FORENSIC
CAPITAL

$3.8B drained. No zero-days. The code was public the entire time.

On-chain. Reconstructed block by block.

Scroll
46 Incidents Documented
$3.8B+ CORPUS LOSSES
100% Proven on-chain
0 Unverified claims
The position

You cannot write the report
on code you audited.

Audit firms have mandates. A mandate is a client to protect.
No mandate here. No prior engagement. Only the chain.

The chain doesn't lie.

Bridge · Oracle · Lending · Stablecoin · Liquid Staking · Perpetuals · Governance

Published reports.

Post-incident forensic reconstruction. Every finding independently verifiable.

FC-046 · 2026-07-11
Bonzo Lend — BLS Verifier Bypass

Degenerate BLS operands accepted by on-chain verifier. Identity and null elements caused pairing equality to hold for any message. $9.05M.

OracleBLS$9.05M
FC-001 · 2026-05-27
KelpDAO — DVN Threshold Bypass

LayerZero DVN requiredDVNCount=1 exploited. A single operator approved a fraudulent cross-chain message.

BridgeOracle$292M
FC-003 · 2026-05-28
Resolv USR — AWS KMS Credential Compromise

AWS KMS key held by a GitHub contractor. $23.8M drained in ~80 minutes — 17 in the initial mint.

CloudKey Mgmt$23.8M
All reports →

The incident already happened.
We reconstruct what others missed.

Forty-six incidents. One taxonomy. Every new exploit has a precedent.

01 — Traced block by block.

Block-by-block trace

Every transaction. Every call stack. Every state change. Root cause identified from on-chain evidence — not inferred from post-mortem summaries.

02 — Proven on-chain, or not at all.

Independently verifiable

Every finding carries a reproducible on-chain proof, an Ed25519 signature, and a Merkle anchor. Any analyst can verify independently. Zero speculation published.

03 — Holds up where it matters.

Defensible in 48 hours

Executive summary, financial exposure model, attack chain timeline, open questions declared explicitly. Delivered through a secure access portal. Defensible before claims committees.

Intelligence, published.

One brief per incident — forensic reconstruction, root cause analysis, and attack chain documentation
drawn from a corpus of 46 documented DeFi incidents. Cryptographically signed. Verifiable.
No paywall.

First contact

We share a finding
before any engagement.

No pitch deck. No discovery call. No forms.

marcus@forensic-capital.com

One email.