If you have just lost cryptocurrency to a scam, theft, or business dispute — or if you are an attorney whose client did — you are about to make a hiring decision under pressure. This guide is written to help you make that decision well. It explains what a blockchain forensic investigator actually does, what you should expect to receive, what fair pricing looks like, the questions to ask before paying anyone, and the red flags that signal a recovery scam dressed up as an investigation.
I run Wallet Witness, an independent blockchain forensic practice. I have written this guide the way I would explain it to a friend who called me at 11 p.m. after a $40,000 wallet drain. It is honest about what investigations can do, what they cannot do, and how to spot the people preying on victims while the panic is still fresh.
Time matters. Stolen cryptocurrency is typically moved through several wallets and converted within hours of the theft. The faster a forensic trace begins, the more recoverable the situation usually is. Contact Wallet Witness now → for a free case assessment within 24 hours.
Contents
What a Blockchain Forensic Investigator Actually Does
A blockchain forensic investigator analyzes on-chain data to determine where cryptocurrency moved, who controls the wallets that received it, and what evidence exists to support recovery through legal channels. The work is part data science, part open-source intelligence, part legal process knowledge.
What it is not is hacking. No legitimate investigator pulls funds out of a wallet they do not own. No legitimate investigator promises to "recover" your crypto by any technical means. Recovery, when it happens, runs through courts, exchanges, and law enforcement — and a forensic report is the document that makes those mechanisms work. For a deeper explanation of the field, see what is crypto forensics and how blockchain investigators trace crypto.
A typical engagement produces three categories of value:
- Visibility — you find out where your money went, often within 24 to 48 hours. This alone changes the case from "I have no idea" to "I have a documented trail."
- Leverage — if the funds reached a centralized exchange with KYC, the investigator's report enables a subpoena, civil discovery request, or law enforcement referral that can compel that exchange to identify the account holder.
- Admissibility — for cases that go to civil litigation or criminal prosecution, a forensic report and sworn declaration give attorneys and prosecutors something they can put in front of a judge.
When You Should Hire One
Not every situation needs a paid forensic investigation. Hire one if any of the following apply:
Hire if
If you lost a small amount, the situation is genuinely unrecoverable on its face (e.g., funds were swapped through a sanctioned mixer with no exit point), or you are not prepared to pursue any legal action — paying for a forensic report may not be the right step. A reputable investigator will tell you that on the first call. We do.
What You Should Get for Your Money
Before you pay, you should have a written scope of work specifying what you will receive. The deliverable should be a real document, not a screenshot stream. Here is what a complete forensic engagement produces:
| Deliverable | What It Contains | Why It Matters |
|---|---|---|
| Forensic Trace Report | Step-by-step transaction trail from victim wallet to current location, with every intermediate hop, timestamp, and amount | Establishes the chain of custody and shows exactly where the funds are now |
| Exchange Identification | Names of any centralized exchanges, OTC desks, or services that received the funds, with deposit transaction IDs | Identifies the subpoena targets and the parties who can be compelled to disclose KYC |
| Attribution Evidence | Wallet clustering, address reuse patterns, and OSINT links between wallets and known entities | Connects anonymous addresses to identifiable parties where the data permits |
| Sworn Declaration | A signed statement of methodology, qualifications, and findings suitable for court submission | Required for civil litigation, TRO applications, and criminal referrals |
| Recovery Roadmap | Specific next steps — which exchange to contact, what subpoena to draft, what agency to refer to, what the investigator can do next | Tells you what action to take with the report |
If a service offers only a verbal phone call, screenshots from a free block explorer, or a "we found your money" email — you have not been given a deliverable. A forensic report is a written, documented, defensible artifact. That is what you are buying.
Realistic Pricing
Pricing varies with case complexity, but the ranges below cover the vast majority of legitimate engagements. For a deeper breakdown see how much does a crypto investigation cost.
| Engagement Type | Typical Range | What's Included |
|---|---|---|
| Initial Trace Report (single wallet, single chain) | $1,500 – $3,500 | Trace, current location, exchange identification, basic recovery roadmap |
| Standard Investigation (multi-hop, attribution work) | $3,500 – $8,000 | Full trace, attribution evidence, exchange ID, sworn declaration |
| Complex / Multi-Chain Investigation | $8,000 – $20,000+ | Multiple chains, bridge tracing, mixer analysis, OSINT, expert declaration |
| Expert Witness Engagement (litigation) | $300 – $600/hr or flat fee | Rule 26 report, deposition prep, trial testimony |
Any service that charges a percentage of recovered funds is almost certainly a recovery scam. Real forensic work is paid as a flat fee or hourly engagement because the investigator is producing a report — not retrieving funds. Percentage-of-recovery pricing creates a fraud incentive: scammers can claim any number, take an upfront "fee," and disappear.
Questions to Ask Before You Pay
Pre-Engagement Questions
Red Flags That Indicate a Scam
The crypto recovery space is heavily contaminated with fraud. Many "recovery agents" who contact victims are scammers running a second-stage fraud against people who were already scammed once. See our companion piece on spotting recovery service scams.
Walk Away If
If a "recovery service" already contacted you, read this guide before engaging with them.
What the Engagement Process Looks Like
For context, here is exactly how an engagement with Wallet Witness works. Most legitimate investigators follow a similar structure.
- Free initial assessment. You email the basics: what happened, the wallet addresses involved, the approximate amount, and whether you have an attorney. We respond within 24 hours with an honest read on whether the case is investigable, what scope makes sense, and what it will cost.
- Engagement letter and scope. If you decide to proceed, you get a written engagement letter with the deliverable, the fee, the timeline, and what is and is not in scope. You pay through normal business channels — invoice, ACH, credit card.
- Investigation. The trace is performed. For most cases this takes three to ten business days. Complex multi-chain or multi-victim cases take longer.
- Report delivery. You receive the written forensic report, exchange identification, and any sworn declarations or recovery roadmap items in your scope.
- Follow-on support. If you proceed to litigation, law enforcement referral, or exchange subpoena, the investigator coordinates with your attorney or LE contact. Expert testimony, supplemental traces, and updated reports are billed separately.
Before you pay anyone, get an honest second opinion. Submit your case to Wallet Witness — we will tell you within 24 hours whether your case is investigable, what we would charge, and whether we recommend a different path. No fee, no obligation.
FAQ
Ready to Hire a Real Investigator?
Wallet Witness provides flat-fee blockchain forensic investigations for victims, attorneys, and law enforcement. Initial case assessments are free, and we will tell you honestly whether your case is investigable before you spend a dollar.
Start a Free Case Review