Six practice areas covering every stage of a crypto-related dispute — from the first traced transaction to expert testimony in court. We regularly investigate investment fraud, romance / pig-butchering scams, job & task tax fraud, online purchase fraud, wallet drainer attacks, and business treasury incidents.
Address clustering, transaction graph reconstruction, and cross-chain follow-through across mixers, bridges, and centralized exchanges.
Documented analysis of pig-butchering, fake trading platforms, and rug-pull schemes with counterparty attribution where possible.
Post-incident review of drainer signatures, malicious approvals, and private-key exposure, with prioritized remediation steps.
Contained triage for treasury breaches, coordination with exchange compliance teams, and preservation of on-chain evidence.
Source-of-funds analysis, sanctions screening context, and risk narratives for regulated institutions and their counsel.
Written expert reports, affidavits, and — where appropriate — expert witness testimony for civil proceedings.
Each typology below has a distinct evidentiary profile. Preserving the right records early materially improves what tracing can establish. See our methodology for how we handle chain-of-custody.
Preserve
Platform URLs/app screenshots, deposit transaction hashes, chat logs, 'account balance' screenshots, withdrawal request denials.
Realistic outcome
On-chain destination of deposits can usually be traced to exchange cash-out points; recovery depends on how quickly the exchange is notified and its compliance response.
Preserve
Full message history establishing the relationship timeline, wallet addresses used for transfers, any claimed 'customs fee' or 'unlock fee' payments.
Realistic outcome
Tracing supports law-enforcement referral and, where funds reached a regulated exchange, may support a compliance freeze request.
Preserve
Recruiter messages, task-platform screenshots, records of 'tax', 'deposit', or 'credit score' payments demanded before withdrawal.
Realistic outcome
These schemes often funnel through TRON/USDT wallets to a small number of collection addresses — clustering can reveal shared infrastructure across victims.
Preserve
Listing screenshots, seller wallet address, payment confirmation, shipping (non-)confirmation.
Realistic outcome
Smaller-value, single-hop cases are often the fastest to assess but may not justify a full investigation — we will tell you honestly if this applies.
Preserve
Wallet address, malicious transaction/approval hash, the site or link that triggered the signature, device used.
Realistic outcome
Drainer contract addresses are frequently reused; attribution to known drainer kits and downstream mixing is common.
Preserve
Carrier fraud report/ticket number, exchange account access logs, 2FA reset notifications, timeline of the takeover.
Realistic outcome
Exchange withdrawal destinations can usually be identified; account-level evidence from the carrier and exchange is often decisive for legal claims.
Preserve
Email headers, internal approval trail, treasury wallet address, invoice or payment instructions used in the compromise.
Realistic outcome
Enterprise incidents often justify a full forensic report suitable for insurers, board reporting, and law-enforcement referral.
We trace across the chains most commonly used in fraud and incident cases, and follow value as it moves between them.
| Bitcoin (BTC) | UTXO clustering, mixer/CoinJoin analysis |
| Ethereum & EVM L2s | Arbitrum, Optimism, Base, Polygon, Avalanche C-Chain |
| Tron / USDT-TRC20 | High-volume scam & pig-butchering rail |
| Solana | SPL token & program-level tracing |
| BNB Chain | BEP-20 token tracing |
| Litecoin & Bitcoin Cash | UTXO tracing |
| XRP Ledger | Payment path tracing |
| Bridges, mixers & CEX off-ramps | Cross-chain bridge correlation, mixer heuristics, exchange deposit clustering |
Full tooling manifests are disclosed in every report so opposing experts, exchanges, and law enforcement can independently verify our conclusions.
Full report with citations, suitable for pleadings, demand letters, and discovery.
Evidence package formatted for compliance escalation and freeze requests.
Loss-quantification narrative and chain-of-custody documentation for claims review.
Structured evidence package aligned to standard referral formats.
Every engagement is billed as a fixed, written fee agreed before work begins. We never charge a percentage of recovered funds — see our process and engagement models for detail.
| Engagement stage | Fee basis | Typical timeline |
|---|---|---|
| Preliminary assessment | Fixed fee | 1–3 business days |
| Standard tracing investigation | Scoped, fixed fee | 2–4 weeks |
| Complex / multi-jurisdiction / mixer-heavy | Scoped, fixed fee | 4–8 weeks |
| Expert report & testimony | Quoted separately | Aligned to court/discovery schedule |
We would rather tell you honestly now than take a fee for work that won't help. A free initial review determines fit before any paid engagement begins.
Fraud victims are frequently targeted a second time by fake "recovery experts." Aegis will never do the following, and you should refuse any firm that does:
Aegis is paid a fixed, written fee for investigative work — never a share of recovered funds. Read our legal disclaimer for full terms.
Regardless of practice area, each Aegis matter is delivered against the same written standards — documented in your engagement letter before work begins.
Deliverables, timeline, and price agreed in advance. No open-ended billing, no contingency terms.
A single senior investigator owns your matter end-to-end and is available to your counsel.
An independent analyst re-derives every conclusion from source data before release.
Transaction hashes, addresses, and exports supplied so findings can be verified independently.
Attributions labelled confirmed, probable, or possible — with limitations stated in the report.
Clarification calls with counsel, insurers, or law enforcement included for 30 days.
Feasibility opinion, initial tracing summary, and recommended next steps in writing.
Executive summary, transaction graph, counterparty attribution, tooling manifest, exhibits.
Declarations, affidavits, rebuttal analysis, deposition and trial testimony.
Aegis provides investigative services only and does not provide legal advice or guarantee recovery of funds. See our legal disclaimer.
Share the essentials — wallet, transaction, timeline. We respond within one business day with a candid view of what on-chain evidence can and cannot do for your situation.