Blockchain forensics. Follow every hop.
Every transfer on a public blockchain is recorded, but the record is a maze of addresses, swaps and bridges built to be hard to follow. We trace stolen or disputed crypto through it, to the exchanges and services where funds can be frozen, and write it up so exchanges, counsel and courts can act.
The ledger is public. Reading it is the work.
Blockchain forensics turns public transaction data into evidence: which addresses received the funds, which of them are controlled together, and where the money left the chain. The chain shows addresses, not names. Naming a person takes records that only an exchange or service holds, which counsel or law enforcement can request once the trace shows where to ask.
First hours after a theft or exploit
- Write down every transaction hash, address, amount and time (with the time zone) you have.
- Never share a seed phrase or private key with anyone, including people offering to recover funds.
- Keep the messages, sites and contracts involved exactly as they are.
- Call us or start a case. Exchanges can only freeze funds that are still there.
Tracing across chains and bridges
Funds rarely sit still. They are split across fresh addresses, swapped for other tokens, pushed through mixers and bridged to other chains. We follow each hop, match bridge and swap transactions on both sides, and record why each step in the trace holds.
Linking addresses to exchanges and services
Addresses that are funded, spent or reused together often belong to the same operator. We cluster them, and identify the deposit addresses of exchanges, payment services and other platforms where the trail reaches a business that keeps customer records.
Smart-contract and DeFi exploit analysis
When a protocol is drained, the question is how. We reconstruct the attack from the transactions themselves: which contract functions were called, in what order, with which flash loans or price manipulations, and where the proceeds went next.
Tracing reports for exchanges and courts
A trace is only useful if someone can act on it. Reports set out each path with its transaction hashes, separate what the ledger proves from what is inferred, and are written for exchange compliance teams, law enforcement, counsel and courts.
What's proved, and what's inferred.
| Finding | What it means | Typical basis |
|---|---|---|
| Direct transfer path | Funds moved from one address to the next in recorded transactions | The transactions themselves, cited by hash |
| Bridge or swap match | Funds that left one chain or token arrived as another | Bridge and swap records, amounts and timing on both sides |
| Address cluster | Several addresses are likely controlled by the same operator | Shared funding, spending and reuse patterns; stated as an inference with its confidence |
| Exchange or service deposit | The trail reached a business that can freeze funds or hold records | Known deposit addresses and the service's own on-chain behaviour |
| Trail ends | The funds can't be followed further with confidence | Privacy coins, some mixers, or transfers inside a platform's own books |
What we need, and what we don't.
What to send us
The transaction hashes and addresses involved, the chains and tokens, the amounts and approximate times, and a short account of what happened. For a protocol exploit, the contract addresses and the block range of the attack.
What we never ask for
Seed phrases, private keys, passwords or access to your wallet. Tracing works from the public ledger alone, so no one tracing your funds needs them.
The limits, stated up front
Some trails end: privacy coins, some mixers and transfers inside an exchange's own books can break the chain of evidence. Speed matters too, because funds that sit at an exchange today may be gone tomorrow. We tell you early how far a trace is likely to go.
Wallet access and password recovery, and investigations into who is behind an online scam, are TechFusion's services: see techfusion.com.
Crypto forensics, asked plainly.
What is blockchain forensics?
Turning public blockchain records into evidence: following funds from address to address, across token swaps and bridges between chains, grouping addresses that are likely controlled together, and finding where the funds reached an exchange or other service. It is also called crypto forensics or cryptocurrency tracing. The result is a report that shows each step and how strongly it is supported.
Will a trace tell us who took the funds?
Not on its own. The ledger records addresses, not names. A trace shows where the funds went and which exchange or service they reached; that business may hold the customer records that identify a person, and counsel or law enforcement can request them.
Can stolen crypto be recovered?
Sometimes, and never by us directly. We don't access wallets or move funds. When funds come back, it is usually because an exchange or service froze them while they were still there, after a request from law enforcement or a court order obtained by counsel. A trace shows where to send that request, which is why speed matters.
Someone offers to get my crypto back for a fee. Should I pay?
Be very careful. People who have lost crypto are often contacted by "recovery" services that take an upfront fee or ask for a seed phrase and deliver nothing; the FBI and the Federal Trade Commission have both warned about these scams. No legitimate tracing work needs your seed phrase, private keys or wallet access.
Should we report the theft to the police?
Yes. In the US, report it to local police and to the FBI's Internet Crime Complaint Center at ic3.gov, with the transaction hashes and addresses. Our tracing reports are written so that law enforcement, exchange compliance teams and counsel can act on them, and they can accompany your report.
Can every transaction be traced?
No. Privacy coins, some mixers, and transfers inside an exchange's own books can end a trail, and some links are inferences rather than recorded transfers. Every report says which steps the ledger proves and which are inferred, with its confidence: see what a tracing report states.
Send us the transaction hashes.
We'll tell you how far they go.
A confidential first consultation, a clear scope and quote, and no work until you say go.