A quieter kind of forensic firm.
Aegis Financial Forensics was founded on a simple premise: the digital-asset industry needs investigators who take evidence — and their own limits — seriously. We are an independent, US-based practice producing blockchain forensic work built to be filed, disclosed, and cross-examined.
Investigators, not marketers.
Aegis exists because too many "recovery firms" operate on false promises, contingency fees, and DM outreach to victims. Those incentives are incompatible with objective forensic work.
We're structured differently. Fixed-fee assessments. Written scopes. Reports designed for use by counsel — not for use in our own marketing. Where the evidence supports action, we say so. Where it doesn't, we say that instead.
The firm serves law firms, virtual asset service providers, cyber insurers, and — carefully — individual victims of significant digital-asset losses. Our methodology and engagement process are published in full so prospective clients can audit how we work before they retain us.
What we hold ourselves to.
We aren't paid on recovery, and we don't accept referral fees from exchanges we investigate.
If on-chain evidence can't move your matter forward, we say so — at the assessment stage, in writing.
Every report is second-analyst reviewed and reproducible from cited transaction data.
Engagements are covered by written confidentiality. Client identity is never used in marketing.
A small firm, deliberately.
Six disciplines under one roof.
Digital-asset matters fail when analysis, evidence handling, and legal framing are split across vendors. Aegis keeps all six competencies in-house so a single senior analyst can carry a case from intake to testimony.
Transaction graph construction, clustering, peel-chain and bridge tracing across 12+ networks.
Report drafting to evidentiary standards, expert declarations, and deposition preparation with counsel.
Fiat off-ramp reconstruction, source-and-application-of-funds analysis, and loss quantification.
Sanctions and exposure screening, VASP risk review, and regulator-ready documentation.
Wallet-compromise triage, drainer contract analysis, and device/approval hygiene review.
Chain-of-custody logging, litigation-hold alignment, and structured evidence bundles.
Every case is led by a senior analyst.
Aegis does not staff junior analysts on new intakes. A senior investigator owns each engagement from scoping through delivery, supported by a second analyst whose only job is to challenge the primary findings before release.
- Backgrounds in law-enforcement, Big Four forensics, and blockchain analytics
- Trained on evidentiary rules for US federal and state courts, plus UK, EU, and offshore venues
- Continuing education tracked and disclosed in analyst declarations
- No outsourcing — all work performed in-house
The standards our work product is measured against.
These are not aspirations — they are the acceptance criteria a report must meet before it leaves the firm.
Hash-verified artifact capture, timestamped acquisition logs, and documented chain of custody from first capture to delivery.
Every attribution is tiered — confirmed, probable, or possible — with the reasoning and limitations stated in the report body.
A second senior analyst re-derives conclusions from source data before release; disagreements are resolved or disclosed.
Findings cite transaction hashes and addresses so any competent third party can verify them independently.
Counterparties, opposing parties, and affiliated VASPs are screened before we accept an engagement.
Case data is retained to your litigation-hold instructions, then securely destroyed with written confirmation.
Built one standard at a time.
- 01 · Foundation
The firm is formed by investigators from law-enforcement, Big Four forensic practice, and blockchain analytics — explicitly structured to reject contingency-fee work.
- 02 · Method codified
Our confidence-tiered attribution standard and mandatory second-analyst review are written into every engagement letter.
- 03 · Litigation practice
Reports begin supporting civil asset-tracing claims, freeze applications, and insurance loss adjudication in US and cross-border venues.
- 04 · US headquarters
Operations centralized in New York City at 48 Wall Street, 11th Floor, New York, NY 10005, with worldwide remote engagement capability.
- 05 · Today
A deliberately small senior practice serving law firms, VASPs, insurers, and individual victims of significant digital-asset losses.
Your matter stays your matter.
Case material is treated as privileged by default. Where you retain counsel, we prefer to be engaged through your attorney so applicable work-product and privilege protections attach to our analysis from the outset.
What Aegis will never do.
Publishing our limits is the fastest way for a prospective client to tell a forensic firm apart from a recovery scam. Read the full legal disclaimer.
Priced by scope, never by outcome.
Every engagement begins with a fixed-fee assessment and a written scope. You approve the scope and fee before any further billable work starts, and we invoice against defined deliverables — not against whether funds are ultimately returned.
Structured for defensible work.
Aegis operates as a private forensic partnership — not a broker, not a recovery agency, and not a marketing front for a trading platform. Our incentives point in one direction: producing work product that survives cross-examination.
US-based, cross-border by necessity.
Stolen digital assets rarely stay in one jurisdiction. We are headquartered in New York City and work with counsel in the venues where funds actually land — aligning our evidence to the disclosure and admissibility rules that apply there.
- US federal and state civil matters, including asset-tracing and fraud claims
- UK, EU, and offshore proceedings via instructing solicitors and local counsel
- Exchange and VASP compliance correspondence in major jurisdictions
- Law-enforcement referral packages formatted for agency intake
Independent by design, not by accident.
Aegis is not owned by, or affiliated with, any exchange, custodian, trading platform, or "recovery" marketplace. We hold no equity stake in any outcome we investigate, and our engagement letters expressly prohibit contingency or success-fee arrangements. That independence is what allows our findings to be relied on by opposing counsel, courts, and insurers — not just the client who retained us.
Our mandate is narrow and stated plainly: produce evidence-grade blockchain analysis that supports recovery efforts pursued through counsel, exchanges, insurers, and law enforcement. We do not pursue, negotiate with, or contact alleged fraudsters, and we do not represent that any engagement will result in recovered funds.
The rules that govern how a case is run.
No billable analytical work begins until a written scope and fee are approved by the client.
The analyst who builds a finding is never the only one who signs off on it.
Technical findings are translated into language usable by non-technical counsel, adjusters, and courts.
Every technique used is documented in our published methodology, not held back as a black box.
We decline matters where the likely cost of investigation exceeds any realistic evidentiary value.
Feasibility is revisited at defined checkpoints; clients are told promptly if the evidence trail weakens.
Generalists don't run our cases.
We describe roles and capability areas rather than individual biographies, in keeping with client confidentiality — but every case is staffed against this structure, not an improvised one.
Own case strategy and client-facing findings; backgrounds in financial-crime investigation and blockchain analytics.
Independently re-derive conclusions from source data before any report is released.
Draft declarations, exhibits, and testimony-ready documentation aligned to the receiving venue's rules.
Screen counterparties, VASPs, and case subjects against sanctions and exposure lists before and during engagement.
Maintain chain-of-custody logs, engagement timelines, and client communications.
Administer encrypted case systems, access controls, and secure evidence storage.
Standards drift if they aren't maintained.
Blockchain tooling, bridge protocols, and mixing techniques evolve constantly. Analysts complete recurring internal training on new chains and obfuscation methods, and their continuing-education record is disclosed in analyst declarations submitted to courts on request.
- Recurring internal case-review sessions on emerging obfuscation techniques
- Ongoing study of evidentiary and disclosure rules across the jurisdictions we support
- Cross-training between analytical, compliance, and reporting roles
- Documented sign-off before any analyst is authorized to lead a new case type
Commercial tooling, verified by hand.
We license established commercial blockchain-analytics platforms and combine them with in-house tooling and manual verification — no finding is reported solely because software labeled it that way.
Licensed commercial clustering and attribution tools across major chains.
Custom scripts for peel-chain, bridge, and mixer-pattern analysis not covered off-the-shelf.
Every material attribution is independently checked against raw on-chain data.
Direct node access for primary-source transaction data, not solely third-party APIs.
Confidentiality is a control system, not a promise.
Case data is handled under a written information-security program covering access, transmission, storage, and disposal — reviewed on a recurring basis and enforced through per-case authorization, not informal trust.
- Encrypted transmission and storage of case files by default
- Role-based, need-to-know access enforced per engagement
- Segregated case workspaces to prevent cross-matter data exposure
- Written incident-response procedures for our own systems
- Documented, confirmable destruction of case data on client instruction
We turn down more work than we accept.
Ethical limits are screened in before an engagement letter is issued — not discovered midway through a case.
We do not accept payment contingent on funds being recovered, under any structure.
We do not access, intrude on, or attempt to disable any third-party system or wallet.
We work only from data lawfully available to the client or obtained through proper legal process.
Matters implicating sanctioned persons, entities, or jurisdictions are screened and, where required, declined or referred.
We do not contact or negotiate with alleged fraudsters on a client's behalf.
We decline matters that conflict with an existing client, counterparty, or prior engagement.
No report leaves without a second signature.
Quality control is a checklist, not a courtesy. Every deliverable passes through defined gates before release, and any unresolved disagreement between analysts is disclosed in the report rather than smoothed over.
- 01Primary analyst compiles findings with cited transaction data
- 02Second analyst independently re-derives conclusions from source evidence
- 03Discrepancies are resolved or explicitly disclosed in the final report
- 04Case manager verifies chain-of-custody and exhibit completeness
- 05Final review against the client's approved scope before delivery
Most people who contact us never become clients — and that's fine.
We publish plain-language guidance on scam patterns, wallet hygiene, and how to report fraud, because the majority of people reaching out need direction toward exchanges, IC3, or local law enforcement rather than a paid investigation. Our resource library is maintained for exactly that audience.
One office, one time zone, worldwide reach.
An investigative firm, not a recovery promise.
Many people first search for a "crypto recovery agent." It's worth understanding how that model typically differs from an independent forensic firm before you choose who to trust with your case.
- ✕Advertises a recovery guarantee or success rate
- ✕Charges upfront “release” or “tax” fees to unlock funds
- ✕Solicits victims directly through social-media DMs
- ✕Provides no written scope, methodology, or report standard
- ✕May request seed phrases, private keys, or device access
- ✓Fixed-fee, written scope — never paid on outcome
- ✓No fees to “release” or “unlock” assets, ever
- ✓Clients come to us; we do not solicit victims
- ✓Published methodology and second-analyst-reviewed reports
- ✓Never asks for seed phrases, private keys, or remote access
Bring us your matter.
We're a small firm by choice. If your case is one we can meaningfully advance, we'll tell you — and get to work.