He read the extremists' chatrooms for twenty years. Now he reads the crypto scammers'.
EVAN KOHLMANN — analyst before most people finish grad school,
coder, courtroom witness, and now a Tribeca founder.
In a Tribeca office a few blocks from where he once ran his first intelligence company, Evan Kohlmann is doing the same thing he has done since he was a teenager: reading the internet's underworld and looking for the tell. The subjects have changed. The method has not. Where he once combed jihadist forums for the signal buried in the noise, he now combs crypto chatrooms, regulatory filings, and Telegram groups for the humans behind the next pump-and-dump.
His company, Cloudburst Technologies, sells what it calls "off-chain cyberintelligence" to the financial sector. The pitch is deceptively simple. Blockchain analytics firms can trace a wallet, but a wallet is not a person. Cloudburst tries to close that gap - to link on-chain money to the off-chain human networks that plan the fraud in the first place. Pig-butchering rings. Market manipulation. Scam syndicates that leave fingerprints everywhere except the ledger itself.
"The goal," Kohlmann told CoinDesk when the company raised its Series A, "is to give institutions visibility into risks and narratives shaping the digital asset ecosystem beyond the blockchain." That word - beyond - is the whole thesis. The crime does not live on-chain. It lives in the conversation.
New York Magazine called him "the Terrorist Search Engine." An FBI agent called him "the Doogie Howser of Terrorism." Both nicknames were about the same thing: recall, and how young he was when he had it.
Kohlmann grew up in South Florida and went to Pine Crest, a prep school in Fort Lauderdale. He studied at Georgetown's School of Foreign Service, then went on to law school at the University of Pennsylvania. He never took the bar exam. He didn't need to. By 1998, while still a student, he had talked his way into an internship at Steven Emerson's Investigative Project on Terrorism. By 2003 he was a senior analyst.
An FBI agent nicknamed him "the Doogie Howser of Terrorism" for exactly this reason - the young TV doctor who was operating on patients before he could legally drink. Kohlmann was quoted as an authority on al-Qaeda's European networks at an age when most of his peers were still in seminars.
The reputation followed him into court. For years he was one of the most frequently called prosecution expert witnesses in American terrorism trials, testifying about the online markers of homegrown radicalization. "Not every case necessarily has one of these or all of these," he told one jury, "but you do tend to see these factors pop up again and again." It was pattern-matching, offered under oath. Defense lawyers pushed back hard - and one uncomfortable fact they liked to raise was that the man testifying about jihadist ideology could not read, write, or speak Arabic. He worked in translation, and in the shape of the data.
Somewhere in that stretch, Kohlmann did something most analysts never do: he built the tool instead of asking for it. He founded Flashpoint, wrote its original code, and grew it from his bedroom into a cyberintelligence company that would become an industry name. He didn't just spot patterns - he shipped the software that spotted them at scale. That combination, the analyst who is also the engineer, is rare, and it is the through-line of everything he has done since.
For nearly 18 years, from October 2004 until March 2022, he was also the face NBC News put on screen whenever a plot broke. If you watched cable news react to a terror attack in those years, you probably watched Kohlmann explain it. Then, in 2022, he walked away from the newsroom to build something new.
The same instinct that mapped al-Qaeda's networks in 2004 now maps a scam syndicate in 2025. Follow the people, not the wallets.
Cloudburst was founded in the early 2020s and headquartered in New York. It raised a $3M seed round led by Strategic Cyber Ventures, with Coinbase Ventures and Bloccelerate joining. In September 2025 it closed a $7M Series A led by Borderless Capital, bringing total funding to $11M. The investor list is its own story: Coinbase Ventures and CoinFund from the crypto world, and In-Q-Tel - the CIA's venture arm - from the national-security world, on the same cap table.
The company describes what it does in the language of intelligence, not finance: autonomous OSINT collection, AI-driven enrichment, entity resolution. Translated, that means it ingests the chatter - chatrooms, forums, filings, news, social sentiment - and resolves it into named actors and mapped networks. It claims its signals can flag market manipulation before it lands. Whether or not that promise holds, the ambition is clear: do for crypto fraud what he spent two decades doing for terrorism.
He is not doing it alone. His COO and general counsel, Michael O'Connor, was Global Head of Litigation at the crypto exchange Kraken. His CTO, Ben Turner, is a former Flashpoint engineer, DHS watch analyst, and U.S. Army paratrooper. It is a team assembled from the exact seam Cloudburst is trying to occupy - the place where finance, technology, and intelligence overlap.
Kohlmann's output was never just testimony. In 2004 he published "Al-Qaida's Jihad in Europe: The Afghan-Bosnian Network," a study of how the Bosnian war seeded a generation of European militancy. He later produced "The Al Qaida Plan," a 90-minute documentary that was presented at the Guantanamo Military Commissions - a piece of work that doubled as evidence. Few analysts get to write the history and then have it entered into the record.
Not everyone was convinced. His book was passed over by the University of Pennsylvania Press. Marc Sageman, a forensic psychiatrist and former CIA officer, dismissed some of his courtroom work as "so biased, one-sided and contextually inaccurate" for legal proceedings. A George Washington University law professor quipped that Kohlmann seemed to have been "grown hydroponically in the basement of the Bush Justice Department." He was, in other words, a polarizing figure - trusted enough to be paid by the government at rates reported up to $400 an hour, contested enough that defense teams built whole cross-examinations around his gaps. He treated the friction as part of the job, describing his testimony as one side of an adversarial process.
To understand Cloudburst, start with what it is not. It is not another blockchain-forensics company tracing coins from wallet to wallet. That market is crowded, and it stops at the edge of the ledger. Kohlmann's whole career says the interesting part is past that edge - in the human coordination that happens before a single transaction is signed. A pig-butchering scam is a script and a call center before it is a transfer. A pump-and-dump is a coordinated conversation before it is a candlestick. Cloudburst's wager is that if you can read the conversation, you can see the crime coming.
So the platform ingests the unglamorous stuff: chatrooms, forums, regulatory filings, news, social sentiment. It enriches that raw feed with AI, resolves fragments into named actors, and illuminates the connections between them. The company frames this as "autonomous threat and financial intelligence," and it sells to the constituencies that most need to see around corners - exchanges, regulators, law enforcement, and institutional investors. It is the Flashpoint idea, ported from counterterrorism to finance: the internet never forgets who was talking, and the people planning the fraud almost always talk first.
The strange specific of Evan Kohlmann is not that he is an expert. It is that he keeps building the machine that makes the expertise scale, and then pointing it at whatever criminal network is hiding in plain sight this decade. First it was terror cells. Now it is crypto scammers. The targets keep changing. The pattern-hunter does not.
Joins Steven Emerson's Investigative Project on Terrorism as an intern - while still a student.
Becomes a senior terrorism analyst, cited widely on al-Qaeda's European networks.
Publishes his book on the Afghan-Bosnian network; begins as NBC News terrorism analyst.
Founds Flashpoint, writing the original code himself and leading fundraising.
Leaves NBC News after nearly 18 years; founds Cloudburst Technologies.
Cloudburst raises $3M seed, led by Strategic Cyber Ventures with Coinbase Ventures.
Closes a $7M Series A led by Borderless Capital; total funding reaches $11M.
Scaling AI and data-science teams to map the human networks behind crypto crime.
"Give institutions visibility into risks shaping the digital asset ecosystem beyond the blockchain."
He was a senior terrorism analyst before he was old enough to have finished grad school.
He went to Penn Law and never took the bar exam. He built software instead.
Two decades of terrorism analysis - and he does not read, write, or speak Arabic.
He wrote Flashpoint's first product himself, from his bedroom, before it became an industry name.
In-Q-Tel, the CIA's venture arm, is an investor in his crypto-intelligence startup.
His COO ran litigation at Kraken; his CTO is a former Army paratrooper and Flashpoint engineer.