Questions? Start here.

Move fast and preserve evidence. Do not move, swap, or "test" any remaining funds in the affected wallet. Write down exactly what happened and when, and gather everything you have: the transaction hash(es), the wallet address that was drained, the link or message that started it, and any screenshots. The first 72 hours matter most because funds are often still moving and may pass through a traceable exchange before they're cashed out. Contact us with the subject line URGENT, or submit your case. For the complete step-by-step, read our First 72 Hours playbook.

We trace funds and build evidence — we don't take custody of crypto or guarantee recovery, and we're cautious of anyone who promises you will get your money back. What we can do is follow the money across chains, identify where it came to rest or where it cashed out, and produce a documented, chain-of-custody report you (and law enforcement) can act on. Recovery, when it happens, comes through exchanges, issuers, or law enforcement acting on solid evidence — which is exactly what we build.

At minimum, the wallet address that was drained or a transaction hash from the theft. Anything else helps: the approximate date and time, the chain it happened on, the tokens involved, and the context (fake airdrop, phishing link, fake support, compromised seed phrase, etc.). If all you have is the wallet, we can usually identify the theft transaction ourselves and work forward from there.

We're currently running a free beta on real theft cases — no upfront fee for the first cohort of clients while we test our tracing technology. Beyond the beta, paid options are available (rapid-response analysis and an ongoing dashboard subscription). Pricing for those is listed on the case form's "Reason for Contact" menu. There are no hidden recovery fees.

Starting from the theft transaction, we follow the funds hop by hop across the blockchain, classifying every address along the way — wallets vs. contracts, bridges, mixers, exchanges, and laundering hubs — and flagging where the trail leads. The output is a structured timeline of where the money went, what each stop is, and which endpoints are actionable (for example, a still-resting balance, an exchange deposit, or a freezable stablecoin). Every conclusion is recorded with the on-chain evidence behind it. For more on how this works and where it hits limits, see Can stolen crypto be traced?

We trace across the major EVM chains — including Ethereum, Arbitrum, Base, BNB Chain, Polygon, and Flare — and follow funds through cross-chain bridges between them. When funds bridge off to a non-EVM chain like Solana or Bitcoin, we detect and document that hand-off; following onto those chains is part of our active development roadmap.

We'll tell you honestly. A privacy mixer is designed to break the public on-chain link between deposits and withdrawals, so when funds enter one, that branch of the trail terminates there — and we will not assert a withdrawal we can't prove. We document the deposit precisely (amount, time, transaction) as evidence, and we never present a guess as a fact. De-mixing approaches exist and are part of our ongoing work, but anything inferred is labeled as inference, not proof. Our guide Can stolen crypto be traced? covers mixers and other limits in depth.

That's often the best outcome for a case. Exchange deposits are a real pressure point: the venue holds know-your-customer records, and stablecoin issuers can freeze funds at the contract level. When we identify a likely cash-out point, we document the inbound transactions so the venue or issuer can be approached by you or law enforcement with concrete evidence.

It depends on how far and how many ways the funds were moved — a simple drain that lands in one place resolves quickly, while a case that's been split across many chains and laundering hops takes longer. For active thefts, speed matters most in the first 72 hours, so urgent cases are prioritized. We'll give you a realistic sense of timing once we've seen the case.

Every API call, classification, and conclusion in a trace is logged with timestamps and verification hashes, so the path from the original theft to any conclusion can be independently re-checked. That tamper-evident record — the chain of custody — is what makes a report suitable for a law-enforcement referral or legal proceeding, rather than just a screenshot of a block explorer. See Can stolen crypto be traced? for what makes a trace court-ready.

Yes — reports are built to support an IC3 / FBI referral package, with the inbound transaction hashes, attributable amounts, and custody linkage that investigators need. We're a forensic service, not a law-enforcement agency, so we can't open a criminal case ourselves; what we provide is the documented evidence that helps the people who can act on it move quickly. We walk through the whole process in How to report crypto theft to the FBI.

Yes. Case details you share are kept strictly confidential and used only to work your case. We don't sell data or publish your information.

We're happy to coordinate with your attorney or with investigators handling your case, and to deliver the report in a format that's useful to them. ChainWatch is not a law firm and does not provide legal advice — for legal strategy, work with qualified counsel.

ChainWatch is built by Sparky Lerner and Titus Claxton. Sparky — Founder & CEO of ChainWatch LLC — started it after losing $93,000 to a wallet drainer via a fake governance-vote link, and rather than accept it, set out to learn blockchain forensics end to end and build the tool that didn't exist. Titus Claxton — Co-Founder & CTO and a network security professional — brings the security and technical expertise behind the platform. Together they build and run ChainWatch, for the people who need it most. Read the full story: I lost $93,000 to a wallet drainer.

No. ChainWatch is a blockchain forensics service. We trace funds and produce evidence; we don't provide legal or financial advice, and our service guarantee covers the analysis work we perform, not fund-recovery outcomes. ChainWatch is in active development, so capabilities shown across the site are illustrative and evolving.