How a Recovery Investigation Works

Initial Case Assessment

We evaluate whether your case is feasible before any engagement.

Every engagement begins with a confidential, no-cost assessment. We review the facts you provide — what was lost, how, when, and what evidence exists — and evaluate whether tracing and recovery are realistically possible. If the case is not feasible, we tell you directly. We do not take on cases we cannot meaningfully advance, because our fee is success-based: we only earn when you recover.

• —No-cost, no-obligation evaluation
• —Feasibility assessment before engagement
• —Honest assessment — we decline unfeasible cases

Evidence Preservation

We secure and preserve all evidence before it can degrade or disappear.

The moment we engage, we work with you to preserve every piece of evidence: transaction hashes, wallet addresses, communications, platform records, and financial documents. In crypto cases, on-chain evidence is permanent, but off-chain evidence — chat logs, platform screenshots, account records — can be deleted by perpetrators or lost over time. We document and preserve everything in a format suitable for legal proceedings.

• —On-chain transaction evidence secured
• —Off-chain communications and records preserved
• —Evidence packaged for legal admissibility

Blockchain & Financial Tracing

We trace where the assets went — across wallets, exchanges, and borders.

For cryptocurrency cases, we reconstruct the transaction graph: following funds as they move between wallets, through mixers, across blockchains, and into exchanges. For fiat cases, we trace the correspondent banking chain, wire transfers, and account flows. Tracing establishes where assets currently sit, which services handled them, and when key movements occurred. This is the forensic foundation of every case.

• —Transaction graph reconstruction across blockchains
• —Correspondent banking and wire tracing for fiat
• —Mixer, bridge, and cross-chain analysis where needed

Counterparty Identification

We identify who ultimately controls the assets — not just where they sit.

Tracing tells us where funds went. Identification tells us who received them. This is where our HUMINT methodology differentiates us from firms that rely on forensics alone. We use human intelligence operations — lawful cover operations, relationship mapping, and elicitation — to link wallets and accounts to real-world individuals. On-chain data rarely names a person; our methodology does.

• —Wallet clustering and entity attribution
• —HUMINT operations to identify real-world controllers
• —Beneficial ownership piercing for shell entities

Exchange & VASP Intelligence

We identify the exchanges and virtual asset service providers that hold or handled the funds.

When funds reach a regulated exchange or VASP (Virtual Asset Service Provider), a critical identification point is created — these services hold KYC on their customers. We identify which exchange or VASP received the funds, when, and in what amount. This establishes the lawful disclosure pathway: the exchange can be compelled, through proper legal channels, to produce account holder information and potentially freeze the funds.

• —Exchange and VASP identification from on-chain data
• —KYC-linked identification point establishment
• —Freeze and disclosure pathway mapping

Legal & Compliance Coordination

We coordinate with local counsel to ensure every action is lawful in its jurisdiction.

Every jurisdiction defines what investigative and recovery methods are lawful. Before any action is taken, we verify compliance with local counsel in the relevant jurisdiction. We do not circumvent local law — we work within it. Our intelligence findings are produced for lawful use and are verified for admissibility in the jurisdiction where they will be used. This is non-negotiable.

• —Local counsel coordination in every relevant jurisdiction
• —Compliance verification before any action
• —Evidence verified for local admissibility

Law-Enforcement & Regulatory Referral

Where appropriate, we coordinate with law enforcement and regulators — not as a substitute for legal action, but as a complement.

In some cases, the most effective path to recovery involves law enforcement or regulatory action — criminal investigations, freezing orders, or regulatory enforcement against a non-compliant exchange. We prepare evidence packages suitable for referral and coordinate with the appropriate authorities. This is not always the right path: in some cases, civil action is faster and more effective. We advise on which approach — or combination — best serves your recovery objective.

• —Evidence packages prepared for referral
• —Coordination with law enforcement where appropriate
• —Civil vs. criminal strategy advisory

Recovery Strategy

We design the recovery strategy that maximizes the chance of actual return of funds.

Tracing and identification are not recovery. Recovery requires a strategy: which legal mechanism, in which jurisdiction, against which party, in what sequence. We design this strategy in coordination with your legal counsel, drawing on the intelligence we have gathered. The strategy may involve civil claims, freezing injunctions, disclosure orders, settlement negotiations, or a combination — always aligned with the evidence and the jurisdictions involved.

• —Recovery mechanism selection per jurisdiction
• —Strategy coordinated with client legal counsel
• —Civil, criminal, and negotiated pathways assessed

Case Monitoring

We monitor the case throughout — because assets move and circumstances change.

Recovery is rarely instantaneous. Between strategy and outcome, assets may move, counterparties may attempt to dissipate holdings, and new information may emerge. We monitor on-chain activity, account movements, and jurisdictional developments throughout the engagement. If circumstances change, the strategy adapts. We keep you informed at every stage, with no black-box reporting.

• —Continuous on-chain and account monitoring
• —Strategy adaptation as circumstances change
• —Transparent reporting throughout the engagement