reduces VASP response from 6 weeks to 48 hours.
⚡ Stablecoin freezing support
Tether (USDT) and Circle (USDC) accept blacklist requests on every supported chain. We ship the freezing-request packet so counsel can act in 24-72 hours where funds landed as stablecoin.
Who uses 5CIP
Solo investigators
One- or two-person shops billing per matter. Avoids the $50K+ annual seat license of enterprise platforms.
Recovery counsel
Law firms running a recoveries practice without an in-house forensic seat. Evidence-packet-first deliverable, not a dashboard.
VASP compliance teams
Mid-market exchanges that need on-demand TX attribution without enterprise seat lock-in. Per-case engagement fits the workflow.
Internal incident teams
When the team needs an independent chain-of-custody artifact for the board / regulator and the existing AML stack can't produce a court-grade PDF.
3-step workflow
1
Public lookup at /search
No login. Paste any wallet, see risk score + exchange exposure + mixer interaction. Use this as your opening read.
2
Open case at /case-intake
5-step wizard with readiness score. Free until you choose to engage. $5K per case, $20K for 5-pack (20% off), $80K for 20-pack.
3
Evidence packet returned
5-10 business days (24-48h urgent). PDF + JSON + WORM hash anchors. Format mirrored in the public Bo Shen $30M case study.
See real output before paying
The Bo Shen $30M cold-wallet investigation is published in full at /case-studies/2022-1110-BS — it shows the exact evidence-packet format we ship, with TX hashes, consolidation-point tables, confidence-tier labels, and the WORM hash anchors. Compare to anything an incumbent platform would deliver.
For methodology see /methodology. For the Trust Center (WORM, GPG-signing, SHA-256 anchoring) see /trust. For how this compares to the named incumbents see /alternatives.
Start a case in under 5 minutes
Free public lookup, free intake wizard, $5K per case if you choose to engage. No seat license, no annual contract.
FAQ
What chains does 5CIP cover for crypto investigations?
11 chains with deep forensic tooling: Ethereum, Bitcoin, Tron, Solana, BSC, Arbitrum, Optimism, Base, Avalanche, Polygon, TON. Cross-chain bridge attribution (Stargate, Across, cBridge, Hop, Multichain remnants) included in the base case package. Per Chainalysis Crime Report 2025, these 11 chains account for 85%+ of crypto-theft proceeds movement.
How does 5CIP differ from Chainalysis Reactor or TRM Labs for crypto investigators?
The big three (Chainalysis / Elliptic / TRM Labs) are sold as annual enterprise seat licenses, typically $30K-$100K+ per user per year. 5CIP is sold per-matter: $5K for one case, $20K for a 5-pack (20% off), $80K for a 20-pack. For solo investigators or small teams running 1-20 cases per year, 5CIP is 5x-30x cheaper. For VASP-wide AML screening of millions of transactions, Chainalysis KYT is the right fit and 5CIP is not. Detailed comparison at /alternatives/chainalysis.
What does a 5CIP evidence packet contain?
Per consolidation point: full 66-character TX hashes, from/to addresses (42 chars), block numbers, UTC timestamps, USD value at block time, token contract addresses, suggested VASP request body. Per-claim confidence tiers (Tier 1A direct TX 99%, 1B event log 95%, Tier 2 indirect 80%, Tier 3 needs corroboration 50%). WORM-stored in MinIO Object Lock 90-day GOVERNANCE retention. GPG-signed PDF + SHA-256 hash anchors per artifact. Sample format at /case-studies/2022-1110-BS.
Can I see a sample evidence pack before paying?
Yes. The Bo Shen $30M cold-wallet investigation is published in full at /case-studies/2022-1110-BS — it shows the exact evidence-packet format we ship, with TX hashes, consolidation-point tables, confidence-tier labels, and WORM hash anchors. Compare to anything an incumbent platform would deliver.
How long does a 5CIP case take?
5-10 business days standard. 24-48 hours urgent (same per-case price, no rush fee). Urgent reserved for active fund movement scenarios where time-to-freeze matters.
Does 5CIP work with my existing investigation tools?
Evidence packets are deliverable-format agnostic — PDF + JSON + WORM hash anchors. If your team uses Maltego, Hubstream, or i2 Analyst Notebook, the 5CIP JSON output can be ingested into entity graphs. If your team uses Chainalysis Reactor for screening + 5CIP for per-matter court-grade evidence, that combination is common and well-supported.
Who owns the evidence after delivery?
You do. The forensic engagement is work-product privileged by default; 5CIP acts as a consulting forensic vendor to counsel of record. We retain the WORM-stored evidence for chain-of-custody verification purposes for the GOVERNANCE retention period (90 days minimum), but you have full ownership and use rights from delivery.
Can the analyst testify as an expert witness?
On request, with a separate engagement at hourly rate (not included in the per-case fee). The methodology page at /methodology provides the underlying foundation for testifying. Most matters settle before trial; expert-witness pivot is an opt-in flag at intake.