Theft & hack investigations

Wallet compromise &
exchange incidents.

Unauthorised crypto transfers can happen in seconds. We preserve the technical record, trace funds while they move, and identify points where exchanges, legal teams, or law enforcement may intervene.

Get urgent support Back to case types

Immediate priorities

Secure access.
Preserve the trail.

Use a known-clean device to secure email, mobile, exchange, and wallet-related accounts. Contact the relevant providers through independently verified channels. Do not share seed phrases or private keys with anyone offering recovery.

Retain transaction hashes, destination addresses, device and login alerts, emails, messages, support tickets, screenshots, and a precise timeline. Avoid altering a potentially compromised device unnecessarily.

Dissecting the incident

The attacker’s playbook

01Access is obtainedPhishing, malicious approvals, exposed credentials, SIM takeover, remote access, insider activity, or a platform failure may provide control.

02Assets are removedFunds are transferred rapidly, sometimes after dormant access is tested or security settings are changed.

03The trail is layeredAssets may be split across addresses, swapped, bridged, or combined with other flows to complicate attribution.

04Value reaches an off-rampThe offender seeks liquidity through an exchange, broker, payment service, or another point where timely notification may matter.

Our response

How we help

Triage

Define the compromise

We establish affected accounts, transactions, devices, approvals, and timings, preserving a clear incident chronology.

Trace

Track assets in motion

We map onward transfers across wallets and chains, identify service exposure, and monitor relevant addresses for movement.

Escalate

Support urgent action

We prepare evidential intelligence and support notifications, freezing requests, legal applications, police reporting, and expert evidence.

Time matters

Start the trace now.

Send the transaction hashes and a short chronology. A specialist investigator will assess the available trail.

Get urgent support

Secure access.Preserve the trail.

The attacker’s playbook

How we help

Start the trace now.

Secure access.
Preserve the trail.