From your first message to your money back.
Every case we take on follows the same four steps, in the same order. No jargon, no mystery, no surprises — just a clear path from the day you reach out to the day funds land back in your account. Here’s exactly what we do, when we do it, and what you’ll hear from us along the way.
A process is the only thing that holds up under pressure.
When a six-figure loss is on the table, “trust us” isn’t a methodology. So we wrote ours down. Every Cryptoblackbird case follows the same four stages in the same order, with the same outputs at each step. You always know where your case is, what we just confirmed, and what we’re waiting on next.
Some cases finish in eleven days. Some take seven months. The discipline is the same either way.
Four stages, one straight line.
Tap any stage to skip ahead, or read top-to-bottom for the full walk-through.
You file a report. We open a confidential case file within 24 hours and assign a lead investigator out of Addison.
We verify your loss vector — wallet, exchange, or scam broker — and lock the chain-of-custody on every relevant address.
Our analysts follow the funds across chains, mixers, and off-ramps. You get weekly intelligence reports until we ground them.
We engage exchanges, regulators, and counsel where assets are recoverable. You only pay performance-based fees on what comes back.
A case file gets opened.
You file a Signal through the form, by email, or through the anonymous Black Box. Within one business day, a lead investigator reaches you with a confidential case ID and a one-line scope assessment: in scope, borderline, or not realistically recoverable.
If your case is in scope, we send a short engagement letter spelling out what we’ll do and what the performance fee structure looks like. There is no retainer to file. There is no charge to assess. If you choose not to proceed after the assessment, we close the file with no obligation.
We move fast at this stage because most of the recovery window is decided in the first 72 hours. The further funds get from the original scam wallet, the harder they are to bring back.
“The first 72 hours decide most of what’s recoverable. After that, we’re working harder for less.”
— LEAD INVESTIGATOR, OUR TEAM
We pin down the loss vector.
Within the first week, we confirm exactly how the funds left your control. That means the originating wallet, the recipient address (or addresses), the chain, the transaction hashes, the timing, and the fingerprints of how the operator runs their setup.
This is the “chain-of-custody” phase. We document every hop, every bridge, every swap. The output is a packet that holds up under exchange compliance review and, where applicable, in front of a court. Without a clean chain-of-custody, no exchange will freeze a wallet for you and no regulator will return a filing.
We also classify the operator pattern. Is this a recognized broker brand? A wallet drainer template we’ve seen before? A romance-investment hybrid? Pattern-matching against our case-file archive often saves weeks — the operator’s past behavior tells us where the funds are likely to be by now.
Six tools, three monitored chains, one mempool relay.
The on-chain layer is where the work actually lives. Our analysts run a stack of in-house and commercial tracing tools simultaneously, cross-checking results so a single tool’s blind spot doesn’t cost you a recovery.
It looks unglamorous. Most of an analyst’s day is spent labeling addresses, watching wallets for movement, and writing notes that other team members will read three weeks later when the case picks back up.
We follow the money to where it actually went.
Stage three is where the depth comes in. Funds rarely sit still — they move through mixers, jump bridges, swap into stablecoins, get split across dozens of intermediate wallets, and eventually hit an off-ramp. Our job is to follow them all the way to the off-ramp and document every step.
You receive a written intelligence report at the end of every week the case is active. It covers what we found, what we’re still pursuing, and what we ruled out. The report is written in plain English by the lead investigator on your case — not auto-generated, not boilerplate. If you want the technical address graph alongside, we attach it.
This stage runs as long as the trace is productive. Some cases unlock the off-ramp in week two. Some take three months of patient watching. We tell you which we think yours is at the start of stage three, and we update that estimate every Friday.
“You don’t need a hundred-page deck. You need to know where your money is, in plain English, every Friday.”
— CASE FILE 0257 CLIENT, ADDISON
We turn intelligence into a wire-back.
The trace tells us where the funds are. The recovery action tells us how to get them back. Depending on the case, that means engaging exchange compliance teams with a documented chain-of-custody packet, supporting regulator filings (FBI IC3, FTC, CFTC, FinCEN, state AG offices, and international counterparts), or referring the matter to civil counsel for an injunction.
We do not move funds on your behalf, and we do not take custody at any point. The wire-back, when it happens, lands in your bank account or your designated exchange account directly — not through us. Performance fees apply only to amounts that actually return, and they’re billed after the funds clear.
If the trace ends at a non-cooperative jurisdiction or an off-ramp we can’t reach, we say so. We don’t bill for the chase that goes nowhere. The closing letter explains exactly what we did, what we found, and what your remaining options are — including filings you can do yourself with the documentation we’ve assembled.
What to expect, week by week.
No two cases run the same, but most fall on a recognizable curve. Here’s the rough rhythm so you know what’s normal.
Open & lock.
Stages 1 & 2. Case ID, scope assessment, chain-of-custody packet drafted, operator pattern classified. You’ll know within seven days whether recovery is realistic.
Trace & pursue.
Stage 3. Weekly intelligence reports every Friday. Address-graph updates, off-ramp candidates, exchange exposure estimates. Most active cases close in this window.
Recover or close.
Stage 4. Exchange engagement, regulator filings, civil counsel coordination, and the wire-back. Or, if the trace is dead-ended, an honest closing letter so you can move on.
What lands in your inbox every Friday.
Your weekly intelligence report — written by the lead investigator on your case, not auto-generated.
SUBJECT — Tracing update, week of Mar 4-8
Status: Active. Funds confirmed at off-ramp candidate (tier-2 exchange, KYC’d).
This week: Tracked the consolidator wallet (0x9A…c4e3) through a Stargate bridge to Tron, then via three intermediate hops to a known operator address. The address has prior deposit activity at Exchange-X. We submitted a documented freeze packet on Wednesday; awaiting compliance team response (typical SLA: 5-10 business days).
Next week: Continue monitoring the wallet for movement. If freeze is granted, we’ll engage counsel for KYC unmasking petition. If declined, we’ll pivot to an alternate off-ramp candidate identified earlier this week.
Recovery probability: Updated to 60-75% (was 50-65% last week). Off-ramp at a cooperative exchange improves the picture materially.
Action requested from you: None this week. We’ll reach out if the freeze is granted — counsel will need a quick signed declaration from you.
— Lead investigator, team, Addison TX
EXAMPLE FORMAT · ACTUAL CASE-FILE DETAILS REDACTED
How we get paid.
Performance-based. Transparent. Agreed in writing before we engage.
Intake & assessment.
Filing a Signal, the scope assessment, the first week of tracing, and a closing letter if the case is unrecoverable — all at no charge. We pay our analysts to find out whether your case is workable.
Performance fees.
Tiered against recovered funds. Smaller recoveries (sub-$100K) sit at the higher end of the range; larger recoveries scale down. Exact percentages are spelled out in the engagement letter before any work past stage one.
Pass-through costs.
If a case requires civil counsel, court filings, or expert-witness time, those are billed at cost with your written approval first. We don’t mark them up. We don’t front-load them.
Questions we hear most often.
Will you ask for my seed phrase or private keys?
Never. Not for any reason. Anyone asking for them — including someone claiming to represent us — is running a recovery scam. Forward the message and we’ll add the operator to the watchlist.
How realistic are the recovery odds?
It depends on the case. The honest range across our case files is 0% (untraceable) to 95%+ (caught early at a cooperative exchange). We’ll give you a probability range at the end of stage two, and we update it every Friday during stage three.
What if my case is unrecoverable?
We tell you, in writing, before you commit. If we discover unrecoverability mid-trace, we send a closing letter with everything we found and refund any work we hadn’t yet earned. We don’t bill for chases that go nowhere.
Do you take custody of my funds at any point?
No. The wire-back, when it happens, lands directly in your bank account or your designated exchange account. We never custody, transfer, or hold client funds.
How long does a case typically take?
Eleven days at the fast end, seven months at the slow end. Most active recoveries close inside twelve weeks. SIM-swap and quick-reaction cases (where we’re engaged within hours of the loss) are typically faster; ICO and Ponzi cases are typically longer.
What chains do you trace?
Bitcoin, Ethereum and EVM-compatible chains (BNB, Polygon, Arbitrum, Optimism, Base), Tron, and Solana, plus the major bridges between them. If your case involves a chain we don’t actively trace, we’ll say so up front.
Is anything I send you confidential?
Yes. Case details stay inside our team. We disclose only when legally required, or when you explicitly authorize us to engage exchanges, regulators, or counsel on your behalf.
Open a case. We’ll be reading by tomorrow.
Filing the Signal is free, the assessment is free, and you’ll know within one business day whether we think your case is workable.