Questions? Start here.

Move fast and preserve evidence. Do not move, swap, or "test" any remaining funds in the affected wallet. Write down exactly what happened and when, and gather everything you have: the transaction hash(es), the wallet address that was drained, the link or message that started it, and any screenshots. The first 72 hours matter most because funds are often still moving and may pass through a traceable exchange before they're cashed out. Contact us with the subject line URGENT, or request a case review. For the complete step-by-step, read our First 72 Hours playbook.

We trace funds and build evidence. We don't take custody of crypto or guarantee recovery, and we're cautious of anyone who promises you will get your money back. What we can do is follow the money across chains, identify where it came to rest or where it cashed out, and produce a documented, chain-of-custody report you (and law enforcement) can act on. Recovery, when it happens, comes through exchanges, issuers, or law enforcement acting on solid evidence, which is exactly what we build.

At minimum, the wallet address that was drained or a transaction hash from the theft. Anything else helps: the approximate date and time, the chain it happened on, the tokens involved, and the context (fake airdrop, phishing link, fake support, compromised seed phrase, etc.). If all you have is the wallet, we can usually identify the theft transaction ourselves and work forward from there.

Every matter begins with a case review and recommended scope. Focused traces (a single incident, defined chains and concise findings) are available now, with pricing on request; complex investigations are quoted according to chain count, transaction volume, elapsed time, and reporting requirements. Litigation support is available on a retainer or hourly basis. Review our services and engagement options or contact us for current availability. ChainWatch does not charge hidden recovery fees.

Starting from the theft transaction, we follow the funds hop by hop across the blockchain, classifying every address along the way (wallets vs. contracts, bridges, mixers, exchanges, and laundering hubs) and flagging where the trail leads. The output is a structured timeline of where the money went, what each stop is, and which endpoints are actionable (for example, a still-resting balance, an exchange deposit, or a freezable stablecoin). Every conclusion is recorded with the on-chain evidence behind it. For more on how this works and where it hits limits, see Can stolen crypto be traced?

We trace across the major EVM chains (Flare, Ethereum, Arbitrum, Base, BNB Chain, Polygon, and Optimism) and follow funds through cross-chain bridges between them, including onward onto networks like Avalanche and Linea. Bitcoin and Tron tracing are live in early access. When funds bridge to Solana, we detect and document that hand-off as an open lead; native Solana tracing is in active development.

We'll tell you honestly. A privacy mixer is designed to break the public on-chain link between deposits and withdrawals, so when funds enter one, that branch of the trail terminates there, and we will not assert a withdrawal we can't prove. We document the deposit precisely (amount, time, transaction) as evidence, and we never present a guess as a fact. De-mixing approaches exist and are part of our ongoing work, but anything inferred is labeled as inference, not proof. Our guide Can stolen crypto be traced? covers mixers and other limits in depth.

That's often the best outcome for a case. Exchange deposits are a real pressure point: the venue holds know-your-customer records, and stablecoin issuers can freeze funds at the contract level. When we identify a likely cash-out point, we document the inbound transactions so the venue or issuer can be approached by you or law enforcement with concrete evidence.

It depends on how far and how many ways the funds were moved. A simple drain that lands in one place resolves quickly, while a case that's been split across many chains and laundering hops takes longer. For active thefts, speed matters most in the first 72 hours, so urgent cases are prioritized. We'll give you a realistic sense of timing once we've seen the case.

Every API call, classification, and conclusion in a trace is logged with timestamps and verification hashes, so the path from the original theft to any conclusion can be independently re-checked. That tamper-evident record (the chain of custody) is what makes a report suitable for a law-enforcement referral or legal proceeding, rather than just a screenshot of a block explorer. See Can stolen crypto be traced? for what makes a trace court-ready.

Yes. Reports are built to support an IC3 / FBI referral package, with the inbound transaction hashes, attributable amounts, and custody linkage that investigators need. We're a forensic service, not a law-enforcement agency, so we can't open a criminal case ourselves; what we provide is the documented evidence that helps the people who can act on it move quickly. We walk through the whole process in How to report crypto theft to the FBI.

Yes. We don't sell your data or publish your information. We use what you share to work your case and, as you agree when you request a case review, we send your case file to law enforcement and to your attorney if you have one. See what happens to your data.

When you request a case review, you agree to two things. First, we use the information you provide to investigate your case, and we send your case file to law enforcement (for example the FBI's IC3 or your local police) and to your attorney if you have one. Second, our tool learns from the public blockchain data in cases: wallet addresses, transactions and the patterns scammers use. That includes your own wallet addresses, because they are public on the blockchain, but not your name, contact details or other personal information. Information from legal matters handled for attorneys is used only for that matter unless the engagement agreement says otherwise. We never sell your data. To ask about your data, contact us.

Yes. Attorneys can contact us directly (choose "Law firm or attorney" on our contact page) or work alongside a client who has requested a case review. Process: we start with a case review of what you have and recommend a scope. Cost: complex investigations are quoted in advance, based on chain count, transaction volume, elapsed time and reporting needs; litigation support, including expert reports and declarations, is on a retainer or hourly basis. See services and pricing. ChainWatch is not a law firm and does not provide legal advice.

Yes. When a victim requests a case review, they agree that we send their case file to the law enforcement handling the case, in a format built for an IC3 report and a local police report. Agencies can also contact us directly (choose "Law enforcement agency" on our contact page) to discuss tracing support for an investigation. Process and cost: we review what you have, recommend a scope and explain any cost before work begins.

No. ChainWatch is a blockchain forensics firm. We trace where stolen crypto went and document it for victims, their attorneys and law enforcement. Recovery scammers promise to get your money back; we don't, and we can't: only law enforcement and courts can seize funds or order them returned. You don't have to take our word for it. Here is our own checklist applied to us:

• No recovery guarantees. We tell you what tracing can and can't show, never that you'll get your money back.
• Never your recovery phrase, private keys or passwords. We never ask for them, and the case intake tells you not to include them.
• No hidden fees and no "release" fees. Paid work is scoped and quoted before it starts. Nobody legitimate charges you to receive money that has "already been recovered".
• Not a government agency. We don't claim to be, or to work for, the FBI, IC3 or any regulator.
• A real, registered business. ChainWatch Recovery Services LLC (d/b/a ChainWatch.US) in Virginia. You can look us up through the Virginia State Corporation Commission.
• Check us like anyone else. As the FTC recommends, search our name with words like "complaint", "scam" or "review".

If anyone claiming to be ChainWatch promises recovery, asks for a fee to release funds, or asks for your recovery phrase, it isn't us. Please report it to us.

ChainWatch is built by Sparky Lerner and Titus Claxton. Sparky, Co-founder & CEO of ChainWatch Recovery Services LLC (d/b/a ChainWatch.US), started it after losing $93,000 to a wallet drainer via a fake governance-vote link, and rather than accept it, set out to learn blockchain forensics end to end and build the tool that didn't exist. Titus Claxton, Co-Founder & CTO and a network security professional, brings the security and technical expertise behind the platform. Together they build and run ChainWatch, for the people who need it most. Read the full story: I lost $93,000 to a wallet drainer.

No. ChainWatch is a blockchain forensics service. We trace funds and produce evidence; we don't provide legal or financial advice, and our service guarantee covers the analysis work we perform, not fund-recovery outcomes. ChainWatch is in active development, so capabilities shown across the site are illustrative and evolving.