
Findings are reviewed and challenged before they're relied on.

Stage 03 of 04
This is where the trail is followed. Using blockchain analytics, open-source intelligence and forensic analysis, we build a verified picture of what happened and where the money went.
Overview
Depending on the case, the investigation may involve tracing cryptocurrency across wallets and chains, analysing the websites and infrastructure behind a scam, examining devices and accounts, or following bank and card payments.
Every finding is verified before it's relied on. Automated tools can suggest connections; an investigator confirms them. Where evidence is uncertain, we say so and explain how confident we are.
Throughout this stage you receive updates, and we'll raise anything time-sensitive immediately — for example, if funds are found at an exchange where a freeze request might be possible.
At the end of this stage
Verified trace map
Timing
Depends on complexity — the number of transactions, chains, platforms and devices involved.

Findings are reviewed and challenged before they're relied on.

Events are placed on a precise, verified timeline.

Every hop of the money is mapped.
Automated tools suggest; investigators verify. Every connection in our report is supported by evidence that someone else can check.
No, not without your explicit agreement. Contacting them can alert them and put evidence at risk.
We tell you immediately and help you prepare the evidence needed for a freeze request through the proper channels.

Confidential case review
Confidential case review
Your message is read by an investigator, not a sales team. We'll reply with an honest assessment of what can be done.
Have a question first? Read our FAQ →
Prefer email? info@gfirglobal.com