Blog and insights
Research and guidance on blockchain investigation, cryptocurrency fraud, and asset tracing, written for clients and counsel, not search engines.
The First 24 Hours After Discovering a Crypto Theft
A practical checklist for the hours right after you notice something is wrong, before evidence starts to disappear.
Inside a Blockchain Trace: How Investigators Follow Stolen Funds
A closer look at the actual mechanics behind following stolen funds from the original theft to where they settle.
Three Scam Structures Behind Most Crypto Investment Losses
Nearly every investment scam we review fits one of three underlying structures, despite constant rebranding on the surface.
The Upfront Fee Recovery Scam, and How It Actually Works
A second scam often follows the first. Here is exactly how it is run, and how to recognize it before sending anything more.
What Changes When a Crypto Trail Crosses Borders
The tracing itself is often familiar. What changes is the legal coordination required once a trail reaches a foreign jurisdiction.
Crypto Fraud in 2026: What We're Actually Seeing Change
A grounded look at how fraud and investigation are shifting this year, based on patterns from our own caseload rather than industry hype.
Tracing a Ransomware Payment After It's Already Been Sent
The payment itself is rarely recoverable. What can still be learned from the on chain record afterward, and why it matters.
The Five-Minute Habit That Closes Off a Common DeFi Attack Path
Forgotten token approvals are one of the most common ways decentralized finance wallets end up drained. Here is what to do about it.
Spotting a Fraudulent DeFi Contract Before You Deposit
A handful of patterns reappear in the contracts behind decentralized finance losses. A practical checklist for before you deposit.
How Bridges Move Assets Between Blockchains, and Why It Matters for Tracing
A plain explanation of what a bridge actually does, and why bridge transactions require reading two separate ledgers to understand fully.
Evidence to Preserve in the First Hours After a Business Wallet Is Compromised
A company treasury incident raises questions an individual theft usually does not. A short checklist for the first hours.
Why More Exchanges Are Responding to Legal Requests Than They Used To
A quiet but meaningful shift in how regulated exchanges handle legal requests, and why the request itself still matters as much as the trace.
AI-Driven Crypto Scams: How Deepfakes and Bot Networks Are Redefining DeFi Theft
Crypto fraud increasingly succeeds by manufacturing the appearance of consensus, using synthetic video and coordinated bot activity to make a scam look popular before anyone checks the fundamentals.
Binance Withdrawal Issues in 2026: What to Do When Your Account Is Unexpectedly Frozen
Exchange freezes are usually a compliance process, not a confiscation. Here is what actually triggers one, and the steps that shorten it instead of dragging it out.
Coinbase Account 'Under Review'? Steps to Recover Locked Crypto Safely
An account marked 'Under Review' is a compliance process with a real end point, not a permanent lock, provided you avoid the fake recovery offers it tends to attract.
The Contaminated Transfer History Attack: How Lookalike Addresses Drain Wallets
This attack doesn't compromise a wallet or trick a user into clicking anything, it quietly plants a familiar-looking address in your transaction history and waits for you to reuse it.
Crypto Customer Support Scams: Why That 'Binance Agent' on Social Media Is After Your Seed Phrase
The fastest-growing threat in crypto right now isn't a smart contract exploit, it's a fake support agent who found your public complaint before a real one did.
Digital Parasites: The State-Sponsored Malware Targeting Hardware Wallets
Hardware wallets remain cryptographically sound, but a class of advanced, persistent malware has found a way around that entirely, by compromising what the user sees, not what the device signs.
Fake Crypto Press Releases: How Media Narratives Mask Fraudulent Projects
A polished write-up on a crypto news site is not proof of anything by itself, increasingly, it's a paid placement bought specifically to manufacture the appearance of legitimacy before a project collapses.
How We Brute-Force Old Blockchain.info Wallets to Recover Lost Passwords
Forgotten wallet passwords are recoverable more often than people assume, not through a shortcut, but through GPU-accelerated, well-targeted brute force built around what a person is likely to have typed.
How We Recover Stolen NFTs From Compromised Wallets
Assets left behind in a drained wallet aren't always unreachable, if they're locked, staked, or simply missed, a carefully built private transaction can sometimes move them out before an attacker's sweeper bot notices.
How to Tell If a Cryptocurrency or DeFi Platform Is a Scam
Across thousands of scam reports we've reviewed, the projects that turn out to be fraudulent tend to fail the same handful of checks, and most of them take less than ten minutes to run.
How to Read Etherscan Like a Pro: Tracking Stolen Funds After a Phishing Attack
Most victims assume a phishing loss is unrecoverable the moment funds disappear. The public transaction record says otherwise, you just have to know what to look for.
How to Recover Funds Lost in ETH Transfer Scams: A Step-by-Step Guide
Once ETH leaves a wallet, there is no bank to call and reverse it. Here is what to do in the hours after, and how to avoid becoming a target twice.
Identity Theft 2.0: How AI Bots Are Exploiting KYC Flaws on Major Exchanges
Attackers are no longer just hacking wallets. They are weaponizing AI to impersonate real people and walk straight through the identity checks exchanges rely on.
Inside the Zondacrypto Scandal: How 4,500 BTC Vanished from a Supposedly Compliant Exchange
A withdrawal glitch at Poland’s largest exchange unraveled into missing founders, a locked cold wallet worth hundreds of millions, and a political scandal.
Malicious "IncreaseAllowance" Signatures: How Fake DApp Prompts Empty Web3 Wallets
Attackers no longer need a seed phrase to drain a wallet. A single misunderstood approval signature can hand them the same result.
The Man Who Spent 17 Years Trying to Recover Lost Crypto
A landfill in Wales may hold over a billion dollars in Bitcoin, and the man who put it there still cannot get permission to look for it.
Revoking Smart Contract Permissions: The Critical First Step After a Suspected Wallet Compromise
Disconnecting a wallet from a suspicious site feels like it solves the problem. It does not. The approval itself usually survives, quietly, until someone revokes it.
Should You Choose a Single-Share Shamir or BIP-39 Seed Backup for Your Trezor?
Trezor now defaults new Safe devices to a 20-word Shamir backup instead of the familiar 12 or 24-word BIP-39 seed. Here is whether that default is actually the better choice.
Trust Wallet vs Coinbase Wallet: Which Is More Vulnerable to Phishing?
Two of the most widely used non-custodial wallets face phishing threats shaped by very different designs, and neither one can fully protect a user who signs blindly.
Xaman (Xumm) Wallet Security: Preventing Malicious Trustlines from Draining Your XRP
XRP holders often assume their ledger is immune to the approval-style exploits common on Ethereum. Scammers have simply adapted the same playbook to trustlines instead.
Bitcoin Self-Custody in 2026: How to Safely Control Your Crypto
Storing your own Bitcoin used to demand real technical skill. It is easier now, which raises a different question: how do you avoid trading theft risk for loss risk?
How Hardware Wallet Users Lose Their Bitcoin
After thousands of recovery cases, the same handful of mistakes keep showing up, and they rarely involve the dramatic hack most people picture.
Kraken Verification Holds: What Triggers Them and How to Respond
Most withdrawal holds are not a sign that anything is wrong with the account. They are the visible edge of a compliance process, and understanding what triggers it changes how to respond.
Why Exchanges Freeze Accounts for 'Unusual Activity', and What Happens Next
The systems behind an "unusual activity" freeze are mechanical, not personal, and the review process rewards clean documentation far more than it rewards urgency.
Fake Firmware Update Prompts: A Growing Hardware Wallet Scam Vector
A fake firmware update prompt is one of the few phishing approaches that specifically targets people who already own a hardware wallet and think they are past the point of easy compromise.
Software Wallet Vulnerabilities: What Actually Puts Hot Wallets at Risk
Not every software wallet compromise happens the same way, and treating "hot wallets are risky" as one undifferentiated warning makes it harder to see which specific habit actually needs to change.
How Investigators Cluster Wallet Addresses to Identify a Single Owner
No single blockchain address tells an investigator who controls it. Clustering is the discipline of combining several imperfect signals until a pattern of common ownership becomes hard to explain any other way.
What Goes Into a Blockchain Chain of Custody Report
A trace that lives only in an investigator’s head, or in a folder of unlabeled screenshots, is far less useful than the same trace written up properly, regardless of how accurate the underlying analysis actually was.
How Legitimate Crypto Investigators Actually Charge for Their Work
How a firm proposes to charge for its work says almost as much about its legitimacy as the work itself, and it is one of the easiest things to check before any money changes hands.
What a Police Report Needs to Include for a Crypto Theft Case
A crime reference number alone rarely moves a case forward. Here is the specific detail that turns a crypto theft report from a formality into something an officer, or a later civil claim, can actually use.
What Insurers Require to Process a Crypto Theft Claim
Crypto theft coverage exists, but it is nothing like a standard homeowner or auto policy. What insurers actually ask for before a claim is paid, and where investigative documentation fits in.
The 'Pay Gas to Claim' Airdrop Scam, and Why It Works
The trick is not the fake reward itself, it is the small, real-seeming gas payment that makes walking away feel like the loss. A walk through of how the mechanism works and where it breaks a specific case.
How Crypto ATMs Are Used to Cash Out Scam Proceeds
A crypto ATM turns physical cash into an irreversible on-chain transfer in minutes, with none of the friction a bank imposes. Why that makes kiosks a preferred cash-out channel, and what a coached victim looks like at the machine.
How to Verify a Blockchain Investigation Firm Before You Engage One
Beyond spotting the obvious upfront-fee scam, a short, practical checklist for verifying that a firm claiming to trace or recover crypto is actually who and what it says it is.
How Tether and Circle Freeze Addresses, and What It Means for a Recovery Case
Stablecoin issuers can blacklist a specific address at the smart contract level itself, a capability no exchange has over its users. What that mechanism actually does, and when it becomes relevant to a stolen-funds case.
How NFT Wash Trading Complicates Valuing a Stolen Collection
When most of the recorded trading volume behind an NFT's price is the same wallet selling to itself, "the last sale price" stops being a reliable number to build a legal or insurance claim on.
How Shifting Crypto Regulation Is Changing Cross Border Recovery Cases
Two years ago, a well documented request sent to a foreign exchange could sit unanswered for months regardless of quality. Licensing regimes are starting to change that, unevenly.
Deepfake Video Calls Are the New Front in Business Wallet Compromise
A live video call with a familiar face and voice is no longer sufficient authorization on its own. What real time deepfake fraud looks like, and the verification habits that stop it.
Cold Storage Mistakes That Have Nothing to Do With Hacking
A meaningful share of the permanently inaccessible cold storage funds we review were never touched by an attacker. The seed phrase itself simply did not survive.
What Happens to a Crypto Wallet When Its Owner Dies Without a Plan
A bank account has a known institution to contact after a death. A crypto wallet usually does not, which is what turns an ordinary estate matter into a permanent loss.
When a Multisig Co-Signer Goes Rogue or Disappears
A multisig wallet is designed to prevent any single person from moving funds alone. That same design can lock an entire treasury when one required signer stops cooperating.
How Civil Freezing Orders Are Used to Recover Stolen Crypto
A blockchain trace can identify where stolen funds sit, but only a legal mechanism can actually restrain them. A general look at how civil freezing orders fit alongside tracing.
How Institutional Custody Actually Differs From a Personal Hardware Wallet
A personal hardware wallet and an institutional custody platform both keep a private key away from an internet-connected computer. Structurally, that is almost where the similarity ends.