Crypto Forensic Investigation: The Complete 2026 Guide to Process, Tools, Techniques, and Real Case Studies

If you've lost cryptocurrency to a scam, a theft, or a disputed transaction, a crypto forensic investigation is the starting point for any meaningful recovery effort. It produces the documented blockchain evidence that law enforcement needs to act on, that attorneys need to litigate, and that exchanges require before they'll freeze or release funds.

This is the working 2026 guide to crypto forensic investigation, written by someone who actually does this work. It covers what the investigation is, how the process moves step by step, the commercial and open-source tools, advanced techniques, how to trace through privacy tech and DeFi, real case studies, pricing, deliverables, and court admissibility. No jargon-heavy vagueness. No recovery promises. Just a clear account of what the work entails.

Whether you're a victim trying to figure out if an investigation can help your case, an attorney evaluating an investigator for a federal civil matter, a law enforcement officer scoping a referral, or a finance/compliance professional building familiarity with the field, the article is structured so you can jump to the section that answers your question.

What a Crypto Forensic Investigation Actually Is

A crypto forensic investigation is a structured analytical process that traces cryptocurrency from a known point of loss through the blockchain to its current or last-known location. The output is a documented evidence package, not a promise to recover funds, but the foundation that makes recovery legally possible.

The key distinction from informal "I can track your wallet" services: a real crypto scam investigation produces reproducible, documented findings. Every transaction hash is cited. Every conclusion is grounded in on-chain data. The methodology can be independently verified. This matters because the report's value lies entirely in its credibility, to a court, to law enforcement, or to an exchange's legal team.

How Crypto Forensic Investigation Actually Works (The Technical Foundation)

Crypto forensic investigation works because of an unintuitive property of blockchains: every transaction is permanently recorded on a public ledger that anyone can read. Wallets are pseudonymous, they're addresses, not names, but the ledger itself is fully transparent. Once you have the right starting point (usually a victim's transaction hash), the trail is fixed in cryptographic stone. It can't be deleted, edited, or hidden by anyone, including the wallet's owner.

Three properties of public blockchains make forensic work possible:

• Immutability. Every confirmed transaction is permanent. There's no equivalent of "deleting bank records", the data exists across thousands of independent nodes.
• Transparency. Every transaction is visible to anyone with a block explorer. Investigation doesn't require special access, only skill at interpreting the data.
• Pseudonymity, not anonymity. Wallet addresses don't carry real-world names, but they leak identity through behavior, which is what wallet clustering and entity attribution exploit.

UTXO vs. Account-Based Models

Different blockchains record transactions in different ways, and forensic methodology adapts accordingly. Bitcoin and other UTXO chains (Litecoin, Bitcoin Cash) record transactions as inputs and outputs, coins are spent and re-created with each transaction, making clustering heuristics like "common input ownership" possible. Ethereum and other account-based chains (BNB Smart Chain, Polygon, Avalanche) record balances on accounts, with transactions modifying those balances directly. Tron, Solana, and others have their own variations.

The investigator's mental model has to fit the chain. A strong Bitcoin tracer isn't automatically a strong Ethereum tracer, different heuristics apply, different tools dominate, different obfuscation techniques are common.

How Identity Is Recovered From Pseudonymous Wallets

The wallet itself never reveals identity directly. Identity attribution usually comes from one of three places:

1. Exchange deposits. When stolen funds reach a regulated exchange (Binance, Coinbase, Kraken, OKX), that exchange has KYC documentation on the receiving account holder. A subpoena, MLAT request, or civil discovery order obtains it.
2. Open-source intelligence (OSINT) correlation. Wallet addresses get posted on Telegram, Discord, social media, GitHub, leaked databases, and ransom notes. Cross-referencing on-chain wallets to off-chain footprints often surfaces named operators.
3. Wallet clustering. Behavioral analysis groups dozens or hundreds of wallets under a single controller. Once any one of those wallets is attributed (via the first two methods), the entire cluster inherits that attribution.

Common Cases Crypto Forensic Investigators Handle

Crypto forensic investigation applies to a much wider range of matters than just consumer fraud. Below are the case categories that come up most often, with what the investigation usually looks like in each.

Pig Butchering and Romance Scams

The largest category by volume. Victims are cultivated over weeks or months on dating apps, social media, or messaging platforms, almost always by operators in Southeast Asian fraud compounds in Cambodia, Myanmar, and Laos. Funds usually move through multiple hops on Tron USDT, consolidate into compound aggregator wallets, then exit through OTC desks tied to casino infrastructure. Forensic work in these cases focuses on identifying the aggregator cluster, finding the exit point at a regulated exchange, and connecting the case to known compound infrastructure already under federal investigation.

Exchange and DeFi Hacks

Centralized exchange hot wallet drains and DeFi protocol exploits. The forensic question is usually not "who", large hacks are routinely attributed to known actors like the North Korean Lazarus Group within days, but "where are the funds now and which exchange or bridge can intercept them." Speed is the differentiator: stolen funds often flow through bridges or mixers within hours, and freezing them requires real-time tracing coordinated with exchange compliance teams. See the notable case studies below for examples.

Fake Investment Platforms

Web-based "trading platforms" that show fabricated profits in a victim dashboard while the real funds flow to scammer wallets. The forensic angle: trace funds from the victim's deposit transaction through the platform's backend wallets to discover that thousands of victims' funds are flowing to a common cluster. Class-action posture in civil litigation often follows.

Ransomware Payments

Forensic work tracks ransomware payments from the victim's wallet through the criminal infrastructure, usually into mixing services and then out to exchange deposits. The DOJ's high-profile ransomware seizures (Colonial Pipeline, BlackCat/ALPHV affiliates) all relied on public blockchain forensic analysis.

Business Email Compromise (BEC) That Crossed Into Crypto

Increasingly, traditional BEC schemes route stolen funds through cryptocurrency to obscure the trail. Forensic work picks up at the wire-to-crypto conversion point and follows funds onward, usually to exchange deposits or off-ramp services.

Divorce and Asset Concealment

One spouse holds undisclosed cryptocurrency. Forensic investigation reconstructs the on-chain history from any available data, exchange statements, recovered wallet seed phrases, device-level OSINT, and documents the holdings for the financial disclosure proceeding.

Embezzlement

An employee, fiduciary, or partner has moved company funds into cryptocurrency. The forensic work usually establishes the conversion point (the exchange that off-ramped the funds), maps the on-chain holdings post-conversion, and supports civil recovery actions.

Estate and Probate

A decedent held cryptocurrency that the estate now needs to value, locate, and secure. Forensic work involves identifying all wallets attributable to the decedent, documenting the on-chain holdings as of the date of death, and supporting executor recovery efforts where private keys can be located.

Bankruptcy and Insolvency

Pre-petition transfers of crypto assets that may is fraudulent conveyance, hidden holdings the debtor failed to disclose, or asset tracing for trustee recovery. Forensic reports support the trustee's investigation and any later clawback actions.

Regulatory Defense and Independent Review

For attorneys defending clients against SEC, CFTC, or FinCEN actions, an independent forensic review of government findings can identify methodology weaknesses, reframe attribution conclusions, and provide a rebuttal foundation.

When to Get a Crypto Forensic Investigation

A crypto forensic investigation is appropriate when:

• You sent cryptocurrency to a scammer and want documented evidence of where the funds went
• You're working with an attorney on a civil fraud claim involving cryptocurrency
• You have filed or plan to file a law enforcement report and need a professional evidence package
• Your business or exchange experienced a hack or internal theft involving cryptocurrency
• You're involved in litigation (divorce, business dispute, bankruptcy) where the opposing party holds cryptocurrency
• You need an expert witness to testify about blockchain evidence in court

If you're unsure whether your situation warrants an investigation, a free case assessment can clarify whether traceable evidence exists and what the investigation is likely to yield.

The Investigation Process: Step by Step

Crypto Forensic Tools and Platforms (2026 Stack)

Professional crypto forensic investigation uses a combination of commercial intelligence platforms and open-source tools. The platforms accelerate work and provide attribution data; the open-source tools fill specific gaps and provide independent verification. Skilled investigators rarely rely on a single tool.

Commercial Intelligence Platforms

• Chainalysis, market leader, used by most U.S. federal law enforcement (FBI, IRS-CI, Secret Service, DEA). Reactor for case investigation, KYT for real-time exchange compliance.
• TRM Labs, fastest-growing competitor, strong on Tron and stablecoin coverage. TRM Forensics for case work; particularly used by exchanges and federal agencies as a complement to Chainalysis.
• Elliptic, UK-headquartered, strong in European law enforcement. Investigator for case work, Lens for real-time risk screening. Particularly strong on DeFi protocol attribution.
• Crystal Intelligence, strong tooling for case visualization, behavioral profiling, and dark market attribution.
• Merkle Science, Singapore-based, predictive risk scoring, strong APAC coverage.

For deeper comparison of these platforms, see our blockchain intelligence platforms guide.

Open-Source and OSINT Tools

• Block explorers, Etherscan, BscScan, Tronscan, Solscan, Blockchain.com. The foundation of any trace. Free, public, authoritative.
• Arkham Intelligence, community-sourced wallet labeling. Free for basic use, surprisingly strong on whale wallets, exchanges, and known criminal addresses.
• Breadcrumbs.app, graph-based wallet visualization, useful for quick traces and stakeholder presentations.
• MetaSleuth, visualization tool from BlockSec, strong for EVM-chain tracing.
• MetaSuites, browser extension that overlays additional context onto block explorers (token flows, contract decoding, related transactions).
• DefiLlama, Dune Analytics, Nansen, DeFi-focused analytics that complement traditional tracing for DEX trades, liquidity pool interactions, and protocol-level analysis.
• OSINT tooling, Telegram and Discord scrapers, GitHub/leaked-database search, social media wallet correlation. The off-chain side of attribution.
• AI-assisted analysis, increasingly used for pattern recognition across thousands of transactions, large-scale clustering, and anomaly detection. Augments rather than replaces investigator judgment.

Advanced Crypto Forensic Techniques

Beyond the headline "trace the wallet" workflow, professional crypto forensics applies a set of analytical techniques that surface attribution and patterns the raw blockchain doesn't make obvious.

Wallet Clustering

Grouping addresses that are likely controlled by the same entity. The dominant heuristic on Bitcoin is common-input ownership, if multiple addresses appear as inputs to the same transaction, they're usually controlled by one wallet. Change-address detection identifies the "change" output in a Bitcoin transaction (often returning to the spender), letting clustering follow the operator forward in time. On Ethereum and similar chains, clustering relies more on funding-source patterns, sweeping behavior, and contract interactions.

Timing Analysis

Wallets controlled by the same operator often act in correlated time windows. Two wallets that consistently transact within seconds of each other across a large dataset are usually operated by the same automation, even when no direct on-chain link connects them. Timing correlation is particularly useful for de-anonymizing mixer outputs, identifying co-coordinated sybil clusters, and linking laundering layers.

Heuristic and Behavioral Analysis

Patterns of address reuse, fund-consolidation behavior, gas-price habits, transaction-batching tendencies, and protocol preferences all leak operator identity. A skilled investigator builds a behavioral profile of the operator, which then helps confirm or refute clustering hypotheses.

Graph Analysis

Visualizing the entire fund flow as a directed graph, nodes are wallets, edges are transactions. Graph analysis surfaces patterns that linear "follow the money" tracing misses: convergence patterns where multiple victims' funds consolidate, splitting patterns where laundering branches and re-merges, and central nodes that act as hubs in a criminal network. Most commercial platforms produce graph views; the analytical value comes from interpreting them.

Cross-Chain Tracing

Following funds as they move between blockchains via bridges, atomic swaps, or DEX aggregators. Each cross-chain hop requires identifying the corresponding output transaction on the destination chain, usually by matching amounts, timing, and bridge-specific identifiers. Major bridges (Wormhole, Synapse, Stargate, deBridge) produce traceable, time-correlated outputs. Intent-based protocols and aggregator routes are harder but generally not opaque to a skilled investigator.

Mixer and Tumbler Deanonymization

Centralized mixers (ChipMixer, Helix) are usually broken at the operator level, once the operator's database is seized, the historical mixing record becomes searchable. Decentralized mixers (Tornado Cash) require probabilistic analysis: timing correlations, anomaly-based pool entry/exit matching, and contextual clues from the operator's pre- and post-mix behavior. Funds passed through Tornado Cash aren't always opaque, but the conclusions carry stated confidence levels rather than hard certainty.

OSINT and Identity Bridging

Connecting on-chain wallets to off-chain identity through ENS names, social media posts, leaked databases, GitHub commits, ransom notes, Telegram or Discord handles, domain WHOIS records, and exchange disclosure. This is the step that turns a wallet cluster into a named suspect.

Crypto Forensic Tracing Through Privacy Tech and DeFi

Modern crypto laundering rarely happens on a single transparent chain. Sophisticated operators routinely combine privacy services, bridges, DEXes, and protocol-level obfuscation. Each technique has known forensic responses.

Tornado Cash and Decentralized Mixers

Tornado Cash uses zk-SNARKs to break the on-chain link between deposit and withdrawal addresses. Forensic responses rely on probabilistic analysis: matching deposit amounts and timing, identifying behavioral patterns of the same operator on both sides of the mix, and contextual evidence (e.g., funded address pre-mix matches an address post-mix in non-mix activity). Conclusions are stated with confidence levels, Tornado Cash analysis is rarely "certain," but is often "likely" enough to support investigative leads. Tornado Cash was OFAC-sanctioned in August 2022, and prosecutions of its developers have proceeded since.

Centralized Mixers

Services like ChipMixer (seized by U.S. and German authorities in March 2023) and Helix (operator convicted in 2021) provide anonymity until they don't. Once the operator is compromised by law enforcement, the historical record of every deposit and withdrawal becomes available, making post-seizure attribution routine. Funds run through a centralized mixer that has since been seized are usually traceable to the original depositor and ultimate withdrawer.

Cross-Chain Bridges

Wormhole, Stargate, Synapse, deBridge, Across, and others enable funds to move between chains. Each bridge produces correlated input/output transactions, identifying the destination address usually requires matching the bridge's specific output format, timing, and amount. Bridge-specific dashboards (Wormholescan, Stargate Finance) accelerate this work. The bridge doesn't obscure attribution; it just adds a step.

DEX Aggregators and Token Swaps

Uniswap, 1inch, Paraswap, and CowSwap route trades through liquidity pools. Forensic interpretation reconstructs the swap from on-chain logs, token amounts, recipient address, timing, to identify what funds came in and what came out. Swap routing through aggregators is fully traceable, though it requires interpreting protocol-specific transaction structures.

THORchain and Native Asset Swaps

THORchain enables swaps between native assets across chains (e.g., native BTC to native ETH) without wrapping. Tracing requires identifying corresponding inbound and outbound vault transactions, THORchain's cross-chain operations leave clear on-chain signatures on each side, making it traceable despite its decentralized architecture.

Atomic Swaps and Intent Protocols

Newer privacy-focused protocols (Near Intents, atomic swap services, Chainflip) deliberately reduce the on-chain footprint of cross-chain swaps. These present the hardest tracing challenges, sometimes requiring scraping output chains for amount-matched transactions in the relevant time window rather than direct chain-to-chain attribution. The trail is rarely impossible, but the work expands significantly.

Privacy Coins (Monero, Zcash)

Monero (XMR) uses ring signatures, stealth addresses, and confidential transactions that effectively prevent direct on-chain tracing with current public techniques. Zcash supports both transparent and shielded transactions; shielded-to-shielded movement is similarly opaque. Funds converted into Monero usually end the on-chain trail at the conversion exchange, investigation pivots to attribution at the entry/exit points (the exchange or swap that did the conversion) rather than continuing the trace.

Lightning Network and Layer-2

Lightning Network channels are off-chain, with only opening and closing transactions appearing on Bitcoin. Lightning forensics focuses on channel identification, routing-fee analysis, and node attribution. Layer-2 rollups on Ethereum (Optimism, Arbitrum, zkSync) remain traceable since rollup data is committed to mainnet, though the analysis tooling differs from L1.

How Long a Crypto Forensic Investigation Takes

Rush timelines are sometimes possible for urgent situations, for example, when funds are still moving and time-sensitive law enforcement action is needed. Alert your investigator to any urgency at intake.

What a Crypto Forensic Investigation Costs

Pricing in the crypto forensics industry varies a lot based on case complexity, the investigator's experience, and the deliverable format. The ranges below reflect current market rates for professional investigations.

At Wallet Witness, initial case assessments are always free. We scope the investigation before quoting a fee so you know what you're committing to. See our dedicated guide to how much crypto investigation costs for a detailed breakdown.

What You Receive at the End

A professional crypto forensic investigation delivers a package of documents, not just a verbal summary. Standard deliverables include:

Challenges and Limitations of Crypto Forensic Investigation

Honest crypto forensic investigators acknowledge what the work can't do. The blockchain itself is permanent, but practical recovery depends on factors well beyond the trace. The most common limitations:

• Privacy coins. Monero (XMR) is effectively untraceable with current public techniques. Funds converted to Monero usually end the trace, investigation pivots to attribution at the entry/exit point rather than continuing the on-chain follow.
• Advanced mixing. Sophisticated use of decentralized mixers like Tornado Cash, multi-layer mixing, and operator-side anonymity techniques can reduce findings to probabilistic conclusions. Reports must state confidence levels honestly.
• Non-cooperating exchanges. A perfect trace is meaningless if funds reach an exchange in a jurisdiction that won't respond to U.S. legal process. Some known exchanges in non-cooperating regions are the dominant exit point for SE Asian compound fraud proceeds.
• Time pressure. Funds usually reach a scammer's exchange within 1–7 days and are often withdrawn within another 1–14 days. Cases brought to investigators after that window has closed face significantly different recovery prospects, even with a perfect trace.
• Weak intake data. A case with no transaction hashes, only an exchange screenshot or a wallet address copied imprecisely, often can't be advanced. The starting data is the foundation of the trace.
• Cross-border legal complexity. Tracing is unaffected by borders; recovery is heavily affected by them. Civil discovery, MLAT, and asset freeze viability vary substantially by jurisdiction.
• Clustering false positives. Wallet clustering heuristics are probabilistic, particularly with custodial wallets, CoinJoin transactions, and contract-interacting wallets, where naive heuristics can incorrectly group different controllers. Honest reporting flags these uncertainties.
• Anonymous unhosted wallets. If funds never touch a regulated exchange, the on-chain trace may be complete but identity attribution requires off-chain investigation that may or may not succeed.

None of these limitations make crypto forensic investigation pointless, they shape what the work can realistically accomplish on a given case. A good initial assessment is honest about which limitations apply to your case before any retainer is paid.

Notable Crypto Forensic Case Studies (Real-World Investigations)

Crypto forensic methodology has played a central role in many of the largest crypto crime investigations of the past some years. The four cases below are public, well-documented, and illustrate different categories of forensic work.

The Ronin Bridge Hack and Lazarus Group (2022)

In March 2022, attackers drained approximately $625 million in ETH and USDC from the Ronin Bridge, the cross-chain bridge for the Axie Infinity game. Within days, public blockchain forensic analysis attributed the hack to North Korea's Lazarus Group based on wallet patterns, prior known Lazarus infrastructure, and timing analysis. The U.S. Treasury OFAC later sanctioned the primary attacker collection wallet (0x098B716B8Aaf21512996dC57EB0615e2383E2f96) and added it to the SDN list. Funds moved through Tornado Cash and a series of bridges; the FBI and Chainalysis published detailed traces showing portions of the funds moving toward DPRK-affiliated cash-out infrastructure. Some million dollars of the funds were eventually frozen at exchanges. The case is a textbook example of attribution-by-clustering plus public-private cooperation, and the OFAC SDN listing is the operational mechanism that turns a forensic attribution into a freeze obligation for every U.S.-touching exchange. See our full Ronin Bridge hack forensic walkthrough for the complete attack timeline and laundering analysis.

The Bybit Exchange Hack (2025)

On February 21, 2025, the Bybit exchange suffered a $1.46 billion ETH theft, the largest single exchange-related crypto theft in history, attributed to the Lazarus Group. The attack vector was smart-contract logic manipulation through a spoofed Safe UI, not a private-key compromise. The attacker's primary wallet (0x47666Fab8bd0Ac7003bce3f5C3585383F09486E2) immediately fragmented the funds into 40 separate 10,000-ETH transactions, swapped staked-ETH variants through ParaSwap and BreederDodo, then bridged to Bitcoin via Thorchain and eXch before mixing through Cryptomixer and Wasabi Wallet. Independent investigator ZachXBT detected and circulated the attribution within the first hour. Mantle's protocol-level 8-hour withdrawal delay prevented an additional 15,000 cmETH from being stolen, a structural defense that turned a partial loss into a partial save. The case is the current state-of-the-art example of how multi-layer obfuscation gets layered together at scale, and how rapid public-investigator response can preserve attribution even when funds are moving fast. See our full Bybit hack forensic walkthrough for the complete attack-vector analysis, laundering map, and recovery breakdown.

Tornado Cash Sanctions and Prosecutions (2022–2024)

OFAC sanctioned Tornado Cash in August 2022, the first sanction targeting a smart contract rather than an entity. The DOJ later indicted developer Roman Storm and co-developer Alexey Pertsev for money laundering and sanctions violations. Pertsev was convicted in the Netherlands in 2024. Prosecutorial evidence relied heavily on blockchain forensic analysis showing the proportion of sanctioned and stolen funds moving through Tornado Cash, including DPRK-attributed proceeds. The case established that smart-contract level forensics are admissible and that probabilistic mixer-output attribution is acceptable evidence.

The ChipMixer Takedown (2023)

In March 2023, U.S. and German authorities seized ChipMixer, which had laundered an estimated $3 billion in cryptocurrency since 2017, including significant proceeds from ransomware operations and the Ronin hack. Once the operator's infrastructure was seized, the historical mixing record became available to investigators, allowing post-seizure attribution of mixed funds to original depositors and ultimate withdrawers. The takedown illustrates that centralized mixers offer anonymity until they don't, a single seizure can render years of historical activity transparent.

The BitMart Hack (2021)

In December 2021, BitMart suffered a $196 million hot wallet hack across Ethereum and BNB Smart Chain. Public blockchain forensic analysis traced the stolen funds through 1inch and Tornado Cash within hours of the breach. The case is a useful illustration of speed-of-tracing, the entire fund flow was mapped and circulated to compliance teams within the same day, even as the attacker was still moving funds.

The Bitcoin Fog / Sterlingov Case (2021–2024)

Roman Sterlingov was prosecuted as the alleged operator of the Bitcoin Fog mixing service, which laundered hundreds of millions of dollars in BTC over a decade. The conviction relied substantially on blockchain forensic evidence and Chainalysis Reactor expert testimony. Defense Daubert challenges to Chainalysis methodology were considered and denied. The case is the leading U.S. precedent for the admissibility of blockchain clustering evidence and commercial-platform expert testimony.

Pig Butchering Compound Investigations (Ongoing)

Ongoing federal and international investigations into Southeast Asian fraud compounds (Sihanoukville, Myawaddy / KK Park, Bokeo SEZ) rely heavily on cross-victim forensic clustering, identifying that funds from many individual victims consolidate into common compound infrastructure. The U.S. Treasury's sanctions against Cambodian Prince Group operators in 2024–2025 used blockchain forensic evidence as a foundation. See our breakdown of the SE Asia compound infrastructure for context on this category.

Court Admissibility (Daubert / FRE 702)

Crypto forensic reports are routinely admitted in U.S. federal civil and criminal proceedings, as well as in courts internationally. Admissibility under Federal Rule of Evidence 702 and the Daubert standard turns on documented methodology, reproducible findings, explicit confidence levels, and a qualified expert who can explain the analysis to a non-technical audience.

Key precedents establishing admissibility include U.S. v. Sterlingov (Bitcoin Fog), U.S. v. Storm and U.S. v. Pertsev (Tornado Cash), and a growing body of SEC and CFTC enforcement actions. The forensic profession has matured to the point that "is this admissible" is rarely the live issue, the live issue is methodology defensibility on cross-examination.

For attorneys evaluating blockchain forensic evidence in litigation, including admissibility considerations, expert witness preparation, and TRO/asset freeze workflow, see our complete attorney guide to blockchain forensic evidence in federal civil litigation.

What Happens After the Investigation

The investigation produces evidence. What you do with it determines whether recovery is possible. The three main paths:

Law Enforcement Referral

The forensic report and law enforcement package are submitted to the FBI via IC3, to IRS Criminal Investigation if tax fraud is involved, or to local agencies. Law enforcement can issue subpoenas to exchanges identified in the report and, in serious cases, pursue criminal prosecution. Reporting to the FBI doesn't guarantee action, but a professional forensic package significantly increases the probability of engagement.

Civil Litigation

When an exchange deposit is identified in a cooperating jurisdiction, an attorney can seek a civil subpoena (or work with law enforcement) to obtain account holder information and name a defendant. The forensic report becomes the foundational exhibit in the civil case. Civil litigation support includes expert witness services for cases that proceed to hearing.

Exchange Cooperation

Some exchanges will freeze accounts holding stolen funds when presented with a well-documented forensic report and law enforcement coordination. This is faster than court process but depends on exchange policy and whether the funds are still sitting in the identified account.

Frequently Asked Questions