Crypto theft
investigation
and tracing.
We trace stolen crypto for victims before it vanishes into mixers, bridges and off-ramps. We investigate and prepare the evidence; law enforcement sends the freeze request on the basis of our report. In 42% of our cases the freeze was in place inside 48 hours.
Partners and coverage.
The analytics firms we work with, and the outlet that covered our work.
What we do.
Crypto theft investigation, tracing and evidence. We investigate and prepare the evidence; law enforcement sends the freeze request on the basis of our report.
Crypto Tracing
On-chain analysis across wallets, bridges, and exchanges, documented hop by hop.
Freeze Evidence
We investigate and prepare the evidence; law enforcement sends the freeze request on the basis of our report to the exchanges and issuers holding the funds. Flagged to AML providers within four hours of intake.
Crypto Recovery
Recovery runs through law enforcement, partner lawyers and the courts. We prepare the evidence and manage the case.
Scam Investigation
Deep investigation of phishing, fraud, rug pulls, impersonation — we map the full attack vector.
AML Monitoring
Transaction monitoring and AML compliance for exchanges. FATF-aligned.
Forensic Reports
Documented, reproducible on-chain findings a compliance officer, an investigator or counsel can act on.
Mixer Tracing
Tracing through Tornado Cash and other privacy protocols, with the confidence of each link stated.
Compliance Audits
AML/CFT audits aligned with FATF standards and UAE law.
Why victims
of large
crypto thefts
work with us.
We investigate and prepare the evidence; law enforcement sends the freeze request on the basis of our report. Partner lawyers take the legal steps in the jurisdiction of each case, across the 12 we work in, and our 68% success rate on accepted cases is measured over the past 24 months.
Clear Division of Work
Tracing, evidence and case management are ours. Law enforcement sends the freeze request on the basis of our report; partner lawyers take the legal steps.
< 2 Hour Response
Our intake team works 24/7. Speed is the single largest predictor of recovery success.
12 Jurisdictions
Cases worked across 12 jurisdictions from Dubai, with every legal step taken by partner lawyers admitted locally.
Reports Built to Be Checked
Every investigation produces forensic documentation whose findings trace back to transactions anyone can open.
How a recovery
case runs.
A transparent, structured process — from first contact to asset return. CRAAS (Crypto Recovery as a Service) operates on a six-stage protocol.
* Timelines are indicative. Duration depends on jurisdiction, fund location, and law enforcement response.
5,000,000 USDT
recovered.
For CoinsPaid.
An investigation for one of Europe's largest crypto payment providers, documented end to end: stolen funds traced across multiple chains.
recovered.
Bitcoin.com News interviewed CoinsPaid’s CEO and our founder about the case on 30 April 2025. The full recording is on X.
Scams
we
investigate.
We work exclusively on cases where a viable recovery path exists.
All six types, in full →Phishing Scams
Fake portals and drainers that siphon wallets via malicious signatures. We trace the recipient addresses and document them for the freeze request.
Investment Fraud
Fraudulent platforms promising high yield. We map the flow from deposit to final off-ramp.
Rug Pulls
Developer-exit scams. Our reports identify beneficiaries across mixers and bridges.
Pump & Dump
Market manipulation. We document coordination patterns for regulator and court submission.
Impersonation Scams
Fake support, exchange reps, and celebrities. We trace impersonator wallets to real off-ramps.
Fake Wallets & Apps
Trojan apps that replace addresses or exfiltrate keys. We reconstruct the theft and trace where the funds went.
Airdrop Scams
Fake tokens that demand wallet access. We trace the approvals and the wallets that received the funds.
Romance Scams (Pig Butchering)
Long-form social manipulation. We map flows from victim wallet to criminal off-ramp.
Frequently asked
questions.
Straight answers on pricing, process, and eligibility. Anything else — send us a message.
Is your case
eligible?
- From $200,000 USD equivalent — smaller cases considered individually
- Transaction hashes (TXIDs) available
- Incident within days preferred — older cases evaluated individually
We evaluate every case. Assets that have remained stationary since the incident may be recoverable regardless of time elapsed.
Act immediately.
Every hour increases the risk of fund movement. Early engagement is the single strongest predictor of recovery success.
Lost crypto?
Contact us.
Our intake team reviews new cases within 2 hours during business hours. All submissions are confidential and treated with the highest discretion.