Crypto investigation software
Every crypto case ends with a person. Start looking for them sooner.
Blockchain tools are good at telling you where money went. Investigators need to know who moved it. Glacier21 starts from whatever your case gives you, a wallet, an email, a phone number, a Telegram handle or a name, then traces the funds to where they cashed out and keeps it all in a case your team works together.
- Blockchains
- 35+
- Labeled wallets
- 500M+
- Off-chain tags
- 1.9B+
- Unique sources
- 580K+
Blockchains
Labeled wallets
Off-chain tags
Unique sources
The off-chain gap
What is in your case that your tool never showed you?
Every case closed with a chain-only tool leaves one question unasked: what was off-chain? None of it is written on the blockchain, so none of it appears in a tool that only reads the blockchain. You did not miss it. Your tool never looked.
The email in the breach
The suspect's address in a leaked customer database, sitting next to a wallet they once paid from. For teams with breach access.
The handle with the airdrop
The Telegram or X account that linked the same wallet years before anyone thought to hide it.
The page on the web
A payment ID or deposit address published on the general web, right next to the name of the person behind it.
The name in another language
A legal name written in Chinese or Cyrillic that an English-only search returns nothing for.
Glacier21 is #1 in off-chain. Full stop.
Let us show you what Glacier21 finds off-chain on an email, a handle or a wallet you choose. If nothing new turns up, you have lost an hour. If something does, you will want to know before the defense does.
- Off-chain tags
- 1.9B+
- Unique sources
- 580K+
- Labeled wallets
- 500M+
Off-chain tags
Unique sources
Labeled wallets
Start anywhere
The wallet is where the case starts. The person is where it ends.
Most cases arrive with an address or a transaction hash. The answer usually sits next to it, off-chain: the email on the account, the handle that posted the wallet, the phone number the scammer called from. So one search box takes all of them and connects each one back to the wallets.
Wallets and transactions
Emails and phone numbers
@handles and usernames
Names, in any language
Payment IDs
Domains and entities
Names in any language
Your suspect does not spell their name in English.
Type a name in Chinese, Cyrillic or Persian and Glacier21 matches it against legal names, aliases and sanctions listings, as written. Here three characters return an OFAC-designated individual and the exchange deposit wallets tied to him. A transliteration search would have missed him.
- Legal-name and alias matching
- Sanctions, exchange and identity context on every hit
- Pin any result straight into a case
Usernames
A username is a fingerprint people forget they left.
The same handle that ran the scam probably claimed an airdrop, joined a Discord or linked a wallet years ago. Glacier21 matches handles to the wallets their owner connected, across chains, with the other accounts that share them.
- Social accounts linked to wallets
- Solana, Ethereum and more from one handle
- Every match shows what it was matched on
Address profiles
The first question is always “who is this?”
So that is what every address profile answers first: identity, sanctions status and risk, then balances across chains, full history and top counterparties. Every label carries the source that produced it, because a label you cannot cite is only a rumor.
- Sanctions and law-enforcement flags up front
- Counterparties ranked by value
- Formal report, entity map and web footprint one tab away
Auto-trace
Money has to stop somewhere. Find where.
Stolen crypto is only useful to a thief once it becomes something else, and that usually happens at an exchange. Auto-trace follows the funds hop by hop and accounts for every unit: mixers, bridges, services, wallets still holding it, and the deposit addresses worth a subpoena or a freeze request.
- FIFO or haircut, your choice
- Exact UTXO tracing on Bitcoin
- Follows funds across 28 bridge protocols
Web footprint
People were careless in 2017. The internet kept the receipts.
Glacier21 searches the general web for an email, handle or payment ID and shows what was published next to it. Here a single WebMoney ID leads to a payment site that listed ten crypto wallets in one person's name, in Persian, for six years.
- Web pages with first and last seen dates
- Wallets published next to the identifier
- A written summary with a confidence level
Breach and leak intelligence
Criminals reuse emails and phone numbers like everyone else.
For teams granted access, Glacier21 links a searched email, phone or handle to leaked records and shows the exact chain of records that connects it to a wallet. It is powerful, so it is deliberately slow to misuse: every user accepts an intelligence-use notice first, and every lookup is logged to their name and case.
- See each hop between the search and the wallet
- Source breach and date on every record
- Granted per team, logged per lookup
Cases, together
Two investigators, one case, one version of the truth.
Cases usually fall apart in the gaps: the screenshot in someone's inbox, the trace on someone else's laptop. In Glacier21 your team works the same trace board and sees each other's cursors and edits as they happen, the way a design team shares one file.
- Live cursors and presence on the trace board
- Comments, @mentions and an activity feed
- Free viewers for prosecutors and clients
Built for the record
A brilliant trace is worthless if you cannot defend it.
The hardest question in a crypto case is often asked months later, by a defense attorney: how do you know? Glacier21 keeps the evidence, the reasoning and the history together so the answer is one click away.
A plain-English read on every search
Formal report and entity map
Hashed evidence snapshots
Tamper-evident activity log
Auto-traces you can rerun
Watermarked share links
One seat or a thousand
You should not need a procurement department to run a trace.
Start with one seat at a published price and add people as the work grows. The same product scales to an agency: cases stay optional, viewers are free, and roles control who can edit what. How teams and seats work →
Solo operator
Every tool in one seat: search, profiles, auto-trace, the AI analyst and cases. Pins land in a private scratchpad until you open a case.
- Private scratchpad and cases
- Invite a client as a case guest
- Annual single-user packages available
Small team
Share cases and work the same trace board live. Everyone sees who is on the case, where their cursor is and what just changed.
- Live cursors and presence
- Comments with @mentions
- Owner, admin, investigator roles
Growing unit
One discount applies to every seat once you reach five users, and annual billing goes deeper. Viewers never take a seat.
- Free, unlimited viewers
- Lead, contributor and viewer case roles
- Restricted cases
Large organization
Seats and volume set by contract, from 1,000,000 lookups a month, with API keys, invoicing and a security review.
- Tamper-evident audit log
- Up to 25 API keys
- Dedicated support, 99.95% SLA
FAQ
Questions investigators ask us.
How do you trace stolen cryptocurrency?
Start from the victim's sending transaction or the first receiving address. Glacier21's auto-trace follows the funds hop by hop, across chains and bridges, and stops where they reach a mixer, a service or an exchange. The exchange deposit address is what you send a preservation request or subpoena to.
How do I find out who owns a crypto wallet?
Search the address. Glacier21 shows any attribution it holds (exchange, service, sanctioned entity or individual) with the source behind it. If there is none, look at its counterparties, its web footprint and, for teams with access, breach records linked to it. Most identifications come from where the money cashed out.
Who is Glacier21 built for?
Investigators first: law enforcement, prosecutors' offices, private investigators, fraud and compliance teams, and attorneys working asset recovery. It works for one person on one matter, and for agencies running hundreds of cases.
Can I start from an email or a username instead of a wallet?
Yes. One search box takes wallets, transaction hashes, explorer links, emails, phone numbers, @handles, names in any language, payment IDs and domains. Glacier21 shows the wallets and records connected to what you typed.
Which blockchains do you cover?
35+ blockchains, including Bitcoin, Ethereum and EVM chains, Tron and Solana. Auto-trace follows funds across 28 bridge protocols and uses exact UTXO tracing on Bitcoin.
How does auto-trace work?
Pick a seed address, a method (FIFO or haircut) and limits. Glacier21 follows the money hop by hop and returns where it went: mixers, bridges, services, wallets still holding funds, and the exchange deposit addresses where it may have cashed out.
What is breach and leak intelligence?
It links a searched value or a wallet to records from third-party data breaches. It is granted per team, every user accepts an intelligence-use notice first, and every lookup is logged. Treat it as a lead to corroborate, not as proof.
Can my team work on the same case at once?
Yes. Cases are optional and shared. Teammates see each other's cursors and edits on the trace board live, comment with @mentions, and keep pins, findings and traces in one place. Viewers are free and do not take a seat.
Is the output usable in court?
Every label shows its source, pins are saved as hashed snapshots, auto-traces are reproducible, and the case log is tamper-evident. Our team of former federal prosecutors and FBI agents can also prepare reports and testify.
How do I get access?
Accounts are by invitation. Request a demo and we will walk you through the platform, then set up your seats.
See it live, not in a slide deck.
We will walk you through Glacier21 on real data: identity search, auto-trace, web footprint, breach intelligence and shared cases. Matters you would rather hand off can go to our in-house team of former federal prosecutors and FBI agents.
Keep reading