A rigorous engagement lifecycle built for legal outcomes.
From your first message to your attorney's first filing — each stage has a fixed deliverable and a clear decision point. Every stage is designed to support recovery efforts through counsel, exchanges, insurers, and law enforcement — outcomes still depend on where funds landed and on third-party cooperation.
Why the first 24–72 hours matter.
Stolen funds are typically layered through multiple wallets and services within hours, and pushed toward an off-ramp — an exchange, a mixer, or a bridge — within days. Exchanges are far more likely to act on a freeze request while funds are still sitting in an identifiable account. Every hour that passes narrows the set of realistic downstream actions available to your counsel.
Preserve every screenshot, transaction hash, and message unedited. Note exact times and amounts while memory is fresh.
Do not pay a further 'unlock', 'tax', or 'release' fee, and do not contact or threaten the counterparty.
Start a police/IC3 report and a case with your exchange's compliance team in parallel with contacting Aegis — none of these steps conflict.
A five-stage engagement, in detail.
Intake
Submit wallet addresses, transaction hashes, and a short narrative through the secure case-review form or by email. We confirm within one business day whether the case is one we can meaningfully advance.
Scoped assessment
Fixed-fee preliminary assessment: initial tracing, a feasibility opinion, and a written scope for any further investigation. If the on-chain evidence can't move your matter forward, we tell you here — before you commit to a full engagement.
Investigation
Deep tracing across chains and services, counterparty attribution, and coordination with exchange compliance teams where an actionable endpoint exists. All artifacts are preserved under chain-of-custody.
Reporting
Delivery of the forensic report — executive summary, transaction graph, counterparty attribution with confidence tiers, and a tooling manifest — reviewed by an independent second analyst before release.
Legal handoff
Support your attorney, insurer, or law-enforcement contact with expert declarations, follow-up analysis, coordination on freeze requests, and — where appropriate — expert witness testimony.
A conversation, then a written scope.
No engagement begins over DMs, on encrypted messengers with unknown parties, or on the promise of a percentage cut. Every matter starts with a confidential intake call and a written scope you countersign before any billable work is performed.
- 15-minute discovery call and free feasibility read — no charge
- Written NDA before any evidence is shared
- Conflicts and KYC check on the engaging party before we accept a matter
- Fixed-fee assessment with clear inclusions and a kill-switch if feasibility fails
A checklist that protects the record.
What you preserve in the first days often determines how far a trace can go. We provide a structured checklist at intake and hash every item as it arrives.
- Screenshots of transactions, chats, and profiles, unedited
- Exchange account records and withdrawal confirmations
- All wallet addresses and transaction hashes involved
- Full communications with the counterparty
- Police report and/or IC3 complaint reference numbers
- Any insurer claim number, if a claim has been filed
A typical case, phase by phase.
Every matter differs by chain complexity and number of hops, but most engagements follow this rhythm. Day ranges are indicative and set precisely in your engagement letter.
Initial review of what you've submitted; confirmation the case falls within a pattern we can meaningfully trace before any fee is discussed.
Conflicts check, identity verification for the engaging party, and a written engagement letter with fixed fee and scope you countersign.
Structured collection of wallets, hashes, exchange records, and communications; every item hashed and logged into the case workspace.
Transaction-graph construction, clustering, and counterparty attribution across all relevant chains and services.
A working session with you and/or your counsel on findings so far, open questions, and any additional evidence needed.
Draft report is written, then independently re-derived and challenged by a second analyst before finalization.
Final report delivered with a walkthrough call for you and your attorney, covering findings, confidence tiers, and next steps.
Kept informed, never left waiting.
We schedule interim briefings so you and your counsel see findings as they develop rather than only at delivery, and can direct additional evidence collection while it's still available.
Drafted, then independently re-derived.
A draft report is never the final word. A second analyst, without sight of the first analyst's working notes, re-derives the key findings before the report is finalized, hashed, and signed for delivery.
- Independent second-analyst review of every material finding
- Assumption register attached where source data was incomplete
- Report versioned and hashed on finalization
- Delivered with a live walkthrough for you and your counsel
Delivery isn't the end of the engagement.
We walk your report through with your attorney, then support the specific downstream actions your matter calls for. Which of these apply — and whether they succeed — depends on where the funds landed and on the cooperation of the institutions involved.
- Exchange freeze-request evidence packages
- Law-enforcement referral packages (FBI/IC3, Secret Service, local units)
- Insurer claim submissions and supporting documentation
- Civil litigation support, including subpoena-ready exhibits
- Expert witness declarations, depositions, and trial testimony where scoped
Post-delivery monitoring & re-tracing.
Funds sitting at an identified address can move again. Where scoped, we monitor known addresses and re-trace promptly if funds are moved, issuing a dated addendum rather than editing the original report — so your evidentiary record stays intact.
If tracing shows no viable path.
Sometimes the honest finding is that funds have moved beyond any point where a freeze, referral, or claim is likely to succeed — through a mixer with no reliable exit signal, or into jurisdictions with no practical cooperation. When that happens during the feasibility stage, we tell you before you commit further fees. When it emerges during a full investigation, we say so plainly in the report rather than manufacturing false confidence, and we outline what limited options, if any, remain.
First response within one business day of intake, during business hours (Eastern Time).
Written feasibility memo typically within three business days of scope approval.
Agreed delivery date in the engagement letter; status updates at each milestone.
A named senior analyst plus a partner-level escalation contact on every matter.
- Wallet addresses or transaction hashes connected to the loss
- A short written timeline of events and amounts
- Screenshots and message logs with the counterparty, unedited
- Exchange tickets, police report numbers, or insurer claim references, if any
- Your attorney's contact details where counsel is already instructed
- ✕Pay any further “tax”, “unlock”, or “release” fee — this is a second-stage scam
- ✕Contact or threaten the counterparty; it destroys evidence and legal remedies
- ✕Share seed phrases or private keys with anyone, including us
- ✕Delete accounts, chats, or apps involved in the incident
- ✕Engage a firm charging a percentage of “recovered” funds
Read more on scope and limitations in our methodology and disclaimer, or see frequently asked questions.
Bring us into your case.
Most engagements begin with a 15-minute call and a wallet address. That's enough for us to tell you whether the on-chain path is worth pursuing.