Specialisms
The wallet is empty, or the platform will not allow the payout.
With crypto assets, what is otherwise separate coincides: the asset itself is access to it. Whoever holds the keys disposes of it – without an institution that could reverse a booking. That makes tracing technically possible and recovery legally difficult, because it presupposes that the funds surface at a point where someone is identifiable.
Circumstances
Clarify the context
Evidence
Preserve documents
Deadlines
Explain any urgency
Approach
Discuss the next steps
Immediate steps
What to do now
The sequence here differs from other patterns: first further outflow is stopped, then the transaction chain is secured, before accounts are deleted or applications removed.
Move remaining holdings to safety
If a wallet is affected, transfer remaining balances to a newly created wallet on a clean device. Do not continue to use the compromised recovery phrase – anyone who knows it has lasting access, regardless of which application you use.
Revoke approvals that have been granted
Check the contract approvals granted for your address and withdraw those that you did not grant consciously and in a limited way. An existing unlimited approval continues to operate and enables further outflows, even if you never visit the site in question again.
Do not make any further deposit for an unlock
Do not pay any tax, fee or verification so that a displayed balance is paid out. These demands do not end with the first payment. A genuinely existing balance would be offset against the costs, not demanded separately in advance.
Document the complete transaction chain
For every payment note the transaction number, the sender and recipient addresses, date, time, amount and the application or platform used. Add recordings of the account overview, the withdrawal requests and the chat histories before access is blocked.
Trace the original fiat deposit
Record via which bank account, which card and which trading venue the funds were originally acquired. This point at the beginning of the chain is frequently the only one at which a supervised company was involved, and is therefore of significance for later information requests.
File a criminal complaint and inform the trading venue
File a criminal complaint stating the transaction numbers and also report the matter to the trading venue involved. Some platforms can mark addresses or halt payouts if marked funds reach them – that cannot be promised.
Contact & appointments
Switzerland
Zürich
United Kingdom
London
Estonia
+372 6 288 2000
France
+33 2 04 26 81 82
Netherlands
+31 970 102 51606
Germany
+49 30 41733313
WhatsAppMessage us directly
Send a WhatsApp messageOverview
The recurring situations
The most frequent variant is the platform that does not pay out. After deposits, an interface shows profits, smaller withdrawals work, and at the larger amount taxes, fees or a verification are demanded. A second variant is the exit scam: a project, a fund or a trading venue ceases operations, accounts are no longer reachable, and the deposited funds were withdrawn beforehand. A third concerns immediate access to a wallet – via a captured recovery phrase, a manipulated application or a carelessly granted approval for a contract that then empties the balance.
Technically, the movements on public networks are traceable: every transaction is visible, and chains can be followed across many stations. In practice that is only the first step, because an address is not a name. It becomes attributable only where crypto assets are exchanged into official currencies or where a trading venue has checked its customers. That is precisely why the perpetrators work with intermediate stations, exchange services and the splitting into many small amounts.
Legally, an unfamiliar situation follows from that. There is no body that can reverse a booking, and no payment service provider that would have to examine a reimbursement. Points of attack arise where a supervised trading venue is involved, where an identifiable person stands behind an address, or where the deposit originally took place via a bank account. Whether such a connecting point exists in the specific case becomes clear only after evaluation of the transaction chain.
Recognising the signs
How the pattern becomes recognisable
The following points appear in almost all cases that reach us – usually several at once and in this sequence.
- You are supposed to enter your recovery phrase or your private key in order to verify, synchronise or unlock an account.
- An application demands an unlimited approval for your holdings so that a process can supposedly be executed.
- A first small withdrawal request is fulfilled, a larger one remains stuck.
- Before the payout, taxes, exchange fees or a verification are demanded that cannot be offset against the balance.
- The deposit address changes with every payment, or you are first supposed to send to a private wallet address.
- The support runs through a messenger contact who presses for returns, and not through the documented support of the trading venue.
- The account is blocked as soon as you demand a payout, and the block is justified with an examination by a supervisory body.
Possible measures
Possible measures
What comes into consideration depends on whether the chain ends at an identifiable point. We examine that first, before we advise further steps.
Evaluation of the transaction chain
We work with specialised service providers who can trace movements across several stations. The aim is not complete clarification, but the question of whether the funds have arrived at a trading venue with customer due diligence.
Information and preservation requests to trading venues
If the chain ends at a supervised company, information and preservation requests may come into consideration. Such applications are urgent and are regularly filed at the company’s seat by locally admitted practitioners, whose involvement we coordinate.
Examining claims at the beginning of the chain
If the acquisition was processed via a bank account or a card, it may need to be examined whether duties were breached there or a chargeback procedure remains open. That depends on the payment route and the timeline.
Criminal complaint with a technically prepared statement of facts
We prepare the transaction data so that investigating authorities can attach to them. Investigating authorities have access possibilities vis-à-vis trading venues that are not open to private individuals.
Bundling with other persons affected
In exit scams and platforms that do not pay out, a large number of people are affected. A bundled presentation can improve the prospect that proceedings will be conducted, and reduces the effort for the individual.
Review of follow-up offers
Alleged “wallet rescuers” and recovery services specifically approach those who have suffered a loss and demand advance payment or access to your keys. We review such contacts before you respond; no one can promise a result against advance payment.
Prospects
What is realistic with crypto assets
A transaction on a public network cannot be reversed. Whether something can nonetheless be returned depends entirely on where the funds went and who holds them today – specifically, whether they have arrived at a trading venue that checks its customers, and whether a balance is still present there. No one can promise an outcome, not even with gapless tracing.
The time factor is particularly pronounced here. Funds are frequently split within hours, routed through exchange services and paid out. Preservation requests take effect in practice only as long as a balance still exists; this route closes quickly. What remains open longer is the evaluation of the chain, participation in investigations and the examination of possible claims at the beginning of the payment chain.
We say openly when a tracing exercise is recognisably leading nowhere, and then advise against further costs. What is legitimate at this point is only an honest assessment, not a promise. The overarching foundations on evidence preservation and payment tracing can be found in the Fraud & Scam practice area.
Frequently asked questions
Frequently asked questions on crypto cases
The answers describe the framework. What is possible in your case depends on the transaction chain and the companies involved.
Related specialisms
Patterns that often overlap
Fraud rarely follows just one pattern. If your case only partly matches, related specialisms may help you understand the connections.
Investment Fraud
Dubious return promises, trading portals and participation models – payment routes, information requests and possible claims.
Find out moreRomance scam
Feigned relationships with systematic demands for money – evidence preservation, payment tracing and discreet handling.
Find out moreInternational fraud
Cross-border constellations involving several legal systems – jurisdiction, applicable law and enforcement.
Find out more
Related information
Related information
- Fraud and scamsWhen fraud is suspected, payment routes, correspondence and timing are important starting points.
- Recognising signs of fraudUrgency, secrecy and extra payments before a promised withdrawal are recurring warning signs. A single feature does not replace examination of the facts.
- Fraud patterns at a glanceForged invoices, fabricated relationships and manipulated investment platforms follow different patterns. Explore how they work and possible next steps.
- Contact usDescribe your matter in a few sentences. Include only what is needed for the initial contact. Documents can be requested later through a suitable channel.
Contact
Describe your matter
An enquiry does not establish a client relationship or responsibility for monitoring deadlines. If a deadline is approaching, do not rely on this form alone.
- General information. The legal assessment depends on the circumstances of each case.