The starting point of any digital-asset recovery is an evidentiary-grade reconstruction of where the assets went. Most off-the-shelf blockchain explorers and consumer-grade analytics tools are built for compliance screening, not for litigation. They produce signals; we produce evidence.
What the engagement covers
Each forensic engagement reconstructs the full transactional path from the point of misappropriation to the current state of the assets — on-chain custody, exchange deposits, mixer activity, cross-chain bridges, and fiat off-ramps. The reconstruction is delivered as a written report supported by the underlying transaction graph, cluster heuristics, and attribution sources, all retained under chain-of-custody.
Scope of coverage
- Bitcoin and Bitcoin-derived chains: UTXO clustering, common-input heuristics, peel-chain detection, and CoinJoin participation analysis.
- Ethereum and EVM-compatible chains: account-graph reconstruction, smart-contract interaction analysis, ERC-20 and ERC-721 transfer tracing, and bridge-event correlation.
- NFT contracts: mint, transfer, and royalty-flow reconstruction across primary and secondary markets, including marketplace-level metadata.
- Cross-chain movement: bridge-event reconciliation across major canonical and third-party bridges, including reconstruction across wrapped-asset pairs.
- Off-ramps: attribution to custodial exchanges, payment processors, and OTC desks at the point of fiat conversion, including jurisdictions outside the United States.
Evidentiary posture
The forensic methodology is built specifically for fraud-recovery casework. That means three things in practice. First, every step in the analytical chain is reproducible from raw on-chain data — the analyst’s conclusions can be re-derived by a third party using the same inputs. Second, attribution sources (where they involve third-party datasets) are documented at the level of individual data point, not at the level of aggregate label. Third, the working files, the methodology notes, and the underlying queries are retained under chain-of-custody so they survive challenges to authentication and admissibility.
What the report contains
- Executive summary with the recoverable-versus-unrecoverable split based on present on-chain state.
- Annotated transaction graph showing the path from origin to terminal state.
- Counterparty inventory with attribution confidence and supporting evidence.
- Methodology appendix documenting heuristics, thresholds, and analytical decisions.
- Recommended next-step posture aligned with the federal civil-recovery framework.
Why this matters under federal jurisdiction
Federal civil-recovery actions, where they are available, place a higher burden on the evidentiary integrity of the underlying tracing than civil actions in many state courts. The forensic record has to survive Daubert-type scrutiny on methodology, authentication challenges on the working data, and adversarial expert review. A reconstruction that is excellent for compliance reporting but built without litigation in mind is structurally difficult to retrofit. We start from the litigation requirement and work backward.
The first question we ask in a forensic intake is not “where did the assets go,” but “under what evidentiary standard does the answer need to hold up.”
How a forensic engagement starts
Forensic engagements are scoped through a written intake that identifies the target chains, the temporal window, the suspected counterparties, and the recovery objective. Most matters proceed under a fixed-scope written agreement with a defined deliverable; complex matters may be scoped in stages with a checkpoint between phases.