A quieter kind of forensic firm.
Aegis Financial Forensics was founded on a simple premise: the digital-asset industry needs investigators who take evidence — and their own limits — seriously. We are an independent, US-based practice producing blockchain forensic work built to be filed, disclosed, and cross-examined.
Investigators, not marketers.
Aegis exists because too many "recovery firms" operate on false promises, contingency fees, and DM outreach to victims. Those incentives are incompatible with objective forensic work.
We're structured differently. Fixed-fee assessments. Written scopes. Reports designed for use by counsel — not for use in our own marketing. Where the evidence supports action, we say so. Where it doesn't, we say that instead.
The firm serves law firms, virtual asset service providers, cyber insurers, and — carefully — individual victims of significant digital-asset losses. Our methodology and engagement process are published in full so prospective clients can audit how we work before they retain us.
What we hold ourselves to.
We aren't paid on recovery, and we don't accept referral fees from exchanges we investigate.
If on-chain evidence can't move your matter forward, we say so — at the assessment stage, in writing.
Every report is second-analyst reviewed and reproducible from cited transaction data.
Engagements are covered by written confidentiality. Client identity is never used in marketing.
A small firm, deliberately.
Six disciplines under one roof.
Digital-asset matters fail when analysis, evidence handling, and legal framing are split across vendors. Aegis keeps all six competencies in-house so a single senior analyst can carry a case from intake to testimony.
Transaction graph construction, clustering, peel-chain and bridge tracing across 12+ networks.
Report drafting to evidentiary standards, expert declarations, and deposition preparation with counsel.
Fiat off-ramp reconstruction, source-and-application-of-funds analysis, and loss quantification.
Sanctions and exposure screening, VASP risk review, and regulator-ready documentation.
Wallet-compromise triage, drainer contract analysis, and device/approval hygiene review.
Chain-of-custody logging, litigation-hold alignment, and structured evidence bundles.
Every case is led by a senior analyst.
Aegis does not staff junior analysts on new intakes. A senior investigator owns each engagement from scoping through delivery, supported by a second analyst whose only job is to challenge the primary findings before release.
- Backgrounds in law-enforcement, Big Four forensics, and blockchain analytics
- Trained on evidentiary rules for US federal and state courts, plus UK, EU, and offshore venues
- Continuing education tracked and disclosed in analyst declarations
- No outsourcing — all work performed in-house
The standards our work product is measured against.
These are not aspirations — they are the acceptance criteria a report must meet before it leaves the firm.
Hash-verified artifact capture, timestamped acquisition logs, and documented chain of custody from first capture to delivery.
Every attribution is tiered — confirmed, probable, or possible — with the reasoning and limitations stated in the report body.
A second senior analyst re-derives conclusions from source data before release; disagreements are resolved or disclosed.
Findings cite transaction hashes and addresses so any competent third party can verify them independently.
Counterparties, opposing parties, and affiliated VASPs are screened before we accept an engagement.
Case data is retained to your litigation-hold instructions, then securely destroyed with written confirmation.
Built one standard at a time.
- 01 · Foundation
The firm is formed by investigators from law-enforcement, Big Four forensic practice, and blockchain analytics — explicitly structured to reject contingency-fee work.
- 02 · Method codified
Our confidence-tiered attribution standard and mandatory second-analyst review are written into every engagement letter.
- 03 · Litigation practice
Reports begin supporting civil asset-tracing claims, freeze applications, and insurance loss adjudication in US and cross-border venues.
- 04 · US headquarters
Operations centralized in Atlanta, Georgia at 1170 Peachtree St NE, 12th Floor, Atlanta, GA 30309, with worldwide remote engagement capability.
- 05 · Today
A deliberately small senior practice serving law firms, VASPs, insurers, and individual victims of significant digital-asset losses.
Your matter stays your matter.
Case material is treated as privileged by default. Where you retain counsel, we prefer to be engaged through your attorney so applicable work-product and privilege protections attach to our analysis from the outset.
What Aegis will never do.
Publishing our limits is the fastest way for a prospective client to tell a forensic firm apart from a recovery scam. Read the full legal disclaimer.
Priced by scope, never by outcome.
Every engagement begins with a fixed-fee assessment and a written scope. You approve the scope and fee before any further billable work starts, and we invoice against defined deliverables — not against whether funds are ultimately returned.
Structured for defensible work.
Aegis operates as a private forensic partnership — not a broker, not a recovery agency, and not a marketing front for a trading platform. Our incentives point in one direction: producing work product that survives cross-examination.
US-based, cross-border by necessity.
Stolen digital assets rarely stay in one jurisdiction. We are headquartered in Atlanta, Georgia and work with counsel in the venues where funds actually land — aligning our evidence to the disclosure and admissibility rules that apply there.
- US federal and state civil matters, including asset-tracing and fraud claims
- UK, EU, and offshore proceedings via instructing solicitors and local counsel
- Exchange and VASP compliance correspondence in major jurisdictions
- Law-enforcement referral packages formatted for agency intake
Bring us your matter.
We're a small firm by choice. If your case is one we can meaningfully advance, we'll tell you — and get to work.