Reconstruct what happened, to a standard.
Forensic reconstruction of on-chain events with a stated method, a preserved evidence chain and explicit limitations — prepared for investigative and evidentiary use, subject to the requirements of the jurisdiction it is used in.
What is blockchain forensics?
Blockchain forensics analyses public ledger data to cluster addresses, attribute activity to known services, and reconstruct fund flows. Forensic tools infer ownership from transaction patterns rather than observing it directly, so every finding carries a confidence level. An address is not a person, and attribution ages as services change infrastructure.
How a forensic reconstruction is built.
Scope
What is being reconstructed, over what period, on which networks, and to what depth.
Acquisition
Chain data acquired through the provider layer, with block heights and retrieval times recorded.
Verification
Key transactions independently verified against a second source where available.
Reconstruction
The sequence of events assembled, with each step referenced to a transaction.
Analysis
Clustering, attribution and exposure applied, each labelled with its method and confidence.
Documentation
Findings typed as fact, interpretation or unverified, with limitations stated.
What is preserved, and how.
| Control | What it provides |
|---|---|
| Acquisition record | Source, provider, block height and retrieval timestamp for every dataset used. |
| Integrity metadata | A checksum recorded for every stored artefact, so alteration after the fact is detectable. |
| Versioning | Artefacts and reports are versioned. Superseded versions are retained, not overwritten. |
| Access log | Every access to an evidence artefact is written to an append-only audit record. |
| Custody trail | Who added an artefact, when, and every subsequent action against it. |
| Export | Evidence exports carry the case identifier, version, checksum and generation time. |
Reports are prepared for investigative and evidentiary use, subject to applicable jurisdictional requirements. We do not claim that any report is admissible in every jurisdiction, because admissibility is decided by a court, not by a vendor.
Where the method genuinely ends.
A forensic report whose limitations are discovered by opposing counsel is worth less than one that stated them itself. Every report we produce has a limitations section, and it is written before the findings section, not after.
Method, tooling and limits.
Forensic crypto recovery describes applying blockchain forensics to a theft: reconstructing the fund path to a standard that survives scrutiny, with methodology stated and confidence graded. The forensic part is the discipline of the analysis. It does not imply the funds come back.
Analysis of a wallet’s on-chain behaviour: which addresses it controls, how it constructs transactions, which services it interacts with, and what its change patterns reveal. It is inference from public data, and it does not access the wallet or reveal its keys.
Through attribution sets built from public disclosures, observed interaction patterns and prior casework. These are inferences with a confidence level, and they age — service address sets change, so a label that was correct eighteen months ago may be wrong now.
Before you pay anyone, report the theft.
Reporting is free, it takes minutes, and it is the step most likely to matter. Do it before you engage us or any other investigator. A tracing report is far more useful to an exchange or a prosecutor when a formal complaint already exists to attach it to.
FBI IC3
The FBI Internet Crime Complaint Center. The primary US route for crypto theft and fraud. File here even if the amount feels small — IC3 aggregates reports, and clusters get investigated.
FTC ReportFraud
The Federal Trade Commission’s fraud reporting service. Covers scams, impersonation and investment fraud, and feeds a database used by law enforcement across the US.
CFTC
The Commodity Futures Trading Commission. The right route where the loss involves crypto derivatives, leveraged trading or a fraudulent trading platform.
SEC
The Securities and Exchange Commission. Use this where the asset or scheme was presented as an investment, a token sale or a fund.
Your local police
File a report in your own jurisdiction and keep the reference number. Banks, exchanges and insurers frequently require it, and it is often the precondition for any formal request to a service.
Report to your national fraud or cybercrime body and to your local police. If a card or bank transfer was involved at any point, contact your bank immediately — that is the one channel where speed can still change the outcome.
Blockchain analysis establishes where funds went and whether an intervention point exists. Whether anything is recovered depends on where the funds landed, how quickly you acted, and whether a cooperating exchange or authority sits at the end of the path. Read exactly what we can and cannot do, and how to spot a recovery scam before you pay anybody.