Skip to content
cftrace will never ask you to pay upfront via messaging apps or crypto. • We only contact you from verified @cftrace.com and @cf-trace.com email addresses. • We never demand a payment. Only a fully refundable recovery deposit may be required. • Your recovered assets stay under your name until released to your wallet. • Scammers impersonate recovery firms so book calls only through this website. • Need proof? Read our case results and verified client testimonials. • All meetings are recorded and case files are encrypted end-to-end.cftrace will never ask you to pay upfront via messaging apps or crypto. • We only contact you from verified @cftrace.com and @cf-trace.com email addresses. • We never demand a payment. Only a fully refundable recovery deposit may be required. • Your recovered assets stay under your name until released to your wallet. • Scammers impersonate recovery firms so book calls only through this website. • Need proof? Read our case results and verified client testimonials. • All meetings are recorded and case files are encrypted end-to-end.
Forensics

The chain does not lie.
We read it.

Every stolen transaction leaves a permanent trail. Our analysts follow that trail through mixers, bridges, and layered wallets, until the funds reach a venue that can act on lawful notice.

Solutions

Find your situation.

Every case is different, but most fall into one of these. Each one has a route forward. If yours is not listed, speak to a specialist and we will tell you honestly whether it is recoverable.

Revolut · Monzo · Barclays · Wise · high street banks

My bank blocked or cancelled the transfer

An automated fraud filter reacted to wording, not to your case. Keep the description factual and the transfer goes through.

  • Do not use the words recovery, scam, fraud, hack or stolen
  • State plainly that you are moving your own funds to your own wallet
  • If the account is under review, ask for the review reference and send it to your specialist
Coinbase · Kraken · Binance · Crypto.com

The exchange froze my withdrawal

Withdrawals are usually held pending source-of-funds or identity checks. We prepare the documentation the compliance desk actually asks for.

  • Never pay a 'release fee' or 'withdrawal tax' - legitimate venues do not charge them
  • We draft the source-of-funds pack and identity evidence
  • If the freeze is unlawful, the dossier goes to the exchange compliance team formally
Cloned brokerages · fake trading dashboards

I invested through a platform that turned out to be fake

Deposits sent to a fake platform still leave a chain trail. We follow the deposit addresses to the venue that ultimately received the funds.

  • Preserve every screenshot, chat log and transaction hash
  • We cluster the platform's deposit wallets and identify the off-ramp
  • Notice is served on the receiving exchange, with law enforcement copied in
Romance and long-con investment fraud

I was persuaded to send crypto by someone I trusted

These cases move funds through many hops before cashing out. Tracing works, but speed matters - the sooner we start the better the odds.

  • Stop all further payments immediately, including 'one last fee'
  • We trace through mixers and bridges to the cash-out point
  • The case is reported to Action Fraud and the receiving venue
Seed-phrase theft · malicious approvals · SIM swap

Someone drained my wallet

We map the drainer's cluster, check whether the funds are still on-chain, and target the exchange where they are cashed out.

  • Revoke outstanding token approvals and move any remaining assets
  • We monitor the drainer cluster for movement in real time
  • Freezing requests are filed the moment funds hit a regulated venue
Second-instance recovery fraud

I was already scammed once by a 'recovery' firm

We treat this as its own case. Fees paid to a fake recovery agent are traceable in exactly the same way as the original theft.

  • We verify who you actually paid and where the funds went
  • You get an honest assessment before anything is opened
  • Nothing is ever requested in crypto to an address we control
Discuss your case
Blocked transfers

Why your bank stopped it.

Banks and exchanges run automated systems that read every transaction. When they see certain words in a payment reference, in a support chat, or in an answer to a security question, the transfer is stopped automatically. It is not aimed at you and it says nothing about your case.

RecoveryScamFraudInvestigationHackStolenCompromised
  • The transaction is cancelled
  • The account may be frozen while it is reviewed
  • You are put through a lengthy review process
What to say

Keep it simple and true.

If they ask
What is this transaction for?
You say

I am transferring funds to my own personal crypto wallet.

If they ask
Who is the recipient?
You say

This is my own wallet address.

If they ask
What is the purpose of this transfer?
You say

I am moving my own funds between my own accounts.

It is truthful, it does not trigger a security alert, and it keeps the transaction straightforward. You are sending funds to a wallet you own.

What we do

Six capabilities, one outcome.

Transaction tracing
Follow every hop from source to destination across chains and layer 2s.
Wallet clustering
Group related addresses using heuristics, timing, and shared behaviours.
Cross-chain analysis
Track funds through bridges, wrapped assets, and swap protocols without losing continuity.
Risk scoring
Rate every address against sanctions, mixer exposure, and known scam clusters.
Exchange identification
Attribute receiving addresses to regulated venues capable of freezing balances.
Evidence dossiers
Compile exhibit-ready reports with chain of custody suitable for counsel.
Tracing

From transaction hash to the exchange holding the funds.

We start with the single transaction that moved your funds. From there we map every branch - splits, bridges, mixer entries, and the addresses that eventually deposit at a venue capable of acting.

Direct transfers
Straightforward on-chain hops between wallets
Mixer exposure
Tornado, Wasabi, ChipMixer patterns identified by entry and exit heuristics
Cross-chain bridges
Wormhole, LayerZero, cBridge routes tracked with matched deposits and receipts
Terminal deposits
Final addresses attributed to their custodian
Trace graph
live
VictimSplit AMixerSplit BBridgeWalletWalletExchange
Risk scoring

Every address gets a rating.

We score each wallet on sanctions, mixer exposure, known scam clusters, and behavioural signals. Analysts triage from the highest-risk nodes first.

Address risk
5 addresses
Victim
0x8a…f21c
4
Split A
0x91…22ae
32
Mixer exit
0x37…c1d9
78
Bridge deposit
0xbb…0f4a
62
Binance hot
TP9…7Xn3
12
Evidence

Reports that hold up in court.

Each investigation ends with a structured dossier - chain of custody, cluster maps, exchange attribution, and legal exhibits. Ready to hand to counsel or law enforcement.

Executive summary
Chronological event log
Wallet cluster maps
Exchange attribution letter
Chain of custody statement
Case CF-2049Confidential
Executive summary

Traced $186,420 across 4 hops to Binance hot wallet.

Filed
09 Jul 2026
Chain
Ethereum → Tron
Custodian
Binance BAM
Status
Notice served
Signed by lead analystv1.4 · sealed
Every case reviewed by a senior analyst

Send us a transaction. We'll take it from there.