Wrench attacks, SIM-swap drains, and targeted phishing all start with the same OPSEC failure: an on-chain identifier (wallet, ENS, NFT mint) chained back to a leaked email, a real name, and a home address. DoxxScan™ finds those chains and helps you break them.
Each one starts from data that’s already public or leaked. We show you which specific records enable each chain and how to break them.
Physical attack at your home, demanding keys or seeds. The chain almost always starts with your wallet publicly tied to a real name, then property records to your address. r/cryptocurrency posts about these every week.
Attacker social-engineers your carrier, ports your number, intercepts 2FA codes, drains exchange accounts and hot wallets. Six-figure losses are routine. Requires only your phone number and your real name.
Etherscan + ENS + NFT mints + airdrop claims + Twitter handles compose into a fingerprint. Add one leaked email and your “anonymous” wallet has a real name, a 2014 password, and a current address.
Attackers see your balance on-chain, then craft a custom phishing message: a fake airdrop, a fake protocol notice, or a fake support ticket sized to your actual holdings. Generic phishing filters miss it because it’s aimed at one person.
DeleteMe and Optery scrub people-search sites. They don’t see the on-chain side of your chain. We see both.
Start free. Warden Plus is the recommended tier — 3 monitored credentials covers your wallet-tied email, your phone, and your business / ops email.
Run your first chain reveal. See the picture.
Continuous monitoring on 1 credential.
Everything in Warden, plus 3 credentials and full AI Concierge for hands-off OPSEC.
The questions we get from holders, builders, and operators after their first scan.
No. We never ask for wallet signatures, seed phrases, or on-chain proofs. The scan runs on a normal identifier (email, phone, handle). When chain mapping reveals an on-chain link, we surface it from public data — not from your wallet.
It helps for on-chain analytics. It does not help for the off-chain side. If any of those wallets ever interacted with an ENS, claimed an airdrop tied to a handle, was funded from an exchange you KYC’d at, or got mentioned in a tweet, the chain is recoverable. Address rotation is necessary but not sufficient OPSEC; the leak vector is usually email, phone, or handle reuse.
No. The scan touches breach databases, paste sites, and people-search broker sites. Nothing is written to any blockchain, nothing is sent to any exchange, and no KYC vendor is contacted on your behalf.
The wallet-to-name link can’t be retracted — the on-chain history is permanent. But the downstream chain (real name → home address, phone, relatives) is exactly what broker-removal breaks. We can’t hide that you’re Builder XYZ; we can make it materially harder for a wrench attacker to find your apartment.
Not at the moment — checkout runs through Stripe. We’re looking at it. Crypto-native payments add a KYC/sanctions-screening layer that takes integration work; we’d rather ship the product than half-ship the rail. If this is a dealbreaker, email us and we’ll figure out a manual workaround.
If your handle is the linking node, we’ll surface that on the chain map. Telegram/Discord themselves we don’t monitor — but breaking the email/phone/name chain takes the harasser’s leverage away (they can’t escalate to your address or call your carrier).
Yes — anytime, from your dashboard, in two clicks. The first 72 hours are a free trial: card authorized but not charged, and cancelling inside the trial is $0. After the trial, if you cancel mid-cycle you keep access until the period ends.
10 seconds. No signup for the first one. See your wallet↔identity chain map. 72-hour free trial on subscription · card auth, not charged · cancel inside = $0.
Start free scan →