UTXO-level tracing
Follows output-by-output movement, not just address hops
Written evidence report
Hashes, timestamps and method notes you can attach
No wallet access
Public addresses only — never keys or seed phrases
How Bitcoin is lost
Bitcoin is the most common target because it is the most widely held. Each pattern below leaves a different trace on the public ledger, and each is examined differently.
“Pig-butchering” approaches and fake brokerage platforms that persuade you to send BTC to a deposit address for a trading account, pool or “liquidity” that does not exist.
What we look at: Deposit addresses, the platform domain, and where your BTC moved next
Seed-phrase extractors, fake wallet sites and malware that empty a wallet in a single sweep — often consolidating several victims into one address.
What we look at: The sweep transaction, the receiving address, and any onward consolidation
Unregulated platforms that accept deposits, show a growing balance, then block withdrawals or impose invented “tax” and “release” payments.
What we look at: Each top-up transaction and whether the platform reused known addresses
Bitcoin demanded for data decryption, account restoration or to prevent the release of material — usually with a short deadline and no second contact.
What we look at: The payment transaction, the ransom address history and its outflow
The process
Bitcoin cases are worked in the same order every time, so you know what stage your case is at and what comes next.
We read the file confidentially and say whether your transactions give an investigation anything to work with. If they do not, we say so before any paid work.
Working from your first outgoing transaction, we follow the UTXO trail — splits, consolidation, peeling chains — and record where the funds touched a service we can name.
Findings become a written report: chronology, transaction tables with hashes and timestamps, and method notes so a third party can follow and check the work.
You get clear direction on where the report can be submitted — exchange compliance teams, police in your jurisdiction — and what each usually requires.
Bitcoin uses a UTXO model: every payment spends specific outputs and creates new ones, so the history of a coin is recorded as a chain of discrete movements rather than a single running balance. That structure often makes consolidation and onward hops visible for longer than on account-based chains. It does not make the funds recoverable, and it does not reveal who holds them.
Any service that promises more than the left-hand column — a guaranteed return of funds, the identity of a wallet holder, or the ability to seize assets — is describing something an investigation cannot deliver.
Bitcoin questions
Short answers to the questions that decide whether an investigation is worth starting.
Bitcoin investigations are investigative and documentary work. They do not constitute legal advice, an offer of recovery, or a promise that any third party will act. Read the service limitations before submitting.