Paste a wallet address. We read every Ethereum-family chain plus Bitcoin, TRON, Solana and XRP — including the TRON side of an 0x wallet, since one key controls both and USDT on TRON is where stolen funds usually go — and tell you what left, when, and which service it reached.
We do not recover funds and we will never offer to. Tracing produces the evidence that lets an exchange, a stablecoin issuer or a police force act — that is a real and useful thing, and it is not the same as getting your money back.
Your client needs an evidence document, not a theory. We produce the trace and the report; you keep the client relationship and the advice. We never contact your client directly, never take a percentage of anything recovered, and never name an individual — identification requires legal process directed at the exchange, which is your work, not ours.
We are not a law practice and do not give legal advice. Engagements are for document preparation and on-chain analysis. Volume and white-label arrangements are available. The terms of service state what a report is, how findings are tiered and where the analysis stops.
No — and nobody else can promise that either. Roughly 5% of stolen cryptocurrency is ever recovered, always through exchanges, stablecoin issuers, police and courts. What we produce is the evidence file that lets those parties act: where the funds went, which custodial service they reached, and the documents to send. Speed matters far more than sophistication — freezes happen in the first days or not at all.
Because everything we analyse is already public on the blockchain. No account, no email, no identity documents, and never — under any circumstances — a seed phrase or private key. Anyone who asks you for those is stealing from you.
Connecting only reads your address — the same thing you could paste by hand. It cannot sign, approve or move anything. The two optional actions that do create transactions (paying for a pass, revoking a malicious approval) are built in your own wallet, shown to you by your wallet, and only happen when you confirm them there.
There are two things to buy, and one of them includes the other. The access pass ($9.99) is thirty days of unlimited self-serve use: full multi-chain reports with every transaction and classified destinations, per-transaction forward tracing, a PDF formatted for submission to police, exchange compliance desks and solicitors, a spreadsheet evidence export, approval and delegation checks with one-click revoke, movement monitoring with alerts, and multi-wallet case building. The reviewed report ($249) is a one-off: a person reads and extends the automated trace for one case, and it comes with its own thirty-day pass. Monitoring is not sold separately — it is part of the pass. The scan, the pre-send safety check and the recovery-offer checker stay free.
It re-checks each watched address on a schedule and sends an alert to the Telegram chat, email address or webhook you choose — not to this browser, so a closed laptop still gets it. Two honest limits. First, alerts need a delivery target: add one on the monitoring panel, or nothing can reach you. Second, the people who move stolen funds rotate deposit addresses often, so an address that has already forwarded everything may simply never move again; watch the addresses that still hold value, and the report tells you which those are. Watching a whole cluster of related addresses is not something the automated pass does today.
Good — the best realistic outcome. An exchange account has an identity behind it and a compliance desk that can freeze and preserve records on a valid request. The report tells you exactly which service, at what confidence, and gives you the letter to send.
As far as the public ledger goes, and no further. A reviewer follows the funds hop by hop and across bridges until they land at a custodial service — an exchange, a payment processor — or are mixed into a commingled pool such as a mixer or a shared exchange hot wallet. Inside that service the records are private: which account received the deposit, who holds it, and where it went next can only be obtained from the service itself by legal process — a police request, a production order or a subpoena. We are not able to issue those and do not attempt to, and no private firm lawfully can. What the reviewed report gives you is the exact service, deposit address, amounts and timing, written so that police, the exchange's compliance desk or your solicitor can act on it directly.
Almost certainly not — unsolicited recovery offers are overwhelmingly a second fraud aimed at people who have already lost once. Paste their message into our free checker above. Official reporting channels never charge, and legitimate investigators do not cold-contact victims.