Home › Knowledge Hub › Forensic reports and lawyers

Forensic reports and crypto fraud lawyers

By Golan Ben Moshe · Co-founder, Chain Pursuit · 8 min · Last updated 1 October 2026

A crypto forensic report is a structured document that organises blockchain transaction data and supporting evidence so a reviewer can follow what happened. A lawyer becomes relevant when the loss is large, a counterparty is identifiable, or a court order might be needed. Neither can guarantee recovery, and neither has any power to freeze funds, those decisions belong to exchanges, regulators and courts.

Do the free things first

Both of these cost money, and both are more useful once the free steps are done.

Preserve your evidence, notify the exchange or bank your payment left, and file with the reporting channel in your country that can lead to an investigation. Those cost nothing, and a lawyer or analyst arriving after they are complete starts from a much stronger position.

Anyone who tells you to hire them before reporting has the order backwards. And if you still hold assets anywhere, securing them comes before either.

What a forensic report is

A structured document organising blockchain transaction data and supporting evidence relating to a suspected fraud, theft, hack or disputed transfer. Its purpose is to make scattered facts legible to someone reviewing them.

A competent report typically contains:

• A case summary and dated timeline
• Wallet addresses and transaction hashes, with networks
• Transaction-flow diagrams
• Blockchain explorer references so anything can be checked independently
• Notes on interactions with known services, exchanges, bridges, mixers
• Screenshots, communications and payment records
• An evidence index
• A description of the analytical methods used, and their limitations

That last item is the one that separates serious work from a printout. A report that presents every finding at the same confidence level is not being careful with you. Real analysis says where certainty drops and why.

What it is not

A forensic report is not a court order, not a guarantee of identification, and not a guarantee of recovery. It does not compel an exchange to freeze funds or disclose records, and it confers no authority of any kind.

It is a document. Its value is entirely in what someone else does with it.

What you are buying

When it is worth paying for

When you have a specific recipient in mind and a reason for them to act.

Useful when: an exchange has asked for documentation before reviewing an account; a lawyer needs it to support an application; an insurer requires it for a claim; a police force has an open file and will accept supporting material; or the trail is complex enough that you cannot explain it yourself.

Not worth it when: you have no identified destination, the funds went through a mixer, the loss is old, or you want to know where the money went for your own peace of mind. In that last case you are buying a fact, not a remedy, and it is an expensive way to confirm bad news.

Before commissioning one, ask what the deliverable is, what you will be able to do with it that you cannot do now, and whether that next step is realistically available in your jurisdiction. If the answer to the last question is no, the report will not help.

Questions to ask an analyst

• Who is preparing this, and what are their qualifications?
• What tools and data sources are used?
• What assumptions does the analysis rest on?
• Is the evidence reproducible: can someone else verify it from the explorer references?
• What are the stated limitations?
• What will you not be able to determine?

And the one that matters most: is the provider claiming anything beyond its authority? No private company can freeze an account, compel disclosure, or reverse a transaction. A provider implying otherwise is misrepresenting what it does, whatever its report contains.

When a lawyer becomes relevant

A lawyer may be useful when:

• The loss is significant enough to justify the cost
• A known company or identifiable individual is involved
• Assets appear to have reached a regulated service
• A court order might be needed, disclosure, freezing, or preservation
• You need advice on jurisdiction, contracts, insurance, or a civil claim

A lawyer cannot guarantee recovery either. What counsel can do is explain the remedies available where you are, and help you judge whether the likely benefit justifies the cost. Often the honest answer is that it does not, and a good lawyer will tell you that in the first meeting.

Some jurisdictions are more workable than others. English courts have treated crypto-assets as property and granted disclosure and freezing orders against persons unknown; several other jurisdictions have comparable mechanisms. Where you live materially changes the answer.

Ask whether the lawyer has relevant experience in fraud, asset recovery, cybercrime or digital assets. General practice is not the same thing.

Preparing for the consultation

You are paying for their time, so arrive organised. Bring:

• A concise written summary, one page
• A dated timeline
• Transaction hashes and wallet addresses, with networks
• Exchange records, bank and card records
• Communications and screenshots
• Any reports already filed, with reference numbers

Our evidence checklist covers assembling this properly.

Questions to bring:

• What are the realistic options in my jurisdiction?
• What would each cost, and over what timescale?
• What is the likely outcome, and what would make it more or less likely?
• How are your fees structured, and what happens if we lose?
• Are there conflicts of interest?
• What are the limits of this strategy?

Verifying either of them

The same discipline applies to both, and it is the discipline that protects you from the far more common scenario, a recovery scammer presenting as a professional.

For lawyers: ask for the bar or law society registration number, the firm's registered address, and an engagement letter. Verify the registration through the regulator's own register, using contact details from that register rather than from the firm. A lawyer who will not provide a verifiable registration is not a lawyer.

For analysts: most jurisdictions do not license blockchain analysis, so there may be no register to check. That makes the other questions more important: reproducibility, stated limitations, and a written scope. Investigative work for a fee requires a private investigator licence in many places, ask which state or country licensed them, and check that register.

For both, the disqualifying signs are identical. A fee demanded before anything is delivered. A guaranteed outcome. A refusal to put terms in writing. A claim to work with law enforcement. And a SAM.gov registration or NATO NCAGE code presented as a credential, neither is a licence, and both are free self-registrations with no vetting behind them.

Frequently asked questions

How much does a forensic report cost?

It varies widely by scope and provider, and there is no standard rate. What matters more than the price is the scope: ask exactly what will be delivered, and what you will be able to do with it. A cheap report you cannot use is more expensive than a good one you can.

Will a forensic report make an exchange freeze the funds?

No. An exchange acts on its own compliance assessment or on a legal basis, not because a report was produced. A report can support a request, and where an exchange has asked for documentation it can be necessary. It has no compelling force by itself.

Do I need a lawyer in my own country or where the scammer is?

Start with one where you are. Blockchain analysis works from anywhere, but only a lawyer admitted in a jurisdiction can pursue proceedings there. Your local lawyer can advise on whether foreign proceedings are viable and, if so, instruct accordingly.

At what loss size is a lawyer worth it?

There is no fixed threshold, but below roughly $50,000 legal costs commonly exceed any realistic recovery. Above that, and particularly where a counterparty or a regulated service is identifiable, a consultation is usually worth the fee even if you go no further.

The firm says it works with law enforcement. Is that meaningful?

Rarely. Anyone can file a report with a police agency, and doing so is not a partnership. Agencies do not sub-contract recovery to private firms. Ask what the relationship consists of in concrete terms, and treat a vague answer as an answer.

Can I use a forensic report to sue someone?

It can support a claim, but you still need an identifiable defendant and a court willing to hear it. That is the constraint that ends most cases, not the quality of the analysis. Discuss viability with a lawyer before commissioning a report intended for litigation.

Keep reading