CCE  ·  CCA  ·  CBE  ·  CSCD   Certified Investigator

Follow the money.
Wherever it goes.

Kestrel Forensics traces cryptocurrency transactions, identifies where funds have moved, and produces court-admissible investigation reports — for fraud victims, law firms, and businesses.

3 chains
BTC · ETH · TRX
SHA-256
Cryptographic evidence
OFAC
Sanctions screening
48h
Standard turnaround
Tamper-evident evidence records
Full chain of custody documentation
Court-admissible report format
OFAC sanctions screening
Confidential & secure
CCE · CCA · CBE · CSCD certified investigator

Built for the people who need answers

Whether you have been defrauded, are advising a client, or need to verify a counterparty — we produce the evidence you need.

Fraud Victims

You sent cryptocurrency and it disappeared. We trace where it went, identify the wallets involved, and produce a professional report you can submit to police, Action Fraud, or your insurer.

  • Romance scam / pig butchering
  • Investment fraud
  • Ransomware payment tracing
  • Rug pull and exchange fraud

Law Firms & Solicitors

Your client's case involves cryptocurrency. We provide expert blockchain analysis, identify exchange contacts for production orders, and produce reports suitable for court proceedings.

  • Civil asset recovery
  • Criminal defence and prosecution support
  • Exchange subpoena identification
  • Witness statement support

Businesses

You have received a cryptocurrency payment, are considering accepting one, or need to verify a counterparty. We screen wallets for sanctions exposure, mixer contact, and darknet activity.

  • KYC / AML wallet screening
  • OFAC sanctions due diligence
  • Counterparty risk assessment
  • Insurance and compliance support

What we deliver

Every investigation is conducted using professional-grade forensic tooling with cryptographic evidence preservation.

Transaction Tracing

We trace funds hop-by-hop from a seed address across Bitcoin, Ethereum, and Tron, identifying every wallet the funds passed through and attributing them to known entities where possible.

BTC · ETH · TRX

Investigation Report

A formal 11-section investigation report covering fund flow analysis, entity attribution, risk assessment, behavioural indicators, and specific recommendations for next steps.

Court-ready format

Evidence Preservation

All trace data is cryptographically hashed using SHA-256 at the point of capture. An evidence certificate is generated with a unique ID, timestamps, and a full chain of custody log.

SHA-256 · Tamper-evident

Exchange Identification

Where traced funds reach a regulated exchange, we identify the specific exchange and generate a formatted legal request letter for a production order or subpoena submission.

Subpoena-ready letters

Sanctions Screening

Every address in the trace is screened against the live OFAC SDN sanctions list. Any match triggers an immediate flag and is documented in the evidence record.

OFAC SDN · Real-time

Risk Assessment

A nine-factor risk score is calculated covering mixer contact, darknet exposure, peel chains, structuring patterns, dormant reactivation, and more — with a full written justification.

9-factor scoring

How an investigation works

From your first contact to a complete evidence bundle — typically within 48 hours.

1

Contact us

Tell us what happened, provide the address or transaction, and we will confirm whether we can help and provide a fixed quote.

2

Investigation

We trace the funds using live blockchain data, screen against OFAC, and annotate every significant address with our intelligence findings.

3

Preservation

The complete trace is cryptographically hashed, an evidence certificate is generated, and the chain of custody log is finalised.

4

Report

A formal investigation report is produced covering all findings, risk assessment, and recommended next steps including any exchange production orders.

5

Delivery

You receive a complete evidence bundle — report, certificate, CSV data, chain of custody log, and subpoena letters — in a single secure package.

Cryptographic proof that nothing has changed

Every investigation produces a tamper-evident evidence record. The moment we capture trace data, it is hashed using SHA-256 — the same cryptographic standard used in digital forensics. Any subsequent modification to the data produces a completely different hash, providing mathematical proof of tampering.

🔑

Unique Evidence ID

Every case receives a unique evidence identifier tied to the cryptographic record.

📋

Chain of Custody Log

Every action taken on the evidence is timestamped and logged — from capture to delivery.

Verifiable at any time

The evidence hash can be independently verified at any point, including during court proceedings.

EVIDENCE PRESERVATION CERTIFICATE
Evidence IDEV-M8X2KP
ChainBitcoin (BTC)
Seed address1CkqmRQE...HgwHn
Risk score95% — HIGH
OFAC matches2 detected
Preserved at14/01/2025 09:42:18
Integrity✓ Verified
Evidence record hash (SHA-256)
a3f8c2e1d9b047f6a2c8e5d1b3f7a9c2e4d6b8f0a2c4e6d8b0f2a4c6e8d0b2f4

Professionally certified in cryptocurrency forensics

Every investigation is conducted by a qualified cryptocurrency professional. These certifications cover forensic investigation methodology, blockchain architecture, cryptocurrency auditing, and smart contract analysis — giving you confidence that your case is in expert hands.

INVESTIGATING CRYPTOCURRENCIES
Investigating Cryptocurrencies
CSI Tech
CCE
Certified Cryptocurrency Expert
Blockchain Council
CCA
Certified Cryptocurrency Auditor
Blockchain Council
CBE
Certified Blockchain Expert
Blockchain Council
CSCD
Certified Smart Contract Developer
Blockchain Council

Why qualifications matter in crypto forensics

Blockchain evidence is increasingly scrutinised in court. Having a qualified, certified investigator conduct the analysis — rather than an uncertified tool user — strengthens the evidential weight of the report and gives legal teams a credible expert to reference or call upon.

Clear, fixed pricing

No hourly rates. No hidden fees. You know exactly what you are getting before you commit.

Screening
£99
A single address or transaction screened for risk, sanctions exposure, and known entity contacts. Results within 24 hours.
  • Single address / transaction trace
  • 3-hop trace depth
  • OFAC sanctions screening
  • Risk score and flag summary
  • Entity attribution report
  • PDF results document
  • Full investigation report
  • Evidence certificate
  • Subpoena letters
Get started →
Complex / Legal
POA
Multi-address investigations, ongoing case support, expert witness statements, and bespoke analysis for legal proceedings.
  • Multiple seed addresses
  • Extended trace depth
  • Cluster and network analysis
  • Expert witness statement
  • Ongoing case consultation
  • Direct liaison with legal team
  • Custom report format
  • Priority turnaround
  • Unlimited revisions
Contact us →
All prices exclude VAT where applicable. Complex cases are quoted individually after an initial consultation. We offer a free 15-minute scoping call for any case before you commit. If we cannot help, we will tell you before you pay anything.

Frequently asked questions

If your question isn't here, contact us and we will answer before you commit to anything.

Can you trace any cryptocurrency?
We specialise in Bitcoin (BTC), Ethereum (ETH), and Tron (TRX), which cover the vast majority of fraud and investigation cases. Privacy coins such as Monero use ring signatures that make tracing mathematically impossible with current technology — we will tell you upfront if a case falls into this category.
Will your report be accepted by police or in court?
Our reports are formatted to professional forensic standards with cryptographic evidence preservation, chain of custody documentation, and a formal investigation structure. We cannot guarantee how any specific police force or court will treat the evidence — that depends on the jurisdiction and specific case — but we produce the most defensible output possible. We recommend having your solicitor review the report for your specific use case.
What if the funds have gone through a mixer?
Mixer contact is documented and flagged in the report. While mixers deliberately break the transaction trail, we can still identify that mixing occurred, which mixer was used (e.g. Tornado Cash, Wasabi Wallet), and in many cases trace pre-mix and post-mix transactions. Mixer contact is itself evidentially significant and often sufficient for a production order to an exchange.
How much of my money can be recovered?
We are an investigation and forensics service — we do not recover funds directly. What we do is produce the evidence needed to support recovery through legal channels: identifying exchanges where a production order can obtain KYC data, identifying sanctioned addresses for OFAC reporting, and producing reports suitable for civil asset recovery proceedings. Recovery success depends heavily on whether funds reached a regulated exchange before being cashed out.
How do I provide the address or transaction?
Simply use the contact form below. Provide the wallet address or transaction hash that the funds were sent to or from, the approximate date, the approximate value, and any background context. All submissions are treated as strictly confidential.
How long does an investigation take?
The Screening report is typically delivered within 24 hours. The full Investigation report is delivered within 48 hours. Complex or multi-address cases are quoted individually and may take longer — we will always give you an estimated delivery date before you commit.
Is my information kept confidential?
Yes. All case information is treated as strictly confidential. We do not share client details or case information with third parties without your explicit consent, except where required by law. We recommend not including sensitive personal details in initial enquiries — a wallet address and brief context is sufficient to begin.

Start your investigation

Tell us about your case and we will respond within a few hours to confirm whether we can help and provide a fixed quote.

What happens next

Complete the form and we will review your case within a few hours. We will confirm whether we can help, provide a fixed quote, and answer any questions before you commit to anything.

enquiries@kestrelforensics.com
Response within a few hours (business days)
UK-based, international cases accepted

Our commitment to you

  • Free initial assessment — no charge until you approve the quote
  • Fixed pricing — no surprises or hourly billing
  • If we cannot help, we will tell you upfront
  • All enquiries treated as strictly confidential
  • Plain English throughout — no unnecessary jargon

Enquiry form

By submitting this form you agree to your details being used to respond to your enquiry. We do not share your information with third parties. All case details are treated as strictly confidential.

Crypto fraud & forensics insights

Practical guides for fraud victims, law firms, and businesses navigating cryptocurrency investigations.

View all articles  →