T R A C E

Loading

Cyber Solution Investigations is an accredited cryptocurrency fraud investigation agency assisting clients with digital asset tracing, evidentiary documentation, and formal recovery support.

Contact Info

Free assessment
Open menu

How We Work

No black box. Six stages, each with a defined output and a defined limit — so you always know what has been done, what it cost, and what happens next. The first stage is free, and a good number of enquiries end there because the honest answer is that the trail leads nowhere useful.

1

Case assessment

Free · typically within 1 business day

You send what you have — transaction hashes, deposit addresses, the platform URL, chat logs, payment receipts. We review it and tell you whether a forensic trail exists and where it plausibly leads. This costs nothing and creates no obligation.

At the end of this step you know

  • Whether your transactions can be traced at all
  • Roughly where the funds appear to have gone, at a first pass
  • Whether an engagement is worth the money — and if it is not, we say so and stop here
2

Evidence gathering

Days 1–3 of an engagement

We collect and preserve everything before it disappears. Scam platforms are taken offline, chat histories are deleted, and accounts are closed — often within days of a victim raising the alarm.

What gets preserved

  • Blockchain data: hashes, addresses, block heights, timestamps
  • Platform evidence: page captures, domain and hosting records, historic snapshots
  • Communications: message logs, email headers, caller IDs, profile records
  • Your own records: bank statements, exchange withdrawal confirmations, receipts
  • Everything is hashed and timestamped on intake so its integrity can be demonstrated later
3

On-chain tracing & analysis

The bulk of the engagement

The core forensic work. We reconstruct the movement of funds hop by hop, resolve cross-chain transfers, cluster addresses by common ownership, and work through obfuscation layers until we reach a service that holds real-world account records.

How we handle uncertainty

  • Every attribution carries a stated confidence level
  • Where a mixer output cannot be attributed, we say so rather than guessing
  • Inference is labelled as inference, never presented as fact
  • You see the working, not just the conclusion
4

Exchange liaison

As soon as a destination is identified

Speed matters more than anything else at this point. Once funds are identified at a custodial platform, we determine the correct compliance channel and prepare a preservation request in the format that platform actually accepts.

What this involves

  • Identifying the operating entity behind the destination address
  • Locating the compliance or law-enforcement contact route
  • Preparing the request with the evidence attached in the expected format
  • Escalating through your bank or solicitor where a private request carries no weight
5

Police & regulator referral

In parallel, not afterwards

A private investigation does not substitute for a statutory report — it makes the statutory report far more effective. We package the evidence so a cybercrime unit can act on it without having to redo the analysis.

Where reports go

  • Action Fraud — the national reporting centre for fraud and cybercrime in England, Wales and Northern Ireland
  • Police Scotland on 101 — Action Fraud does not cover Scotland
  • The NCSC, for the phishing infrastructure and cloned sites involved
  • Your bank or exchange compliance team, and the FCA where a regulated firm was impersonated
  • The Financial Ombudsman Service, where a UK financial institution is involved
  • Overseas channels where the destination service sits outside the UK
6

Recovery support

Ongoing

We stay with the case: monitoring the traced addresses for further movement, supporting your solicitor with follow-up analysis, and updating exhibits as proceedings develop.

What continues

  • Address monitoring and alerts on new movement
  • Supplementary analysis for freezing or disclosure applications
  • Updated exhibits as the case progresses
  • A candid view on prospects at every stage — including when to stop

The first 48 hours matter most

Whatever you decide about engaging us, act on this immediately — asset preservation depends on it far more than on any investigator.

  • Stop transferring. Do not pay any "unlocking fee", "liquidity deposit" or "clearance tax". Those demands are always fraudulent.
  • Preserve everything now. Screenshots, transaction hashes, URLs, full chat histories — before the platform disappears.
  • Tell your bank or exchange today. Fast notice can trigger an internal hold that no later action can replicate.
  • Secure your accounts. Revoke smart-contract allowances, rotate passwords, enforce hardware or app-based 2FA.
  • File the statutory report. Action Fraud (or Police Scotland on 101) — keep the reference number.
The full checklist, with the reporting links, is in our emergency 48-hour guide.

Start with the free assessment

Send us the transaction hashes and whatever records you have. We will tell you within one business day whether there is a trail worth following — and if there is not, that answer costs you nothing.

Request a free assessment See what each service covers in detail →