Asset recovery cases

Explore the tracing process, key evidence and documented asset returns.

  • Wallet theft
  • Cross-chain transfers
  • Asset returns

Featured case

Ethereum · Wallet theft

Tracing mixer activity and asset returns

Reviewing the transaction path and organizing on-chain evidence to support subsequent action.

Assets involved119.78 ETH
Return documentedRead case details
Illustrative fund path

Tracing mixer activity and asset returns

Assets involved
119.78 ETH
Resolution record
May 2026 Recovered
Case category
Ethereum

Case summary

The case record states that a phishing drainer caused the loss of 119.78 ETH, which later moved through a fixed-denomination mixer to Exchange D. Delta & Capital used demixing heuristics to organize withdrawal links, transaction paths, and the timeline. Partner counsel handled the necessary legal procedure and submitted materials to the relevant institutions. The platform and competent authorities independently decided any hold, freeze, and restitution; the case record states that 119.78 ETH was later returned to the victim.

Case profile

Forensic Agency 德尔泰 (Delta & Capital)
Stolen Assets 119.78 ETH
Chain Ledger Path Ethereum Single-Chain
Typologies Phishing drainer, fixed-denomination mixer pool, gas funder clustering, exchange attribution
Control Signals Shared Gas Funder Address providing initial gas to multiple withdrawal addresses

Fund path and forensic analysis

  1. Victim (ETH)
  2. Drainer Address
  3. Mixer Deposits
  4. Mixer Withdrawals
  5. Peel chain hops
  6. Exchange D Deposit Address

Probabilistic Demixing Model

While mixers sever direct links, we structured a probabilistic model analyzing denomination matches, deposit-withdrawal windows, and shared gas-payers. By clustering withdrawals based on shared gas sources, we grouped independent addresses back into a single malicious entity.

Transaction risk review (KYT)

Hop Interaction Laundering Indicators Risk Level
Hop 1 Victim → Drainer address Unsigned asset transfer / phishing harvest (Drainer Harvest) HIGH
Hop 2 Deposit into Mixer M contract Interaction with sanctioned high-anonymity address (Mixer Deposit) CRITICAL
Hop 3 De-mixing model / Gas correlation Shared gas first-funding source clustering (Gas Funder Match) INFO / PROBABILITY
Hop 4 Layered peeling after withdrawal Multiple split transfers to obscure the trail (Peeling hops) HIGH
Hop 5 Exchange D deposit gateway Gateway off-ramp cash-out (VASP deposit entry) CRITICAL

Actions and outcome

  1. Demixing Report
  2. VASP Emergency Appeal
  3. VASP Account Locked (<96h)
  4. Seizure Warrant & Forfeiture
  5. Full Refund to Victim

Outcome Record: Since ETH lacks native blacklist triggers, we designed our search to lock the gateway entry. Exchange D locked the target account within 96 hours of our emergency filing. Following a 14-month legal process, the 119.78 ETH was fully refunded to the victim.

More recovery cases

BSC → TRON cross-chain fund tracing

BSC / TRON295,590 USDT

BSC → TRON cross-chain fund tracing

Assets involved
295,590 USDT
Resolution record
March 2026 Recovered
Case category
BSC / TRON

Case summary

The case record states that the victim transferred 295,590 USDT (BEP-20) in an investment scam and that the funds later moved through BNB Smart Chain, a cross-chain bridge, TRON, and an exchange deposit address. Delta & Capital reconstructed the loss record, transaction paths, and source-of-funds materials to support the victim's claim. Partner counsel handled legal procedures, while the relevant platform and authorities independently decided freezing, forfeiture, and restitution. The case record states that the funds were later returned to the victim.

Case profile

Forensic Agency 德尔泰 (Delta & Capital)
Stolen Assets 295,590 USDT
Chain Ledger Path BNB Smart Chain (BEP-20) → TRON (TRC-20)
Typologies Peel chain layering, cross-chain bridge, TRON activation clusters, VASP deposit attribution
Control Signals Shared TRON activation parent address & shared energy delegation source

Fund path and forensic analysis

  1. Victim (BSC)
  2. BSC Hops / Layering
  3. Bridge Lock
  4. Bridge Release
  5. TRON Consolidation Cluster
  6. Exchange A Deposit Address

Dual-Heuristic Lock

We combined TRON resource model finger-printing (shared activation and energy delegate) with cross-chain bridge reconciliation. Both distinct lines of evidence converged to target a single entity, elevating the attribution confidence to meet strict judicial evidence standards.

Transaction risk review (KYT)

Hop Interaction Laundering Indicators Risk Level
Hop 1 Victim → BSC consolidation Rapid consolidation of scam proceeds (Scam Consolidation) HIGH
Hop 2 Peel-chain layering on BSC Change-splitting to evade large-amount compliance alerts (Peel chain layering) HIGH
Hop 3 BSC → TRON cross-chain bridge Cross-ledger obfuscation path (Cross-ledger hopping) HIGH
Hop 4 TRON-side consolidation (shared energy/activation) Single-controller clustering fingerprints (Attribution finger-prints) INFO / FOCUS
Hop 5 Exchange A deposit gateway Off-ramp cash-out (VASP deposit entry) CRITICAL

Actions and outcome

  1. Delta Forensic Report
  2. Law Enforcement (FBI/IC3)
  3. Dual Freeze (Tether & VASP)
  4. Civil Forfeiture
  5. Full Refund to Victim

Outcome Record: Within 6 business days of report submission, Tether and Exchange A issued a freeze. Following civil forfeiture proceedings, the claim was resolved in favor of the victim. 295,590 USDT was returned in full to the victim's safe wallet. The entire process took approximately 12 months.

Tracing funds across multiple chains

Multi-chain108,743 USDT

Tracing funds across multiple chains

Assets involved
108,743 USDT
Resolution record
December 2025 Recovered
Case category
Multi-chain

Case summary

The case record states that the victim transferred 108,743 USDT to a fake arbitrage platform and that the funds later moved through DEX swaps, a cross-chain bridge, TRON, and Exchange C. Delta & Capital decoded the DEX routes and matched bridge Lock-Release events to organize the multi-ledger path. Partner counsel handled the necessary legal procedure. The issuer, exchange, and competent authorities independently decided freezing and restitution; the case record states that the funds were later returned to the victim.

Case profile

Forensic Agency 德尔泰 (Delta & Capital)
Stolen Assets 108,743 USDT
Chain Ledger Path EVM (BEP-20 / ERC-20) → TRON (TRC-20)
Typologies DEX multi-hop swap, chain-hopping, bridge lock-release matching, VASP deposit clustering
Control Signals Strict temporal & value reconciliation between EVM bridge burn and TRON bridge release events

Fund path and forensic analysis

  1. Victim (EVM)
  2. DEX Swap (USDT→wrapped)
  3. Bridge Lock
  4. Bridge Release
  5. Swap back to USDT
  6. Exchange C Deposit Address

Cross-Chain Event Reconciliation

Chain-hopping is designed to render single-chain tracers useless. We reconciled bridge events using automated scripts to match burn logs on EVM and release logs on TRON based on token value, transaction delays, and smart contract counterparties.

Transaction risk review (KYT)

Hop Interaction Laundering Indicators Risk Level
Hop 1 Victim → EVM receiving address Scam proceeds credited (Laundering Entry) HIGH
Hop 2 Multi-step DEX swaps Stripping stablecoin freezability; laundering the assets (Asset conversion) HIGH
Hop 3 EVM → TRON cross-chain bridge Cross-ledger obfuscation (Chain-hopping) HIGH
Hop 4 TRON-side swaps and consolidation Rebuilding stablecoin positions and re-consolidating (Re-consolidation) HIGH
Hop 5 Exchange C deposit gateway Off-ramp cash-out (VASP deposit entry) CRITICAL

Actions and outcome

  1. Cross-Chain Report
  2. Federal Case Filing
  3. Dual blacklisting & account locks
  4. Civil Forfeiture
  5. Full Refund to Victim

Outcome Record: Since the assets were reconverted to TRC-20 USDT, we leveraged both the contract blacklist and gateway locks. Dual-locks were executed within 7 business days. Following an 11-month international forfeiture case, the 108,743 USDT was returned in full to the victim.

TRON fund tracing and asset return

TRON327,684 USDT

TRON fund tracing and asset return

Assets involved
327,684 USDT
Resolution record
June 2025 Recovered
Case category
TRON

Case summary

The case record states that the victim transferred 327,684 USDT (TRC-20) in four batches and that the funds later moved through multiple sub-addresses, shared activation and energy nodes, peel-chain transfers, and Exchange B. Delta & Capital organized the transaction paths, address links, and technical materials. Partner counsel handled legal matters under the applicable procedure and submitted materials to the relevant institutions. Tether, the platform, and competent authorities independently decided whether to freeze, burn, reissue, or return assets; the case record states that the relevant funds were later returned to the victim.

Case profile

Forensic Agency 德尔泰 (Delta & Capital)
Stolen Assets 327,684 USDT
Chain Ledger Path TRON Single-Chain
Typologies Address activation clusters, energy delegate sharing, peel chain layering, haircut taint analysis
Control Signals All routing addresses shared a unique activation parent and shared a TRX resource delegate pool

Fund path and forensic analysis

  1. Victim (TRON)
  2. Scam Consolidation
  3. Peel Hop 1
  4. Peel Hop n (Shared parent)
  5. Exchange B Deposit Address

Taint Propagation Engine

In account-based ledgers, clean and illicit tokens mix. We implemented dual-attribute (haircut & FIFO) taint-propagation tracking to measure the pollution ratio at each peel hop, proving tracing continuity for small estrutured deposits.

Transaction risk review (KYT)

Hop Interaction Laundering Indicators Risk Level
Hop 1 Victim → initial consolidation Rapid aggregation of scam assets (Deposit Entry) HIGH
Hop 2 Peel-chain splitting Change-splitting to stay under AML thresholds (Peeling structuring) HIGH
Hop 3 Activation source + energy-proxy correlation Attributed to a single controller's fingerprints (Attribution finger-prints) INFO / FOCUS
Hop 4 Exchange B deposit gateway Off-ramp cash-out (VASP deposit entry) CRITICAL

Actions and outcome

  1. Delta Forensic Report
  2. Submit to Tether Limited
  3. Blacklist Freeze Action
  4. Burn & Reissue to Government
  5. Full Refund to Victim

Outcome Record: Leveraging Tether's blacklist-burn-reissue protocol, we assisted law enforcement in issuing a formal order. Tether blacklisted the address, burned the 327,684 USDT, and reissued it to the government custodial wallet. Funds were returned in full to the victim. The process completed in 6 months.

Cases are based on existing website records. Individual outcomes do not predict future results.

Facing a similar theft or scam?

On-chain tracing, address-label analysis, evidence organization and recovery support.

Submit a case for review