Crypto Scam Investigation: Find Out Where Your Funds Went
I'm Zack Coffing, an independent blockchain forensic investigator. When crypto is stolen in a scam, I trace it from your wallet to the exchanges where it landed and document every step in a report your attorney and law enforcement can act on.
What a scam trace tells you
Scammers count on the trail looking impossible to follow. It isn't. Every transfer is recorded on a public blockchain, and I read that record from the first transaction out of your wallet.
- Where the funds went, hop by hop, through splits, swaps, and bridges, until they reach an exchange or stop.
- Which exchanges received them: the deposit addresses and transactions your attorney can subpoena for account records or send a freeze request about.
- Whether anything may still be freezable, such as USDT still sitting at an address Tether can freeze. When that's possible, it's the first thing I check.
- Where the trail ends. If funds went into a mixer, a privacy coin, or an off-exchange trader, the report says so plainly.
The blockchain shows how money moved, not who controls a wallet. Names come from exchange account records, which is why the report points to the exact accounts to subpoena.
What you get
This is a redacted page from a real 2026 matter. Scam reports use the same format: one chart per wallet or cluster, showing where funds came from and where they went.
- Fund-flow charts from your wallet to each exchange or endpoint.
- A list of exchange deposits: exchange, address, transaction, date, and amount, ready for a subpoena or a law enforcement request.
- A plain-language summary you can attach to your IC3 report or hand to a detective.
- A methodology and limits section stating what was traced, what wasn't, and why.
Scams I investigate
- Pig butcheringLong-con investment scams run from overseas compounds. How they move the money.
- Romance scamsA relationship first, then an "investment." The playbook.
- Fake exchanges and trading appsIncluding "pay a tax to withdraw" demands. How that scam works.
- Wallet drainers and phishingMalicious approvals and fake sites. How drainers work.
- Address poisoningLook-alike addresses planted in your transaction history.
- ImpersonationFake exchange support, fake government agents, fake law firms.
- Rug pulls and exit scamsProjects that take the money and disappear.
- Recovery scamsThe second hit, aimed at people who were already scammed. How to tell.
Is your case worth investigating?
- Losses of $50,000 or more. Below that, a full trace usually costs more than it can realistically achieve, and I'll point you to free steps instead.
- At least one starting point: a transaction hash, an address you sent funds to, or an exchange statement.
- Time matters. Freezes happen in hours and days, not months. If funds may still be moving, say so when you reach out. See what to do in the first 72 hours.
If a trace won't change anything for you, I'll tell you in the free review, before you spend anything.
What I don't do
- No recovery promises. Getting funds back is a legal process run by attorneys, courts, exchanges, and law enforcement. Anyone who guarantees it is a red flag.
- I never ask for your seed phrase, private keys, or passwords.
- No "hacking back." Stolen crypto can't be pulled back by force, whatever someone online tells you.
- No contingency fees and no surprise bills. Fees are hourly, and you get a written estimate first.
- I don't contact victims first. If someone messaged you offering to recover your crypto, treat it as a second scam.
How it works
Free 30-minute case review
You tell me what happened and what you have. I tell you what a trace can and can't do for your case.
Written scope and hour estimate
Before any billable work: what I'll trace, what I need from you, and how many hours it should take.
Trace and report
Anything that might still be freezable comes first. Then the full trace, the exhibits, and the written report.
Hand-off
The report goes to you, your attorney, or the detective on your case, and I answer their questions about it.
File your reports at IC3.gov and ReportFraud.ftc.gov either way. A trace makes those reports specific. For the realistic options after a trace, see can you get crypto back after a scam.
Book a Free 30-Minute Case Review
Frequently asked questions
Can you get my crypto back?
I can't promise that, and no honest investigator will. I trace where the funds went and document it, so your attorney, law enforcement, or the exchange can act through freezes, subpoenas, and court orders. Whether money comes back depends on where it landed and how fast those steps happen.
How much does a crypto scam investigation cost?
It depends on how many wallets, chains, and hops the funds went through. I bill hourly, never on contingency. The 30-minute case review is free, and you get a written scope and hour estimate before any billable work starts. For typical market ranges, see what a crypto investigation costs.
Should I report the scam to the FBI first?
Yes. File at IC3.gov and with your local police as soon as you can. A trace doesn't replace those reports. It gives them something specific to act on: the exchanges and transactions involved.
Someone contacted me offering to recover my crypto. Are they legitimate?
Almost certainly not. Scammers re-target victims, posing as investigators, hackers, or law firms who can get the money back for a fee. Legitimate investigators don't reach out first, don't guarantee recovery, and never ask for your seed phrase. More in are crypto recovery firms legit.
What do I need to start?
Transaction hashes or the wallet addresses you sent funds to, a timeline of what happened, and any screenshots of the platform or chats. One transaction hash or one address is usually enough to start.
Is there a minimum loss?
Yes, losses of $50,000 or more. Below that, the cost of a full trace usually outweighs what it can realistically achieve, and I'll point you to free steps instead.
Zack Coffing
Founder of Wallet Witness. Independent blockchain forensic investigator, in crypto since 2017, with 20+ cases investigated and $10M+ traced. Full background.