On-chain forensics · Free case review
A blockchain is a public ledger — every transfer, every address, every timestamp, permanently readable by anyone who knows how to follow it. We follow it for you, hop by hop, and name the platform your funds ended up on.
What we promise
- To follow the funds from your wallet to the last address we can attribute
- To name the exchange, bridge or service they landed on
- To submit the report to that platform's compliance desk on your behalf, with your written authorisation
- To tell you plainly where the trail ends
- To finish the flow map on virtually every case we accept — because we only accept the ones we've already confirmed are traceable
What we never promise
- That your funds come back — no one can reverse a blockchain transaction
- That an exchange or police force will act on the report
- To follow funds through a mixer or a privacy coin — nobody can
- A share-of-recovery deal, or payment in crypto
We do the first review. You don't pay for it. A specialist reads your case and tells you whether it can be traced. If anyone asks you to pay just to hear that answer — us included — treat it as a warning sign.
People reach us after losing savings, after borrowing to cover the hole, sometimes after paying a second company that promised the money back and then asked for more. That is not what happens here. You get a straight answer from a person, and you get it before you spend anything.
Exhibit A · Flow map — specimen case
Start here
Three steps. That is the whole process.
You tell us what happened
About ten minutes, in your own words. No technical details needed. If you don't have wallet addresses or transaction records, that is fine.
A specialist reads it
Within 24 hours a person — not a bot — replies to you, in English or Chinese.
We tell you if we can help
If your case can be traced, we explain the work and the cost in writing first. If it can't, we say so and it stops there. You don't pay to find out either way.
Not ready to contact anyone? Read the free guide for your country first
Case intake
Ask a specialist
Free · reply within 24 hours
Received
Your reference number
Quote this in any message about your case. A specialist will reply within 24 hours with a straight answer on whether we can help.
While you wait: if you still have access to the affected wallet, move anything left in it to a new wallet with a new recovery phrase. And file a police report if you haven't — a case number materially changes what a platform will do with our findings.
We could not reach our server. Please press "Send by email" below so your details definitely reach us.
Your case record — keep a copy
Talk to a person
Would you rather just talk to someone?
You do not have to write in English, and you do not have to explain anything technical. Leave your number and a specialist will call you.
Request a call
Leave three details and a specialist calls you.
Call requested
We'll call you back.
We'll call during working hours. Remember: we call from one number only, and we will never ask for a password, a recovery phrase or a payment on the phone.
Send by emailThe mechanics
Thieves can move funds. They can't move them invisibly.
There are only a handful of ways to shift stolen crypto, and each leaves a distinct shape in the ledger. Once you know the shapes, you can follow them. Here are the three you'll see in almost every case.
The peel chain
Funds hop wallet to wallet, shedding a small slice at each step to a cash-out point. It looks like noise. It's actually the most followable pattern there is, because the main balance stays intact and the timing is machine-regular.
The fan-out
One wallet splits into dozens to look like unrelated activity. But split funds almost always come back together before cash-out, and the moment they do, the whole cluster is provably one operator. Fan-outs create evidence rather than hiding it.
The cross-chain jump
Moving to another chain feels like vanishing. It isn't — a public bridge records both sides of the transfer, with matching amounts and timestamps. We pick the trail back up on the far side and keep going.
Coverage
Every major public chain — and an honest note on the ones that resist.
Most services list chains and stop there. We'd rather show you the traceability of each one, because that's what actually decides whether your case is worth taking.
If your case sits in the last group, the free review will say so and you'll pay nothing. A service claiming to trace Monero is telling you something that is not technically possible.
After the map
We take the report to the platform your funds landed on.
A flow map on its own is a document. Its value is in whose desk it reaches. Once you sign an authorisation, we submit the case to that platform's compliance or law-enforcement channel in your name, and we log every response.
Exhibit E · Escalation sequence
The authorisation letter
Acting on your behalf means exactly this
You sign a one-page letter naming us as your authorised representative for correspondence about this incident. It lets us write to a platform's compliance desk in your name, attach the report, and chase a reply — so you're not sitting in a support queue trying to explain transaction records to a first-line agent.
What it does not do, and what no letter could: compel a freeze, compel a refund, or make us your lawyers. Platforms act on their own risk rules and on formal requests from law enforcement. That's why we push every client to file a police report in parallel — a case number is usually what turns a compliance review into an actual hold.
Deliverables
What arrives in your inbox.
Built so a compliance officer, an investigator or a lawyer can verify every claim in it without taking our word for anything.
Exhibit A
Transaction flow map
Every hop from your wallet to the last attributable address, labelled with amounts, timestamps and hop counts. PDF and image.
Exhibit B
Address ledger
A spreadsheet of every address and transaction in the movement chain, so any step can be checked on a public explorer.
Exhibit C
Off-ramp findings
Which platforms received the funds, when, in what amount, and which of them hold customer identity records.
Exhibit D
Written narrative
What happened, in order, in plain language, with our method and confidence level stated for each finding.
Exhibit E
Submission & log
The authorisation letter, the request we sent to each platform, and a dated log of every reply.
Exhibit F
Limits statement
What we could not determine and why. Mixers, privacy coins and dead ends named as such. This section is never omitted.
Coverage and reach
We work where the money goes, and we know who to file with there.
Stolen crypto rarely stays in one country. A trace is only worth something if you also know which authority in your jurisdiction will accept it — and which exchange compliance desk sits in which timezone. These are the jurisdictions we take cases from, and the channel your report is built for in each one.
Exhibit G · Jurisdictions and filing channels
Reports issued in English and Traditional Chinese
Asia–Pacific
Europe
Four numbers
The only figures we'll put in large type.
These describe how we work, not how often we win. Two of them are zero, and those two are the ones worth reading.
In their words
What clients have said.
Every review here is from a client who read it and agreed to it being published, with the case type and month shown so you can weigh it. Nothing on this page is written by us.
[ REAL CLIENT QUOTE — DO NOT INVENT ]
[ REAL CLIENT QUOTE — DO NOT INVENT ]
[ REAL CLIENT QUOTE — DO NOT INVENT ]
Questions
The ones people actually ask.
Can you get my money back?
No, and neither can anyone else directly. A blockchain transaction cannot be reversed. What sometimes returns funds is a legal or compliance process: if the money reached a platform holding identity records, that platform can freeze an account, and a police request or court order can compel it to act.
Our work is the input to that process — the map, and the submission that puts it in front of the right desk. It is not a substitute for the process and not a guarantee of its outcome. Most traced cases do not end in recovery. You should hear that from us now rather than pay to hear it later.
How do I know you're not another recovery scam?
Check us against the pattern. A recovery scam promises a specific sum back, asks for payment in crypto, invents new fees mid-process, claims to have already "located and frozen" your funds, and tells you police can't help.
We look at your case for free first, quote in writing before starting, take payment on a normal card or bank rail with an invoice, promise a document and a submission rather than an outcome, and actively push you to file with police. If any message you get ever breaks that pattern, treat it as an impersonator and check the sending address.
I don't understand wallet addresses or transaction records. Can you still help?
Yes. Nothing technical is required to contact us — describing what happened in ordinary words is enough. Most of our clients arrive with a screenshot, an email from an exchange, or nothing but a story and a date.
If we need a specific record to start the trace, we'll tell you exactly where to look in your app or your email, step by step. There is one thing we will never ask for, and nobody legitimate ever will: your recovery phrase, your private key, or your password.
You say you cover all the major chains. Really all of them?
Every major public chain, yes — the coverage table above names them. But two honest exceptions: privacy chains like Monero are not traceable by anyone, and once funds enter a mixer the link between input and output is broken. Any service claiming otherwise is selling confidence rather than capability.
This is exactly why the free review exists. We check your specific case against those limits before you pay anything, and if it falls on the wrong side of them we say no.
What does "contacting the platform on my behalf" actually get me?
It gets your case in front of a compliance or law-enforcement desk in a form they can act on — with the deposit address, timestamps, amounts and a verifiable trail — instead of sitting in a general support queue as a distressed message with no addresses in it.
Platforms do sometimes flag or freeze on a well-evidenced report. Often they'll confirm receipt and say they need a request from law enforcement to go further. We log whatever comes back and tell you the next step either way. What we won't do is imply we have influence over their decision. We don't.
My funds went into a mixer. Is it worth contacting you?
The free review costs you nothing, so yes — ask. If everything went straight into a mixer we'll tell you the trail is dead and stop there. Partial cases are common though: attackers routinely split funds, and the branch that reached an exchange is worth documenting even when the rest is gone.
Is my case too small?
Below roughly USD 5,000 a full trace will cost a meaningful share of what you lost, and the odds of recovery are low. We'd rather say that during the free review than take your money. Small cases still matter as pattern evidence, so we'll point you to the free reporting channels worth using.