On-chain tracing

We follow the money, and you can check our work

A confirmed blockchain transaction cannot be reversed by anyone. What can be done is follow it — hop by hop — to the point it reaches a service that has to answer for it. Every step we record carries a transaction hash you can open on a public explorer yourself.

What a trace actually looks like

Funds rarely go straight from you to a cash-out. They are split, layered and bridged. This is the shape of a typical trail, and the point at which it becomes actionable.

  1. 1

    Your wallet

    Your payment
    0x4f2a…c19d

    The payment leaving your own wallet, with the hash from your wallet history.

  2. 2

    First receiving address

    Controlled by the operation
    0x91bb…7e05

    Controlled by the operation. Usually emptied within hours.

  3. 3

    Splitting layer

    Controlled by the operation
    0xe70c…2a44

    Funds divided across several addresses to break the trail. Clustering analysis reconnects them.

  4. 4

    Bridge or swap

    Controlled by the operation
    0x5af3…b8c1

    Moved to another chain or swapped for a different asset. The trail continues on the new chain.

  5. 5

    Exchange deposit address

    Actionable — a regulated service
    0xcc12…9f37

    The pressure point. This service knows who its customer is and can freeze the balance.

Illustration of the structure, not a real case. The addresses shown are examples.

Check it yourself

This is the part that separates a trace from a claim about a trace. Every crypto payment on your case carries its hash, and in your account each one is a link to a public block explorer. You do not need us, or any special tool, to confirm it.

  1. 1 Open your claim and find the payment in the payments list.
  2. 2 Click the hash. It opens the transaction on a public explorer — Etherscan for Ethereum, Mempool for Bitcoin, Tronscan for Tron, and so on.
  3. 3 Check the amount, the date and the receiving address against what your own wallet shows.
  4. 4 Follow the receiving address on the same explorer to see where the funds went next.

If a firm shows you a trace you cannot independently verify, ask why. On public chains there is no reason to keep the hashes to ourselves.

Chains we resolve to an explorer

Algorand Arbitrum Avalanche C-Chain BNB Smart Chain Base Bitcoin Bitcoin Cash Cardano Cronos Dogecoin Ethereum Fantom Litecoin Optimism Polygon Solana Stellar Tron XRP Ledger

Where a network is not in this list we still record the hash — it simply appears as plain text rather than a link.

From hash to recovery

Tracing is a means, not an end. It exists to reach somebody who can return the money.

01 INTAKE

Case intake and triage

Every payment recorded with its hash, reference or beneficiary details. We establish which rail each one left on, and which deadlines are already running.

02 TRACE

On-chain tracing

We follow each transfer hop by hop across chains, cluster the addresses that move together, and flag where funds entered a mixer, a bridge or a known service.

03 IDENTIFY

Identify the custodian

The question is not who the fraudster is — it is who is holding the money now. A named exchange, custodian or processor is a party with compliance obligations and an address to write to.

04 FREEZE

Freeze and report

A freeze request goes to the service holding the funds, evidenced with the trace. In parallel we get the case on the record with police or a national fraud body, because most services will not release funds without one.

05 RECOVER

Dispute and recover

The dispute is filed through whichever route the payment allows, and pursued through refusals and escalations. Anything recovered is credited to your balance as it clears.

Why the first hours matter most

Nothing about this is a sales tactic — it is how the rails work. Funds are most freezable before they have been layered and cashed out.

0–2 hours Funds often still sitting at the first receiving address. A freeze request has its best chance.
2–24 hours Commonly moved to an exchange. Still identifiable, and cooperation is usually good.
1–3 days Splitting and bridging make the trail harder to follow, though not impossible.
3–7 days Funds may have reached services outside any effective regulatory reach.
7 days or more Still worth tracing. Dormant addresses move eventually, and seizures produce distributions years later.

Where a trace stops

  • A mixer or privacy tool that deliberately breaks the chain. Analysis can sometimes see through it partially, often not conclusively.
  • A service outside any effective regulatory reach, which simply does not reply.
  • Funds that never cash out. We can watch a self-custodied address indefinitely, but there is nobody to serve a request on.
  • Conversion to cash through peer-to-peer or offline networks.

A traced case is worth leaving on watch rather than closing. Addresses that have sat still for years do sometimes move, and when they move into a regulated service the case becomes actionable again.

What we recommend you do

Whether or not you ever file with us, these are the things worth doing, in this order.

1

Stop paying, immediately

No tax, release fee, gas fee or verification deposit unlocks a withdrawal. Paying it is the most common way a loss doubles.

2

Collect your transaction hashes now

From your own wallet or exchange history. Without a hash a crypto payment often cannot even be confirmed, let alone traced.

3

Contact the receiving exchange directly

If funds went to a named exchange, their compliance team can freeze a balance while it is still there. Quote the hash.

4

Report it officially, today

Police and your national fraud body. Most exchanges will not release funds without a report reference, so this unlocks the rest.

5

Screenshot everything before it disappears

Sites are pulled and chat accounts deleted within days. Capture full screens with the address bar and clock visible.

6

Treat every offer of help as suspect

Victim lists circulate. Anyone who contacts you asking for payment up front is running the second scam.

Lost money to a scam?

Filing takes about ten minutes. We will assess what recovery routes are realistically open to you, and tell you plainly if we do not think recovery is achievable.