Cryptocurrency Investigation & Tracing

What this service does

Cryptocurrency tracing is the documented process of following on-chain funds movement from a starting address through subsequent transactions, identifying clustering patterns and possible attribution to exchanges or service providers, and producing a written report that an attorney can use as the basis for civil discovery, exchange subpoena requests, or evidentiary submission.

Triage tracing. Initial investigation of a single victim address or transaction. Includes on-chain path documentation, identification of major service interactions (exchange deposits, mixer use, intermediate clusters), and a written summary suitable for sharing with counsel or law enforcement.
Deeper investigative work with attorney coordination. Multi-address tracing with documented methodology, attribution evidence where derivable from open data, and reports formatted for civil discovery use. Coordination with retained counsel throughout.
Documentation for law-enforcement referral. Reports formatted to make law-enforcement intake efficient. The reality is that local and state law-enforcement crypto-investigation capacity is limited; documented victim packages increase the probability of escalation to federal agencies with the capability to pursue.
Civil-litigation support. Expert documentation for attorneys pursuing civil recovery against on-chain wallets, custodians, or exchanges.

Scope and limits

Honest scope-setting is core to good forensic work. Cryptocurrency tracing is not the same as cryptocurrency recovery.

Tracing is not recovery. A trace can document where funds went, identify likely exchange interactions, and support civil or law-enforcement action. It cannot, by itself, return funds to a victim. Anyone who promises recovery in advance of investigation is not engaged in honest forensic practice.

Free open-source tooling is the default. This practice uses Crystal Lite, Breadcrumbs.app, GraphSense, OXT.me, WalletExplorer, Blockchair, Mempool.space, Chainabuse, and Maltego Community Edition for most work. Paid commercial tooling (Chainalysis Reactor, TRM, Elliptic) is acknowledged where it would meaningfully change results — typically only relevant in larger-budget engagements with attorney coordination.

Reports state tooling and limits explicitly. Every written report identifies the tools used and the limits of those tools. This is methodological discipline, not a disclaimer — it makes the report defensible and useful in proceedings.

No covert work. Engagements require either a clear victim or a clear retaining attorney with a documented interest. Open-data tracing only; no breaches, no social engineering, no covert acquisition of credentials.

Pricing

Pricing is per engagement and discussed during scoping. Typical ranges:

Triage trace: $1,500 – $3,000 — initial investigation of a single victim address, written summary report, approximately one-to-two-week turnaround.
Deeper investigation with attorney coordination: $5,000 – $10,000 — multi-address tracing, attribution work, coordination with retained counsel, four-to-eight-week timeline depending on complexity.
Commercial tool access (BlockTrace, Arkham, others): billed as case expense when used, with the client informed before any paid tool is engaged.

Why this practice

Cryptocurrency investigation is a field with no licensing barrier and a large gap between competent practitioners and people running recovery scams against people who have already been scammed once. The differentiator here is documented professional experience in the blockchain investigation field.

CISSP CSSLP CRISC Ex-Chainalysis

Previously at Chainalysis Inc. Customer Success Engineer, 2017–2019. Direct experience with deployment and operational use of the Chainalysis investigations platform across U.S. and foreign government agencies. Working knowledge of clustering heuristics, attribution methodology, and the operational limits of commercial blockchain analysis platforms.
FLETC instructor. Co-instructed cryptocurrency investigation training (Chainalysis Reactor) at the Federal Law Enforcement Training Center in Brunswick, Georgia.
19+ years in security and software architecture across Bank of America, Citigroup, Verizon, Walmart, and others.
Active blockchain research including security analysis of the Coinbase Advanced Trade API as a registered HackerOne security researcher.

Who this serves

Victims of pig-butchering and romance scams seeking documented tracing of where their funds went, particularly when filing law-enforcement reports or pursuing civil recovery.
Family members of elderly victims who need professional documentation of fund movement for guardianship, estate, or recovery purposes.
Civil-litigation attorneys representing victims and needing technical foundation for subpoenas, discovery, or expert documentation.
Elder-law and estate attorneys handling matters where cryptocurrency-related fraud is an element of the case.

Start a conversation

Fill out the form below or schedule a 30-minute scoping call. For active fraud matters, faster response is given to inquiries that include relevant attorney contact information.