Four client profiles, one standard of work. Every engagement is scoped in writing before we begin.
Discovery support, expert reports, and testimony in civil disputes.
We work alongside civil litigators on fraud, breach of contract, and asset-tracing matters. Engage us through counsel to preserve applicable privilege, and we'll produce reports designed for direct use in pleadings, depositions, and trial.
Incident support, inbound-risk analysis, and evidence packaging.
For centralized exchanges and virtual asset service providers, we support post-incident forensic reviews, deposit-risk analysis for specific counterparties, and produce evidence packages that your compliance team can act on quickly.
Loss quantification and independent verification for cyber policies.
For cyber and crime carriers, Aegis produces independent verification of digital asset losses, quantifies exposure across chains, and evaluates the credibility of insured statements against on-chain evidence.
Feasibility-first assessments for high-value personal losses.
Individual victims receive the same feasibility-first approach as our institutional clients. Every private engagement begins with a fixed-fee assessment that answers one question honestly: is there a viable on-chain path worth pursuing?
Beyond our core client profiles, we regularly support the following mandates. Each engagement is scoped to a specific deliverable and a specific downstream use.
Representative matters — details altered to protect client confidentiality.
These summaries are illustrative of the type of work we perform. Facts, amounts, and identifying details have been changed. Outcomes always depend on where funds landed and the cooperation of third parties — we do not claim or imply that any matter resulted in full fund recovery.
A family office lost mid-seven-figures to a fraudulent OTC counterparty posing as a licensed liquidity desk.
Traced deposits across three exchanges and a bridge hop; identified the counterparty's primary cash-out exchange and built a confidence-tiered attribution.
Counterparty exchange identified; freeze request supported by counsel. Partial recovery pursued through the exchange's compliance process — outcome pending exchange and jurisdictional cooperation.
An individual victim of a romance/pig-butchering scheme moved funds through a fake trading platform.
Reconstructed the full withdrawal path from the platform's custodial wallets to two centralized exchanges, with confidence tiering disclosed at each hop.
Evidence package filed with the FBI's IC3 and referred to litigation counsel; law-enforcement action remains subject to agency prioritization.
A mid-sized exchange requested post-incident review after an apparent hot-wallet compromise.
Independent forensic review of the incident timeline, on-chain movement of stolen funds, and identification of mixer entry points.
Regulator-ready evidence bundle delivered; exchange used findings to support its own disclosure obligations and insurer notification.
A cyber insurer needed independent verification of a policyholder's claimed six-figure crypto loss.
Reviewed the insured's own transaction records against on-chain data, quantified verifiable loss, and flagged inconsistencies in the claim narrative.
Verified loss figure delivered materially below the claimed amount, supporting an adjusted settlement.
A fixed-fee, feasibility-first review of the wallets, transactions, and timeline provided. States plainly whether a viable on-chain path exists before any larger commitment is made.
Complete transaction reconstruction, counterparty attribution with confidence tiers, and a written report formatted for use by counsel, insurers, exchanges, or law enforcement.
Expert reports, affidavits, declarations, and testimony instructed through counsel for civil or regulatory proceedings.
Continuous wallet and counterparty monitoring for treasury risk, active litigation, or law-enforcement-pending matters where funds may still move.
Independence is the foundation of admissible forensic work. Before accepting any engagement we run our own onboarding controls — not just yours.
We verify the identity of instructing parties and screen against sanctions and PEP lists before opening a case file.
Named parties, counterparties, and affiliated VASPs are checked against our active and historical case list; we decline where independence would be compromised.
Written scope, deliverables, fee basis, confidentiality terms, and data-retention terms, signed before billable work begins.
A fixed retainer or scoped fee is agreed up front. We do not begin analytical work without a signed engagement.
US federal & state channels. We prepare evidence packages formatted for the FBI's IC3, the U.S. Secret Service, state attorneys general, and civil freeze applications in state and federal court. Case acceptance and prioritization remain at each agency's discretion.
Foreign exchange cooperation. Where traced funds land on an offshore exchange, cooperation depends on that platform's own compliance posture and, where compulsion is required, Mutual Legal Assistance Treaty (MLAT) requests routed through counsel and prosecutors. MLAT processes are slow and outcome is not guaranteed — we say this plainly rather than overpromise.
New York-based, nationally engaged. Aegis is headquartered in New York City, and engages on matters across the United States and, through counsel-directed channels, internationally.
Terms are the same for a global law firm and an individual victim: written scope, fixed assessment fee, and no interest in the outcome of any recovery.
Scope, deliverables, fee basis, confidentiality, and retention terms — signed before billable work.
Where counsel is instructed, we contract through the law firm so work-product protections attach.
Parties and affiliated VASPs are screened; we decline where independence would be compromised.
Mutual NDA available at intake. Client identity is never used in our marketing.
We never take a percentage of assets, and never charge fees to “release” funds.
Professional indemnity and cyber cover maintained; certificates available on request.
Aegis does not offer legal advice and is not a substitute for counsel. Where an individual or company approaches us directly and litigation, freeze applications, or law-enforcement referral would help, we say so and can refer to independent counsel. Conversely, where a law firm identifies a client need for on-chain tracing, we accept instructions directly from the firm so that our analysis can be incorporated into the broader legal strategy under applicable privilege protections. We do not pay or receive referral fees for legal work, and we do not take a percentage of any recovered funds.
Share the essentials — wallet, transaction, timeline. We respond within one business day with a candid view of what on-chain evidence can and cannot do for your situation.