Before we begin with the actual crypto forensics, we will take time for a detailed consultation. During this phase, you will not receive a pre-packaged contract, but rather a forensic and recovery proposal tailored to your specific case, which we will review with you point by point. You will fully understand, which wallets are analyzed, which blockchain networks we use to track the activity, when lock requests are sent to Tether or Circle and how the time-critical securing of funds is intertwined with the parallel preparation of criminal charges.
This voting phase is the transition from the evaluation of your case (via the free initial assessment and the Cost/benefit analysis) to the actual forensic work. Only after your informed consent will the concrete blockchain analysis and – if applicable – the legal processing begin.
In cases of crypto fraud, the Speed and accuracy of initial actions The chances of recovery are often crucial. Stolen funds are rarely kept quiet in practice – they move between multiple wallets, are exchanged for other coins, transferred via cross-chain bridges, or routed through mixing services. Anyone acting without a clear plan at this stage loses time – and often loses track of the scam.
The voting phase ensures four things:
Binding basis for subsequent processing – documented in writing, with clear delivery dates for each forensic module
The voting process is a structured conversation – available by phone, video call, or in person, as desired. Four key topics are covered.
We will go through step by step which forensic and recovery tools are used and in what order. This typically includes:
You will receive the following with each building block:
Decision points (e.g.: If the cash-out is identified on an EU-regulated exchange, you decide on the next instruction to the lawyer – blocking request, asset freeze or both)
Even though the main work lies with us, there are points where we depend on your cooperation. With crypto mandates, this applies particularly to:
In the case of crypto mandates, the confidential communication Especially important – wallet addresses, seed phrase hints, or forensic reports do not belong in unencrypted emails. We stipulate the following:
Wallet addresses, transaction hashes, and forensic reports are transmitted via secure data rooms. We do not communicate sensitive case details via unencrypted channels – this is not a marketing slogan, but a fundamental requirement for crypto mandates.
At the end of the vote, a written agreement is drawn up in which all the points discussed are bindingly recorded:
The actual blockchain analysis will only begin after you have signed this agreement. Until then, you will incur no costs beyond the free initial assessment.
You will receive our written offer in advance via email – including all forensic components, prices, timeframes, and an overview of the blockchain networks likely to be affected. This allows you ample time to prepare, note down your own questions, and consult with trusted advisors or consultants if necessary.
During the actual consultation – either by phone or video call – we will go through the offer point by point. We will clearly explain why each forensic component is appropriate for your case, answer all your questions, and adjust the offer to your specific requirements if necessary. Please allow 30 to 60 minutes for this.
If any adjustments are necessary after the meeting, you will receive a revised version. Please take your time to sign it and return it to us. Upon receipt of the contract, the forensic work begins – in most cases within 24 to 48 hours, and faster for time-critical blocking requests.
At the end of the voting phase, you will have:
Unlike traditional financial crimes, the situation is changing with crypto fraud. every minute to every hour. Funds can be moved to new addresses in fractions of a second via automated scripts, tokens can be exchanged for other coins on decentralized exchanges (DEXs) without KYC, and cross-chain bridges allow switching between networks in minutes.
That's precisely why our coordination phase is designed to be swift – we don't waste time on unnecessary bureaucracy. At the same time, we take the necessary time to ensure you truly understand what will happen during the engagement. Poor coordination at the beginning creates significantly more friction than careful coordination.
In time-critical situations – e.g., if the stolen USDT is still on a single TRC-20 address and a Tether blocking request needs to be sent out within the next few hours – we will expedite the coordination accordingly and start initial evidence preservation measures in parallel, if you wish.
After the vote, the actual work begins without delay. Typical components include:
You will receive the agreed updates at each stage and will be actively involved at important decision points – such as after identification of a cash-out point or after confirmation of a Tether block.
You can reach us via our Contact form or by phone during our business hours, Monday to Saturday, 9:00 am to 8:00 pm.
Important: Crypto fraud cases have a time factor. The sooner the concrete forensic work begins, the better the chances that the funds are still recoverable – be it as untransferred USDT holdings, unpaid exchange balances, or unmixed coins. The reconciliation phase is therefore designed to be swift, usually completed within a few days.
You are currently viewing a placeholder content from Vimeo. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from YouTube. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou need to load content from reCAPTCHA to submit the form. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from Google Maps. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou need to load content from hCaptcha to submit the form. Please note that doing so will share data with third-party providers.
More InformationYou need to load content from reCAPTCHA to submit the form. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from Gymnastics styles. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More Information
