If you have lost cryptocurrency to a scam, a theft, or a business dispute, or you are an attorney whose client has, you are about to hire someone under pressure. This guide explains how to do that well: what the work is, what you should get, the questions to ask, the red flags, and what changes if the case is headed to court.
I run Wallet Witness, an independent blockchain forensic practice, and I am a crypto expert witness. My tracing and testimony were accepted in a 2026 divorce arbitration. This is how I would explain hiring an investigator to a friend who called me the night their wallet was drained, including how to spot the people who prey on victims while the panic is still fresh.
Time matters. Stolen funds usually move through several wallets and get converted quickly, and exchange records are easier to preserve early. Write down every wallet address and transaction hash you have before you do anything else. Send them to Wallet Witness → for a free case assessment within 24 hours.
Contents
What the Work Is (and Is Not)
A blockchain forensic investigator reads public transaction data to work out where cryptocurrency went, which services received it, and what evidence exists for the people who can act on it: courts, exchanges, and law enforcement. The output is a written report someone else can check.
It is not hacking, and it is not retrieval. No legitimate investigator pulls funds out of a wallet they do not control, and no one can promise that money will come back. When funds are returned, it happens through a court order, an exchange freeze, or a law enforcement seizure, and a forensic report is what supports those steps. For how the tracing itself is done, see how blockchain investigators trace crypto.
Good work gives you three things:
- A documented trail. Where the money went, hop by hop, with transaction hashes anyone can look up.
- A target. If funds reached an exchange that verifies its customers, the report identifies the exchange and the deposit, which is what a subpoena or law enforcement request needs.
- Evidence that holds up. A report and declaration written so an attorney can file them and an opposing expert can check them.
When Hiring Makes Sense
Hire if
It may not make sense if the loss is small relative to the cost of legal action, if the funds went somewhere with no realistic way to compel records, or if you do not plan to take any action with the report. An honest investigator will say so on the first call, before you pay anything. If you are unsure, read whether a crypto loss is worth investigating.
What You Should Receive
Before you pay, get a written scope that names the deliverables. A deliverable is a document, not a phone call or a stream of screenshots.
| Deliverable | What It Contains | Why It Matters |
|---|---|---|
| Trace report | The path from your wallet to where the funds are now, with every hop, timestamp, amount, and transaction hash | Shows exactly where the money went, in a form anyone can verify |
| Exchange identification | Any exchanges or services that received funds, with the deposit transactions | Names who can be subpoenaed or asked to freeze an account |
| Attribution notes | Why particular wallets are believed to belong to the same person or service, and the source for each claim | Separates what the chain shows from what the investigator infers |
| Signed declaration | A sworn statement of method, qualifications, and findings | What an attorney attaches to a motion or complaint |
| Next steps | Which exchange to contact, what to request, and which agency to refer to | Tells you what to do with the report |
The test I apply to my own reports is simple: every key figure should trace back to a public transaction hash. If a report asks you to take a number on faith, that number is where opposing counsel will attack it. Attorneys can use the crypto forensic report checklist to review any report, including mine.
Questions to Ask Before You Hire
Ask every investigator
Red Flags
Crypto recovery is full of fraud. Many "recovery agents" who contact victims are running a second scam on people who were already scammed once. See how to tell a legitimate service from a recovery scam.
Walk away if
How an Engagement Works
This is how an engagement with Wallet Witness runs. Most legitimate investigators follow a similar shape.
- Free assessment. You send what happened, the addresses and transaction hashes, and whether you have an attorney. Within 24 hours I reply with an honest read on whether the case can be traced, what scope makes sense, and whether I would recommend a different path.
- Engagement letter. If you go ahead, you get a written letter with the scope, the deliverables, the fee, and the timeline. Nothing starts until it is signed.
- The trace. I follow the funds, document each step, and note what cannot be determined and why. How long this takes depends on the number of wallets, chains, and swaps involved; the engagement letter gives the estimate.
- The report. You receive the written report, the exchange identification, and any declaration in scope.
- Follow-on work. If the case moves to a subpoena, a lawsuit, or a referral, I work with your attorney or the officer on the case. Testimony and updated traces are scoped separately.
If the Case Is Headed to Court: The Rule 26 Report
In U.S. federal court, a testifying expert usually has to deliver a written report under Federal Rule of Civil Procedure 26(a)(2)(B): every opinion with its basis, the facts and data considered, supporting exhibits, qualifications, prior testimony and compensation. The method will be tested under Federal Rule of Evidence 702, and unless the court sets other dates, expert disclosures are due at least 90 days before trial, so bring the investigator in early. State courts and arbitrations set their own rules; ask your attorney which apply.
In my 2026 arbitration, the question was whether my client was hiding crypto. The answer came from reconciling every wallet, by chain and by asset, inflows against outflows, until each balance was accounted for. That is what lets a tribunal check the work instead of trusting the expert. The expert witness service page covers how court-ready engagements work.
FAQ
Want a Second Opinion Before You Hire Anyone?
Send the addresses and transaction hashes. Within 24 hours you get an honest read on whether the case can be traced and what the report would cover, with no fee and no obligation.
Start a Free Case Review