Priced for the work, never for the outcome.
The case assessment is free. Investigative work is scoped and quoted before it begins. We do not take a percentage of anything recovered, because that structure rewards promising outcomes nobody controls.
What does a crypto investigation cost?
A crypto investigation is priced on scope: how many transaction hops, how many chains, and whether funds entered constructions that break a trace. The initial case assessment is free. ChainwatchCrypto charges no contingency fee and takes no percentage of recovered value, because neither would be honest where recovery cannot be promised.
Three ways to work with us.
Which one fits depends on whether you are bringing a single incident, running a matter, or integrating intelligence into a business process.
Case assessment
- Confirmation that your transactions exist as described
- An early read on whether tracing can produce anything useful
- Scope and complexity if an investigation is worth running
- A written quote before any chargeable work
- A straight answer if the honest one is that we cannot help
Scoped investigation
- Transaction tracing to an agreed hop depth
- Wallet clustering and exposure analysis where supported
- Entity attribution with source, evidence and confidence
- A structured evidence report with methodology and limitations
- Recommended next steps supported by the findings
- Case management, messaging and the evidence vault included
Platform agreement
- Direct platform access with role-based permissions
- Monitoring, KYT, KYB and sanctions screening
- API keys, scopes and signed webhooks
- Configurable risk policy and versioned rules
- Audit records and examination support
- Investigation capacity available alongside
Why we will not publish a price list.
Two cases with identical loss amounts can differ tenfold in effort. A published price per case would be either meaningless or wrong, so we quote against scope instead.
| Factor | Low effort | High effort |
|---|---|---|
| Hop depth | Funds reached a service within two or three hops | Long chains with repeated splitting and consolidation |
| Networks | A single supported chain | Multiple chains with bridge transfers to match |
| Constructions | Direct transfers throughout | Peel chains, pooling constructions, automated splitters |
| Attribution | Terminal address already attributed with a recorded source | Attribution work required, or none possible |
| Evidence volume | A handful of transactions and one exchange ticket | Months of correspondence across several platforms |
| Reporting standard | A report for your own use | Documentation intended to support a filing |
That is most of what it is for. If your case sits firmly in the right-hand column and the amount at stake does not justify the effort, we will say so rather than quote it.
What is always included
What we will never charge for
It is fraud, without exception. No legitimate service requires payment to release funds that are already yours. Read the recovery scam guidance.
How an invoice is paid.
Invoices settle by bank transfer or in crypto. The crypto routes below are the ones the platform currently accepts, with the confirmation threshold that determines when a payment becomes available.
Receiving addresses are issued inside your account, behind authentication, on the Deposit and Pay screens — never on a public page and never over email or chat. That is deliberate: an address on a page anyone can clone is an address an impersonator can swap.
Before you pay anyone, report the theft.
Reporting is free, it takes minutes, and it is the step most likely to matter. Do it before you engage us or any other investigator. A tracing report is far more useful to an exchange or a prosecutor when a formal complaint already exists to attach it to.
FBI IC3
The FBI Internet Crime Complaint Center. The primary US route for crypto theft and fraud. File here even if the amount feels small — IC3 aggregates reports, and clusters get investigated.
FTC ReportFraud
The Federal Trade Commission’s fraud reporting service. Covers scams, impersonation and investment fraud, and feeds a database used by law enforcement across the US.
CFTC
The Commodity Futures Trading Commission. The right route where the loss involves crypto derivatives, leveraged trading or a fraudulent trading platform.
SEC
The Securities and Exchange Commission. Use this where the asset or scheme was presented as an investment, a token sale or a fund.
Your local police
File a report in your own jurisdiction and keep the reference number. Banks, exchanges and insurers frequently require it, and it is often the precondition for any formal request to a service.
Report to your national fraud or cybercrime body and to your local police. If a card or bank transfer was involved at any point, contact your bank immediately — that is the one channel where speed can still change the outcome.
Blockchain analysis establishes where funds went and whether an intervention point exists. Whether anything is recovered depends on where the funds landed, how quickly you acted, and whether a cooperating exchange or authority sits at the end of the path. Read exactly what we can and cannot do, and how to spot a recovery scam before you pay anybody.