Follow the money, not the story.
Investment fraud, romance fraud, impersonation and business email compromise share one thing: the payments are real even when nothing else was. That is where an investigation starts.
What does crypto scam recovery involve?
Crypto scam recovery begins with investigation, not payment. A fraud investigation reconstructs how funds moved from a victim wallet to the scammer’s cash-out point, identifies the services that received them, and produces evidence an exchange, a lawyer or a police force can act on. It cannot guarantee that money comes back.
What we see most, and what tracing adds in each.
Investment fraud
A platform that showed a balance that never existed. Tracing follows real deposits to the services that received them.
Romance and long-contact fraud
Payments made over months. The pattern across them is usually more informative than any single transfer.
Phishing and approval drains
A malicious approval and the automated drain that followed, usually within minutes.
Business email compromise
Redirected settlement. Speed matters here more than in any other category.
Impersonation
Someone claiming to be a service, an official, or a recovery firm. Frequently the second loss, not the first.
Recovery fraud
Fraud targeting people who have already been defrauded. The most common follow-on we see.
Concretely, for a fraud matter.
| Contribution | What it means for your matter |
|---|---|
| Scale | Whether your loss sits alongside many others at the same receiving addresses — which changes what law enforcement can do with it. |
| Destination | Which services ultimately received value, and whether any of them identify their customers. |
| Timing | How fast funds moved, which speaks to automation and to the window for intervention. |
| Structure | Whether the operation used a repeatable pattern that links your case to others. |
| Documentation | A report a lawyer, an exchange or a police unit can actually work from. |
Report to the police or the relevant national reporting body in your jurisdiction even if you also engage an investigator. Aggregation across reports is often what makes a case actionable, and a private investigation is not a substitute for a report.
That is extremely common and it is not your fault — people who have lost crypto are the single most targeted group in this market. Bring both losses to a case assessment; the second one is often traceable because it was more recent.
No. A number displayed in a web interface is a number in somebody's database. What matters is whether a blockchain transaction ever moved value to an address you control. That is checkable, and we check it.
That is a fraud pattern, without exception. No legitimate service requires a payment to release funds it holds for you. Do not send it.
What a cryptocurrency investigation involves, and the tools it runs on
Blockchain investigation is a documented method, not a product. The tooling matters less than whether the reasoning behind each finding can be examined.
A crypto asset investigation reconstructs how value moved: which addresses cluster together, which entities they connect to, and how confident each of those conclusions is. Blockchain investigation tools automate the graph work, but every serious finding still rests on a heuristic that can be wrong, and a blockchain investigator who does not say which heuristic they applied has not given you evidence.
This is why cryptocurrency investigation software should be judged on transparency rather than on the size of its label database. A crypto investigations solution that outputs a confident answer with no visible reasoning is unusable in a proceeding, because the first question from opposing counsel is how the conclusion was reached.
Investigating a scam
Big crypto scams and small ones trace identically. What changes is the off-chain evidence — the platform, the messages, the payment rails — which is often what makes a case actionable.
Stolen crypto vs a failed investment
Not every loss is theft. Distinguishing fraud from a project that simply failed requires evidence of intent, which on-chain data alone rarely establishes. We will say which one your case looks like.
What blockchain investigation covers.
A blockchain investigation reconstructs how value moved across a public ledger: which addresses cluster together, which entities they connect to, and how confident each conclusion is. It combines on-chain analysis with off-chain evidence such as platform records and communications. It establishes what happened on the chain, not who was sitting at the keyboard.
Graph analysis over chain data, clustering heuristics, entity attribution sets, and monitoring. Blockchain investigation tools automate the mechanical work, but every material finding still rests on a heuristic that can be wrong. Judge a cryptocurrency investigation solution on whether it shows its reasoning, not on the size of its label database.
Before you pay anyone, report the theft.
Reporting is free, it takes minutes, and it is the step most likely to matter. Do it before you engage us or any other investigator. A tracing report is far more useful to an exchange or a prosecutor when a formal complaint already exists to attach it to.
FBI IC3
The FBI Internet Crime Complaint Center. The primary US route for crypto theft and fraud. File here even if the amount feels small — IC3 aggregates reports, and clusters get investigated.
FTC ReportFraud
The Federal Trade Commission’s fraud reporting service. Covers scams, impersonation and investment fraud, and feeds a database used by law enforcement across the US.
CFTC
The Commodity Futures Trading Commission. The right route where the loss involves crypto derivatives, leveraged trading or a fraudulent trading platform.
SEC
The Securities and Exchange Commission. Use this where the asset or scheme was presented as an investment, a token sale or a fund.
Your local police
File a report in your own jurisdiction and keep the reference number. Banks, exchanges and insurers frequently require it, and it is often the precondition for any formal request to a service.
Report to your national fraud or cybercrime body and to your local police. If a card or bank transfer was involved at any point, contact your bank immediately — that is the one channel where speed can still change the outcome.
Blockchain analysis establishes where funds went and whether an intervention point exists. Whether anything is recovered depends on where the funds landed, how quickly you acted, and whether a cooperating exchange or authority sits at the end of the path. Read exactly what we can and cannot do, and how to spot a recovery scam before you pay anybody.