Blockchain evidence practice
Cryptocurrency Forensics for Federal, Enforcement and Civil Matters
Blockchain tracing, wallet forensics and exchange-record analysis documented for counsel and expert review in federal criminal, civil recovery, FinCEN and IRS-CI referrals and enterprise fraud matters.
The engagement
Reproducible ledger evidence with bounded attribution
Cryptocurrency evidence is public, permanent and easy to over-claim. The public ledger records transaction hashes, addresses and time-stamped blocks, but it does not record legal identity. Identity attribution comes from subpoenaed exchange records, seized wallet artifacts, endpoint forensics on the custodian's device and, occasionally, address-clustering heuristics whose error properties are not always well characterized on the record. A useful opinion states what the ledger evidence establishes on its own and where identity attribution depends on additional records.
Potential matters include federal criminal proceedings, civil recovery of stolen funds, FinCEN and IRS-CI referrals, sanctions and OFAC-related tracing, enterprise fraud analysis and bankruptcy trustees pursuing crypto assets. The report distinguishes on-chain evidence from off-chain evidence and states the methodology used to move from address to real-world identity.
Coverage across Bitcoin, Ethereum and major EVM chains, Solana, Tron, the Bitcoin Lightning Network, major stablecoins and privacy-oriented chains where the record allows meaningful tracing. Wallet-artifact examination covers seed-phrase and keystore recovery from seized devices, browser-extension wallets and mobile wallets, custodial-service audit exports and hardware wallet artifacts.
Scope
Blockchain tracing and transaction analysis
Independent tracing of funds across Bitcoin, Ethereum and major EVM chains, Solana, Tron and Bitcoin Lightning where the record supports it. Reproducible tracing paths documented by transaction hash and block height.
Wallet forensics
Analysis of seized wallets on Windows, macOS, Linux, iOS and Android, including seed-phrase and keystore recovery, browser-extension wallet artifacts (MetaMask, Phantom, others), mobile wallet application data and hardware-wallet companion-app data.
Exchange record analysis and subpoena support
Analysis of exchange-produced records: KYC verification packages, deposit and withdrawal history, IP and device attribution, sub-account structure and API-key activity. Written support for subpoena drafting where counsel requests it.
OFAC, sanctions and DeFi analysis
Sanctioned-address exposure analysis, mixer and bridge tracing where the underlying protocol supports it, and DeFi-protocol analysis for lending, DEX and yield-aggregator matters. Written statement of what the ledger record can and cannot establish about intent.
Address-clustering heuristics documentation
Written documentation of any address-clustering heuristic used, including the specific rule, the known error properties on the record and the alternative attributions the heuristic does not exclude. The report separates the heuristic from the tracing itself.
Expert testimony under FRE 702
Party-retained blockchain expert testimony for federal criminal and civil matters, including deposition, evidentiary hearing and trial testimony. Coverage of Daubert challenges on address clustering, mixer tracing and identity attribution.
Rebuttal and defense-side analysis
Independent analysis for defense in federal criminal matters where a government-side tracing report is at issue. Rebuttal declarations, cross-examination question sets and defense-side technical opinions on identity attribution.
Methodology
How a cryptocurrency forensics matter runs
-
Retention and case scope
Retention letter, conflict check across custodians and exchanges named in the matter, and a scope note stating the chains in scope, the addresses under examination and the review period.
-
Independent tracing
Tracing anchored to transaction hashes and block heights. Any clustering heuristic used is documented separately from the tracing itself. Alternative paths that the record does not exclude are identified.
-
Off-chain reconciliation
Reconciliation of on-chain tracing against exchange records, wallet artifacts and endpoint forensics. Attribution is stated only where the off-chain record supports it.
-
Report drafting and testimony
A written report separating on-chain evidence, off-chain evidence and the reasoning that ties them. Deposition and trial testimony bounded by the report.
Evidence commonly examined
Evidence reviewed
- Ledger records for the chains in scope, by transaction hash and block height
- Exchange-produced KYC, transaction, IP and device records
- Seized wallet artifacts from Windows, macOS, Linux, iOS and Android devices
- Custodial-service audit exports and cold-storage records
- Chain-analysis tool output with the specific version and rule set documented
- Opposing tracing report and workpapers
- Court orders, protective orders and any tracing-methodology stipulations
What you can expect
What you receive
- Written tracing report anchored to transaction hashes and block heights
- Address-attribution appendix stating on-chain versus off-chain evidence
- Wallet-artifact appendix stating recovery method and reproducibility
- Deposition and trial testimony bounded by the report
- Rebuttal declaration on an opposing tracing report where applicable
- Court-facing demonstratives sourced to the ledger and the exchange records
Frequently asked
Common questions
Are address-clustering heuristics accepted in federal court?
Admissibility is decided by the court. What can be documented is the heuristic itself, its error properties on the record, the alternative attributions it does not exclude and how it interacted with the tracing conclusion. The report treats the heuristic as evidence of a certain weight, not as identity.
Can you trace funds that moved through a mixer?
Where the mixer's design allows post-hoc analysis and where the record supplies the additional data the analysis needs, tracing across the mixer can be attempted. Where the design defeats analysis, the report says so and states what the record does and does not support downstream.
Do you work only with government referrals, or with private plaintiffs and defense as well?
The scope can support federal criminal defense, civil recovery, enterprise fraud, bankruptcy trustee work or enforcement referrals. A conflict check and authority review run before work begins.
How does chain-analysis tool output become admissible?
The tool output is one input, not the opinion. The report cites the specific tool version and rule set used, states the reasoning the examiner ran on top of the tool output and describes what the tool does and does not attempt to prove. Admissibility is decided by the court on the record actually offered.
Can you recover assets from a wallet where the seed was not preserved?
Access depends on documented authority and the artifacts that survived on the relevant devices. A keystore, browser-extension database or backup may support technical recovery, but GDF does not promise access, transfer assets or take custody of funds through the public intake process.
Related capabilities
Related services
Talk with an examiner
Discuss the matter and the next step.
Call to discuss timing, scope and the safest way to share information. Do not send evidence or credentials by email.
24/7 hotline: 1-800-868-8189