A recurring situation, and an uncomfortable one for everyone in it: the client has a good lawyer, the lawyer has a good case on paper — a clear theft, a clear victim, a clear loss — and the case is stuck, because nobody in the room can say where the money is.
The lawyer knows how to file, how to apply for an order, how to approach a foreign court. What they do not have is the sentence every one of those steps has to start with: "the funds are at this venue, in this account, and here is the evidence." This article is about the division of labour between a crypto recovery lawyer and a blockchain investigator, what each needs from the other, and the order in which the work has to happen.
Why a strong lawyer gets stuck
Legal process acts on parties. A claim is brought against someone; an order is served on someone; a freeze is requested from someone who holds the assets. In a conventional fraud, the parties are known or discoverable through the banking system — a bank account has a name on it, and a court can order the bank to say whose.
In a crypto theft, the moment of loss produces a transaction hash and a receiving address, and nothing else. There is no party yet. The address cannot be linked to an identifiable party until it is attributed to a service, exchange or other entity that can be contacted, requested or legally compelled to act. Between the hash and the party lies the investigative work, and until it is done the lawyer has a client, a loss and no defendant. Filing against "persons unknown" is possible in some jurisdictions and is sometimes the right first move, but it does not by itself locate anything.
The second reason is time. A stolen balance moves. A freeze request is most effective while the funds remain at the identified venue; delays can significantly reduce the chances of an effective freeze. The legal steps have their own clock — a police report, an application, a hearing — and the investigative work has to be far enough ahead of it that the target is still where the papers say it is.
What the investigator produces, and what it is for
An investigation ends in a blockchain investigation report. Its purpose is not to persuade; it is to give the lawyer the facts each legal step is built on, in a form the recipient of that step can check. The pieces are these.
The trace
Where the funds went, from the theft transaction to the present, across every chain, bridge and swap they passed through, with a transaction hash behind every movement. This is the narrative of the case. The method is described on the crypto tracing page; the point of this crypto asset tracing, for the lawyer, is that every sentence in it is independently verifiable by anyone with the hashes.
The endpoints
The addresses where the funds stopped, and what each one is: an account at a named exchange, attributed with a stated confidence; a service that will respond to a request; a self-custody address that will not; a mixer where the trail has to be worked statistically. This is the list of parties. It tells the lawyer whom to write to, in which jurisdiction, and in what order.
The evidence pack
The artefacts behind the trace, fixed so that they cannot be disputed later: exports of the transactions, the attribution sources, the timeline, and the analyst's reasoning where a step is an inference rather than a fact. In our practice, evidence is fixed with SHA-256 hashes and a chain of custody is kept when it is handled. Whether a given court accepts a given report is that court's decision; the investigator's obligation is to make it checkable, and to say plainly where attribution stops.
The flags
Something a lawyer cannot do and often does not know exists: the stolen transactions are submitted to screening providers used by exchanges, so that the transactions can be identified as flagged and assessed by the relevant compliance team. In our process, we aim to submit stolen transactions to AML providers within four hours of intake. It is usually the fastest step in the whole sequence and can help buy time for the legal steps.
What the lawyer produces, and what it is for
The investigator's report identifies the party; the lawyer acts on it. Three steps, in order, each of which needs the one before.
The police report. Filed where the victim is, with the trace attached, so that the case has a reference number and a public authority behind it. Some exchanges may hold funds provisionally on a well-evidenced request. A police report can support the transition from a provisional hold to a more formal or longer-term freeze, depending on the exchange, jurisdiction and circumstances of the case. Without formal law-enforcement documentation, some exchanges may limit the duration or scope of a provisional hold.
The freeze request. A freeze request may be submitted to the venue's compliance team, with formal law-enforcement involvement often required for a continued or final freeze. Based on our case experience, responses may sometimes be received within 2–4 days from exchanges and within 24–62 hours from stablecoin issuers. Actual timelines vary depending on the case, jurisdiction and supporting evidence. We have no private channel into either, and anyone who claims one should be asked to show it. Where the funds are USDT, the issuer publishes its own Law Enforcement Requests Policy, which is worth reading before the request is drafted.
The order and the release. Turning a freeze into a return usually requires a formal legal or law-enforcement process, which may include a court order depending on the jurisdiction and the venue. This is where the case often becomes conventional crypto litigation again — with a defendant, an order, a hearing — and where the timelines lengthen.
In the cases handled by our team, a return from an exchange has typically taken six to nine months, complex or multi-jurisdiction matters six to thirty-six, and a first payout where a stablecoin issuer reissues funds twelve to twenty months or longer, depending on the legal process and the circumstances of the case. The stages and the clocks are on our figures page.
The order matters
The mistakes we see are almost always mistakes of sequence, not of competence.
- Filing before tracing. A police report without transaction hashes, addresses or tracing information may provide investigators with fewer actionable leads. A claim against persons unknown with no endpoint identified has nobody to serve. Trace first, even a preliminary sweep, so that the first filing contains the facts a unit can act on.
- Writing to the wrong party. A demand letter to the address the funds first landed at reaches nobody; that address was a hop. The letter that matters goes to the venue where the funds are now, and only the trace says which venue that is.
- Waiting for the order before requesting the freeze. While the legal process continues, some exchanges may consider a provisional hold based on sufficiently detailed evidence. Waiting for a court to compel what a compliance desk might have done voluntarily can cost weeks, and the funds do not wait.
- Treating the freeze as the end. A freeze stops the money; it does not move it. Clients hear "frozen" and expect a transfer. The legal work has just begun, and the lawyer is the one carrying it from here.
- Choosing the jurisdiction before the trace. Where the venue is, where the funds are and where the victim is can point to different courts; counsel decides which forum is workable, and the trace tells counsel which of these are in play.
How the engagement is usually scoped
When a law firm or an insurer is already handling the matter, the investigative work is engaged on its own — the trace, the endpoints, the evidence pack and the flags — and the legal steps stay with the lawyers. That is the normal arrangement, not an exception, and it is how a firm like ours works with counsel: we do not practise law, and every legal step in our own cases is carried out by partner firms admitted in the relevant jurisdiction, under our case management. Where there is no lawyer yet, the same split applies with the partner firm on our side. Who does what, stage by stage, is set out on the recovery process page.
A word on what an investigator should not be asked to do: give legal advice, predict what a court will do, or state that a report will be accepted anywhere. Admissibility is decided by a court; the investigator's job is to write something that can survive the question. Equally, a lawyer should not be expected to read a chain. The two skills do not overlap much, and the cases that go well are the ones where nobody pretends they do.
What to bring to the first conversation
For the investigator to give a useful answer in the first call, the lawyer needs: the transaction hashes of the theft, the victim's addresses, the date and mechanism of the loss as the client understands it, any communication with the thief or the platform, and the jurisdictions already in play — where the client is, where any report has been filed.
With that, a preliminary sweep answers the question that decides everything else: are the funds at a venue that can be asked, or are they not. In our case the assessment is free, we aim to respond within two business hours, and the honest answer may be that there is nothing to pursue, which is the answer a meaningful share of enquiries get. The published threshold is a loss from $200,000; smaller cases are reviewed individually. How to check any firm — including us — before engaging it is on the verification page.
If the funds are traceable and the loss is significant, send us the transaction hashes: the assessment is free, and we aim to respond within two business hours, including when the answer is that there is nothing to pursue. Write through the contact page or message @StarCompliance on Telegram.
Questions counsel ask before engaging an investigator
Can you identify the thief?
On-chain evidence usually identifies addresses and services rather than conclusively identifying the individual controlling them. The trace reaches an account at a venue; the venue holds the identity, and it releases it to an authority or a court, not to us. That step is yours.
Will your report be accepted by the court?
That is the court's decision, and we do not claim it in advance. What we can say is what the report contains — hashes behind every step, sources behind every attribution, inference labelled as inference, artefacts hashed and logged — and that reports of this kind are what freeze requests and police filings are built on in our own cases.
How fast can you tell us whether there is a case?
We aim to answer the assessment within two business hours of receiving the hashes. If it is a case, we aim to submit the stolen transactions to AML providers within four hours, and freeze requests follow; based on our case experience, responses may sometimes be received within 2–4 days from exchanges and within 24–62 hours from stablecoin issuers. If it is not, we say so and stop.
Do you take the whole case or only the forensic part?
Either. With counsel already engaged, the usual scope is the investigative work alone. Without, the legal steps run through our partner firms in the relevant jurisdiction, and we manage the case end to end. In neither arrangement do we practise law.
What should we bring to the first call?
The transaction hashes of the theft, the victim's addresses, the date and mechanism of the loss, any communication with the thief or the platform, and the jurisdictions already in play. With that, a preliminary sweep answers whether the funds are at a venue that can be asked.
Do you give legal advice?
No. We do not practise law; every legal step in our own cases is carried out by partner firms admitted in the relevant jurisdiction, and we do not predict what a court will decide.
