Blockchain tracing
We follow funds across hops, bridges and chains to the point they left the blockchain, and document every step.
We trace stolen digital assets across blockchains, identify where they were cashed out, and build the evidence that exchanges, regulators and law enforcement will act on. We cannot promise recovery — nobody honestly can — but we will tell you exactly what your case is worth pursuing.
Stolen crypto is typically moved through mixers, bridges or exchanges within hours. A freeze at a receiving exchange is only possible while the funds are still sitting there — which is why the first 72 hours decide most cases. Read the 72-hour action plan →
Four disciplines applied to one question: where did the money go, and is there anyone left holding it who can be compelled to give it back?
We follow funds across hops, bridges and chains to the point they left the blockchain, and document every step.
Device, email header and communications analysis to establish how the compromise happened and who was behind it.
Attribution work linking wallets, domains, personas and infrastructure to identify the operation behind your case.
Evidence packages for exchanges, regulators and law enforcement — and support through the legal process that follows.
You will know at every point what is happening, what it costs, and what the realistic prospect is.
You submit a report. We review it and tell you whether there is a realistic path — free, and with no obligation.
Scope and fees are agreed in writing before any work starts. You can have the agreement reviewed independently.
Blockchain tracing, forensics and OSINT to establish where the funds went and who handled them.
Documented reports submitted to exchanges, regulators and law enforcement, with support through the process.
We report the outcome plainly, whether or not funds are returned, and hand over the full evidence package.
Everything you upload is hashed with SHA-256 the moment it arrives, so any later alteration is detectable. Files are stored outside the public web directory and cannot be reached by a web address — only an authenticated specialist assigned to your case can open them, and every access is written to an audit log.
That matters because a compliance team or a police force will only act on material whose integrity can be demonstrated. The hash of every file appears on your own case record too, so you can verify it independently.
Case counts and values are read directly from our case management system.
Funds routinely leave a victim in one country, pass through an exchange in a second, and are cashed out in a third. We work across 38 countries, engaging the regulators and law enforcement bodies that actually have jurisdiction over each leg of the trail.
Where a jurisdiction will not cooperate — and some will not — we say so plainly rather than billing work that cannot reach a conclusion.
Everything below is free and requires no engagement with us. If reading it means you never need our services, that is a good outcome.
The structural signals that separate a fraudulent investment offer from a legitimate one — and how to check them in under ten…
Read guide Recognising fraudA field guide to the scheme types we see most often, how each one is structured, and the point at which money…
Read guide If it has happenedAn hour-by-hour action plan. Early steps materially affect whether funds can be traced, frozen, or recovered.
Read guideRecoverability is largely determined before most victims have finished processing what happened. Here is what is actually happening to the funds during…
Read article ExplainersA plain-language account of how fund tracing works, where it reliably succeeds, and the four situations where it genuinely stops.
Read article Case patternsA composite walkthrough of the most damaging fraud pattern we see — stage by stage, including the two moments where it can…
Read articleNo, and you should not engage anyone who says otherwise.
Recovery depends on factors outside any investigator's control: where the funds went, whether they passed through a mixer or privacy coin, whether they reached a regulated service that will respond to lawful requests, and how much time has passed. We assess your case honestly and tell you when the realistic prospect is low — including when it is close to zero.
What we can commit to is a competent, documented investigation and a clear account of what is and is not achievable.
The initial case assessment is free. If we take the case on, you receive a written engagement agreement setting out the scope, the fee structure, and what happens if nothing is recovered — before you commit to anything.
We do not ask for cryptocurrency payments, we invoice to a corporate account, and we never ask for a fee to "release" funds. Any approach demanding payment in crypto or gift cards in our name is not us.
Immediately. Stolen crypto is usually moved within hours to days, and a freeze at a receiving exchange is only possible while the funds are still there.
Older cases are not automatically hopeless — funds sometimes sit dormant, off-ramps are identified later, and cases connect to wider investigations — but the position is materially weaker. If the loss happened in the last few days, treat it as urgent.
As much of the following as you have:
Submit what you have — a missing item does not stop us starting. Our evidence guide explains how to capture each of these properly.
Never, under any circumstances. No legitimate investigation requires them.
Anyone asking for your recovery phrase, private keys, or remote access to your wallet is attempting theft, regardless of whose name they use. If someone claiming to represent us asks for these, it is not us — contact us through the details on this site and report it.
Tell us what happened and attach whatever evidence you have. A specialist will review it and give you an honest assessment of what can realistically be done. If the answer is that recovery is unlikely, we will say so.
No obligation. We never ask for seed phrases, private keys, or remote access.