Cryptocurrency asset tracing
We follow the money. Starting from the transaction hashes and deposit addresses you provide, we reconstruct the full path your funds travelled — through wallet clusters, bridges, swap services, privacy mixers and, in most cases, into a deposit address at a centralised exchange.
What the work covers
- Full transaction-graph reconstruction across EVM chains, UTXO chains, Tron, and major sidechains
- Cluster attribution — grouping addresses that demonstrably belong to the same operator
- Bridge and swap tracking, including cross-chain hops that break naive block-explorer analysis
- Mixer and peel-chain analysis, with clearly stated confidence levels where output cannot be attributed with certainty
- Identification of the terminating service: exchange, custodian, payment processor or OTC desk
What you receive
- An annotated flow diagram of the movement of funds
- A hop-by-hop ledger table with timestamps, amounts and chain identifiers
- A named list of destination services with the corresponding deposit addresses
- A written confidence assessment for every attribution we make
Fraud & scam investigation
Where tracing follows the funds, investigation reconstructs the scheme: who approached you, through which infrastructure, using which persona, and how the same operation has behaved elsewhere.
What the work covers
- Timeline reconstruction from your chat logs, emails, platform screenshots and payment records
- Infrastructure analysis of the platform — domain registration, hosting, clone-site relationships, historic content
- Persona and open-source research on the accounts, profiles and phone numbers used to contact you
- Pattern matching against known typologies: fake trading portals, pig butchering, romance fraud, impersonation of exchange support, giveaway and multiplier schemes
- Identification of secondary recovery-fraud attempts targeting you after the original loss
What you receive
- A documented incident chronology suitable for a bank dispute or police report
- An infrastructure profile of the platform and its related domains
- A typology classification with the indicators that support it
Exchange & wallet intelligence
Knowing that funds reached "an exchange" is not actionable. Knowing which platform, which deposit address, at what time, and which compliance channel accepts a preservation request — that is.
What the work covers
- Attribution of destination addresses to the operating service
- Identification of the correct compliance or law-enforcement contact route for that service
- Screening of counterparty addresses against sanctions data and known-abuse indicators
- Assessment of the custodial jurisdiction and what that means for the realistic prospects of a freeze
- Wallet exposure profiling before you transact — see also our free Wallet Inspector
What you receive
- A destination service report naming the platform, the deposit address and the time window
- The applicable reporting channel and the evidence format that channel expects
- A jurisdictional note on enforceability
Forensic reports for legal action
A finding that cannot be presented is not much use. Our reports are written to be handed directly to a bank's disputes team, a police cybercrime unit, a regulator, or your solicitor.
What the work covers
- A methodology section stating what data sources were used and how conclusions were reached
- Reproducible evidence: every transaction hash, address and timestamp cited so a third party can verify it independently
- Clear separation between fact, inference and assumption — with confidence stated, never overstated
- Exhibits formatted for attachment to a statutory report or court filing
- A plain-English executive summary for non-technical readers
What you receive
- A signed forensic report in PDF, with numbered exhibits
- A one-page summary for your bank or insurer
- Source data in a machine-readable format on request
Recovery case facilitation
Coordination work: making sure the right document reaches the right desk, in the right order, while the funds are still somewhere they can be reached.
What the work covers
- Preparation and sequencing of preservation requests to destination services
- Support for your solicitor in freezing or disclosure applications
- Structured submission to statutory bodies — Action Fraud, the NCSC, your bank, and the Financial Ombudsman Service
- Liaison with overseas reporting channels where the destination service sits outside the UK
- Ongoing monitoring of the traced addresses for further movement
What you receive
- A prioritised action sequence with deadlines
- Draft correspondence for each recipient
- Progress reporting for the duration of the engagement
