Illicit funds leave a record.
Chain Fraud Watch investigates crypto theft, fraud operations and on-chain money laundering. We work for the people and platforms who were hit, and for the lawyers, insurers, investigators and journalists who need what happened established in writing.
Traced an Exodus wallet shown on a recorded Discord call back to a 185 BTC (~$13M) social engineering theft on 14 March 2026 and to $5.85M+ from five earlier 2025 thefts, tying $19M to a US-based actor who appears in the complaint only as Co-Conspirator 1; Trenton Johnson, charged over the 185 BTC theft, faces up to 40 years.
| Hop | Date | Movement | Value |
|---|---|---|---|
| 1 | AUG–OCT 2025 | Five earlier social engineering thefts, later identified as the source of funds for 0x97da…1122 | $5.85M+ |
| 2 | 14 MAR 2026 | 185 BTC social engineering theft to bc1qc07y…gnue | 185 BTC (~$13M) |
| 3 | 14 MAR 2026 | Funds sent to the same laundering service within minutes of the theft, linking the older wallet 0x97da…1122 | |
| 4 | 15 MAR 2026 | Exodus wallet 0x4487…bba6 receives proceeds of the theft | $5.3M |
| 5 | 23 APR 2026 | Balance shown on a recorded Discord “band 4 band” call; $1.6M already spent or laundered | $3.68M |
| 6 | 11 MAY 2026 | Criminal complaint against Trenton Johnson unsealed for his role in the 185 BTC theft | UP TO 40 YRS |
Three kinds of case
Most work arrives as one of these three. Attribution and expert reports run through all of them and are set out on the services page.
Theft tracing
Funds taken from a person or a protocol. We follow them from the theft address through swaps, bridges, mixers and peel chains, and document each hop.
Fraud exposure
Rug pulls, fake platforms, pig butchering, ponzi structures, paid promotion. We establish what the operation actually is: its wallets, its victim pool, its promotion, and the people running it.
Tracing laundered funds
How proceeds get washed and where they convert to cash. Mixers, bridge loops, peel chains, OTC and P2P desks, and the exposure a wallet or platform has to funds it should have flagged.
The trail breaks where attention lapses
Theft, fraud and laundering are all processes, and processes have seams. Chain-hopping leaves timing signatures, mixers leave amount patterns, scam operations reuse infrastructure, and the people running them get careless. We work the seams.
Across chains, not just one
Funds rarely stay put. We follow value through bridges and swaps between chains and reconcile both sides of each crossing.
Cluster before you conclude
One address is not an actor. We build the address cluster first, then reason about who controls it.
Off-chain corroboration
Deposit addresses, reused handles, leaked names, timing overlaps. On-chain data alone rarely names anyone.
Evidence you can file
Hashes, captures and timestamps recorded as we go, so the work is usable.
Four independent links between the cluster and one operator. Any single link would be weak; together they are hard to explain otherwise.
What working with us looks like
No dashboard to log into. You get an investigator, a case, and a written result.
Intake
You send the addresses, transactions or the operation you want looked at, plus what happened and when. We tell you within the day what looks establishable and whether the work is worth paying for.
Trace & attribute
We map the flow, cluster the addresses, size the operation where there is one, and pursue off-chain links where they exist.
Handover
You get the report, the address inventory, and the exhibits. Where it helps, we brief your counsel.
A report you can act on
Every case ends in a written report and a machine-readable address inventory. Expert declarations and briefings to platforms or law enforcement are scoped separately, only when a case actually needs them.
- 01Scope, timeline of the incident, and the sources used to establish it.
- 02The fund path, hop by hop, with transaction hashes for every movement.
- 03Address inventory: theft addresses, intermediates, cluster members, and custodial deposits.
- 04Attribution findings with the evidence behind each one, and an explicit confidence level.
- 05Timestamped exhibits and captures, in a form that survives being checked.
You were drained, social engineered, or hit by a fake support call. Priced per case, with the scope agreed in writing before anything starts.
Exploits, insider theft, or a question about illicit exposure in funds you have received. Retainer or per case, depending on whether you need us standing by.
Lawyers and insurers who need funds movement established to a standard that survives challenge. Expert declarations scoped separately where a matter needs one.
An operation documented to a standard you can publish from: sourced findings, the full address inventory, and an explicit confidence level on every claim.
Tell us what happened and what you already have
Theft, a scam operation, or funds you think are laundered. We read it, tell you what can be established, and say when it isn't worth your money.