Forensics built for the courtroom.
We trace stolen crypto and write the evidence report your lawyer or law enforcement needs to act.
- Matter
- Illustrative sample, not a real matter
- Asset
- USDT (TRC-20)
- Loss
- 184,200 USDT
- Hops traced
- 11 · 3 exchange deposits identified
We produce the forensic evidence. Your counsel or law enforcement acts on it.
Reports are written to be read by a lawyer, a compliance officer, or a judge, and verified by any examiner they choose.
Four steps, start to finish.
Once the report is delivered, we stay available to explain it, update it, and testify to it.
- 01
Intake
You send what you have: hashes, addresses, dates, screenshots. An examiner reviews it and replies within two business days with a tier, a price, and an honest view of whether a report will help.
Free · 2 business days - 02
Trace
We follow the funds hop by hop across chains, bridges, and mixers, attributing endpoint addresses to exchanges or services and logging every query we make.
Ours · 1–3 weeks - 03
Report
You receive a hash-sealed report with flow-of-funds diagrams, attribution evidence, confidence levels, and a chain-of-custody log. Written for a reader who has never heard the word "blockchain."
Ours · delivered as PDF + source data - 04
Counsel acts
Counsel or law enforcement uses the report to request a freeze, seek a disclosure order, or file a complaint. We stay available to clarify, update, or give sworn testimony.
With your counsel · we support throughout
What makes a report hold up in court
A blockchain explorer screenshot is not evidence. A report is admissible when the method is documented, repeatable by another examiner, and every step from your wallet to the final address is accounted for. This is how we work.
Tracing and attribution
We follow funds through every hop, not just the first exchange deposit. Where funds are split, bridged, or swapped we document each branch and the heuristic used to connect it.
- Multi-chain: UTXO, EVM, XRPL, Tron, Solana
- Commercial attribution data cross-checked against open sources
- Clustering heuristics named and justified per step
Chain of custody
Every piece of data in the report has a recorded origin, timestamp, and hash. A second examiner can reproduce the trace from the appendix alone.
- SHA-256 of every source file and node response
- Tooling and database versions recorded
- Examiner log of every query, with timestamps
Court-ready standard
Reports are written to the form expert declarations take in civil freeze and disclosure proceedings. Confidence is stated per finding; nothing is overstated.
- Findings separated from opinion
- Limitations section in every report
- Examiner available for declaration or testimony
- Examiner qualifications and declaration
- Scope and sources of data
- Incident summary (your account, verified on-chain)
- Flow-of-funds analysis with diagrams
- Attribution of endpoint addresses
- Chain-of-custody log
- Limitations and confidence levels
- Appendix: raw transaction data, hashes, tooling versions
Of the $1.5 billion lost to crypto hacks and frauds in 2024, Immunefi found that only 7.7% was recovered. Source: Immunefi, Crypto Losses in 2024
Most cases end at a report, not a recovery. We say so before you pay us.
- Report only
- The most common result. Funds have reached an unreachable endpoint, or the legal cost of pursuit exceeds the loss. You have a document for insurance, tax, and law enforcement purposes, and a clear answer.
- Freeze or disclosure
- Funds identified at a cooperative exchange. Counsel uses the report to request a freeze or a court order compelling the exchange to disclose the account holder. This is where cases become winnable.
- Partial recovery
- Rare, slow, and almost always partial. Typically follows a freeze, a civil judgment, or a criminal forfeiture. Measured in months to years, not weeks.
We tell you what the trace shows, including when it shows a dead end.
Two ways to pay. Neither is an upfront “recovery fee.”
Fixed fee buys a report. Success fee costs nothing unless funds come back. The intake call that places your case in a tier is free, and we'll tell you if we think a report won't help.
Direct trace
One asset, one chain, funds reach an exchange or dormant wallet within a handful of hops.
- Flow-of-funds report
- Attribution of endpoints
- Exhibit package for counsel
Multi-chain
Bridges, swaps, or multiple chains. Several branches to follow and document.
- Everything in Tier 1
- Bridge and DEX transaction analysis
- One update after delivery
Complex
Mixers, OTC desks, many victims, or losses above $500k where litigation is likely.
- Everything in Tier 2
- Sworn declaration prepared
- Examiner testimony (billed hourly)
Paid in two halves: 50% to open the file, 50% on delivery. If the first 48 hours of tracing show nothing actionable, we stop and refund the balance. Price is fixed at intake and does not change.
Straight answers
Tell us what happened.
An examiner reads every intake and replies within two business days with an honest view: whether a report is likely to help, which tier it falls in, and what it would cost. No payment is requested at this stage.