Methodology

Forensic Capital produces independent forensic intelligence on DeFi security incidents. Every report is built from primary, externally verifiable evidence — on-chain transaction traces, contract bytecode and storage, vendor and protocol post-mortems, and the cryptographic record of the event itself. Where a claim cannot be reconstructed from observable data, it is not made.

The analytical chain proceeds in four stages. First, observation: the incident is reconstructed transaction by transaction from chain data, with block heights, addresses, and call traces preserved as the evidentiary spine. Second, classification: each incident is assigned to the Forensic Capital Vulnerability Class Taxonomy, situating it by failure mechanism rather than by headline. This discipline matters — an event widely reported as one class of failure frequently resolves, on inspection, into another, and the distinction changes who is exposed and how it is remediated. Third, scoring: severity, defensibility, recovery probability, and blast radius are assessed against fixed published anchors, so that two analysts working the same evidence arrive at comparable figures. Fourth, corroboration: findings are cross-checked against multiple independent sources before a report is released.

Forensic Capital grounds its frameworks in established external standards. Vulnerability severity is expressed in CVSS terms. Failure mechanisms are mapped where applicable to MITRE classifications. Loss, cost, and recovery context draws on recognized industry baselines, including the IBM Cost of a Data Breach Report and the Verizon Data Breach Investigations Report.

The defensibility score is central. It measures how completely a finding can be reproduced from public and forensic data alone, without reliance on privileged access or unverifiable testimony. A high-tier report is one a reasonable reviewer could reconstruct independently and reach the same conclusion.

Forensic Capital does not disclose private operational methods, proprietary tooling, or the identities of sources. What it discloses is the standard every report is held to: evidence that is observable, classification that is consistent, and conclusions that are defensible on their own terms.