A freeze is not a return. Stopping an asset is measured in hours and days. Getting money back into your account is measured in months, because it runs through law enforcement, courts or an issuer's payout schedule. A site quoting you “recovery in 48 hours” is quoting a freeze or lying. The figure above is not a window we commit to either: it is how often a freeze was already in place two days in, measured across our own cases, and every stage after it is published with its own timing. Stage by stage, with the timing of each: flagged, frozen, returned.
Stolen assets are traced across chains and mixers until they reach a service with a compliance department — an exchange, a payment processor, a stablecoin issuer. Done in-house, across Ethereum, Bitcoin, Tron, BSC, Polygon and Solana.
The trace becomes a filing with the compliance team of the exchange or issuer the funds reached. Requests go through each counterparty's official procedure — there is no private channel to any of them, and we do not claim one.
Executed by partner lawyers admitted in the relevant jurisdiction, under our case management. We do not practise law, and we say so rather than let the eleven steps below imply otherwise.
That is the entire honest toolbox. No recovery firm on earth can reverse a blockchain transaction, reach into a private wallet, or compel an exchange by phone call. Firms advertising those abilities are the reason the verification checklist exists. Ten checks you can run on us without contacting anyone, and equally on any other firm you are considering.
Eleven exact steps. A chain of custody documented end-to-end — from intake, through freeze request, to court-ordered transfer back to the rightful owner. Steps 05 to 10 are the ones a court and an exchange decide, not us.
The victim — or their legal counsel — initiates contact with StarCompliance. Intake receives the incident summary, wallet addresses, TXIDs, and amount at loss. Reviewed within two hours during business.
Analysts perform a preliminary on-chain sweep to gauge recovery potential. Flow traced, mixers and bridges identified, reachability confirmed — before any contract is signed.
Identity, KYC, and case documents are verified. A formal recovery contract is executed before any work begins: the scope, the responsibilities of each side and the commercial terms are set out in it in writing, and you read them before you sign.
A detailed on-chain forensic report — clustering, heuristics, risk scoring — is prepared in a format operationally useful for law enforcement. Advisory begins immediately to initiate asset freezing.
Law Enforcement Agents analyze the Investigation Report and prepare jurisdictionally-appropriate Freeze Requests targeted at specific Virtual Asset Service Providers.
Requests are sent in parallel to VASPs and stablecoin issuers across the applicable jurisdictions — minimizing the window in which funds can be moved or liquidated.
Receiving VASPs verify the authenticity of the Freeze Request and cross-reference the flagged addresses against their internal ledger and sanction lists.
The VASP responds to the request and provides KYC/KYT data to Law Enforcement — establishing custody, beneficial ownership, and transaction history.
Law Enforcement receives formal confirmation that the targeted assets have been frozen on-exchange, halting any further movement or liquidation.
Legal counsel obtains a Court Order authorizing the transfer of the seized assets from VASP custody back to the rightful owner.
Seized funds are transferred to the victim.
Before the freeze request in step 05, the stolen transactions are flagged to AML providers — within four hours of intake, and long before anything a court is involved in. What that flagging does, what it does not do, and why freezing and repayment are two further events: AML monitoring.
Step 02 is that sweep: the funds are followed far enough to tell whether they are still somewhere reachable, before anything is signed. What the reconstruction involves — contract calls, crossings between blockchains, and the endpoints a trail can end at — crypto tracing.
The fraud report in step 01 is the one you send us. It runs alongside the reports you file yourself — the national cybercrime portal, your local police, the exchange involved — which cost nothing, need no firm, and are what step 07 converts into a formal block. Where to report a crypto scam, by country.
The figures this page quotes — 200+ successful cases, $42.5M recovered in 2025, 68% on accepted cases — are published with the period each one covers on the figures page, the registry record behind the company name is on credentials, and the engagements we are allowed to describe are on cases.
Founder and CEO, StarCompliance · blockchain investigations since 2022 · interviewed by ForkLog, 23 July 2024 · on Bitcoin.com News, 30 April 2025 · LinkedIn
Reviewed by: compliance reviewer — not named: no reviewer profile has been supplied. We would rather name nobody than name someone we have not asked.