Skip to content
We never ask for private keys or passwords without a signed agreement. How to tell us from scammers
Request

AML compliance & investigations

Crypto Forensics

We trace stolen cryptocurrency and prepare documents for police, exchanges and lawyers.

  • Free assessment
  • Reply within 1–2 business days
  • Confidential, NDA
Submit a request

What happened?

Pick your situation — we’ll open the form with the right request type.

01

What we do

Our services

We handle thefts, freezes and lost seed phrase words. Every engagement starts with a free assessment — we do not take on work without one.

01

Stolen crypto tracing

We map the flow of funds and find the exchanges they reached.

Learn more 02

Crypto flow analysis

Where funds came from and went to, links to exchanges and mixers.

Learn more 03

Documents for law enforcement

Timeline, flow diagram, addresses and hashes for your report.

Learn more 04

Legal support in exchange disputes

Review of the freeze, a claim to the exchange, a regulator complaint.

Learn more 05

Frozen USDT on a wallet

We find out why it was frozen and draft an appeal to the issuer.

Learn more 06

Partial seed phrase recovery

We find the missing words when no more than 6 are lost.

Learn more

Case assessment is free

Don’t see your situation?

Describe it — we’ll tell you how we can help.

Submit a request
02

What you get

Documents you can actually act on

Our output is not promises but materials that investigators, exchange compliance teams and lawyers understand.

Live Trace · CTX-DEMO

Sample from a report

Sample graph from a report (illustration): addresses and amounts are fictional. Trace illustration: 25,000 USDT from your TRON wallet were split across two transit addresses. 3,000 USDT went into a mixer, 12,000 USDT crossed a bridge to Ethereum and 9,800 USDT went through a swap service. In total 21,800 USDT (87%) were found on an exchange deposit, where they can be frozen. 15,000 USDT 10,000 USDT 3,000 USDT 12,000 USDT 10,000 USDT 12,000 USDT 9,800 USDT YOUR WALLET TQx7…9fA2 TRON TRANSIT TJk3…81Qd TRON TRANSIT TMa9…c4Lp TRON MIXER TXm1…0aZq BRIDGE 0x8e…b04C SWAP SERVICE TWq5…7hYe UNTRACED — — — EXCHANGE DEPOSIT 0x4f2…e91B ETH CAN BE FROZEN FREEZE
  • Your wallet
  • Transit address
  • Mixer — risky path
  • Cross-chain bridge
  • Exchange — freeze point
  • Flow of funds
Sample graph from a report (illustration): addresses and amounts are fictional.
  • 01

    Transaction graph

    A visual map of fund movements from your address to end points: exchanges, services and wallets.

  • 02

    Incident timeline

    Events by date, from the first contact with the scammer to the last known transaction.

  • 03

    Address attribution

    Which addresses belong to exchanges, swaps, mixers and bridges — with sources.

  • 04

    Evidence package

    Address and hash lists, screenshots and appendices, formatted for reports and requests.

  • 05

    Action plan

    What to do next: who to contact, in which order and which deadlines matter.

Networks we cover:

  • Bitcoin
  • Ethereum
  • TRON
  • BNB Chain
  • Solana
  • TON
  • Polygon
  • Arbitrum
  • Base
  • Litecoin
  • Avalanche
  • Optimism
03

Common schemes

How crypto is most often stolen

Knowing the scheme helps us pick up the trail faster and describe the incident correctly in a report.

01

Phishing and fake sites

Clones of exchanges, wallets and “wallet validation” pages that lure out a seed phrase or a signature.

02

Drainers and malicious approvals

Signing a single transaction gives the attacker the right to move tokens out of your address.

03

Fake investment platforms

Your “profit” grows on screen, but withdrawal requires paying a “tax” or “insurance” first.

04

Romance scams

Weeks of trusted conversation, then an offer to “invest together” on a rigged platform.

05

Fake support

An “exchange employee” in a messenger asks for your seed, remote access or a transfer to a “safe” address.

06

Recovery scams

Victims get scammed again: a guaranteed refund for an upfront fee. We never work that way.

Why you should act quickly

While funds sit on an exchange, they can be frozen at the request of law enforcement. The sooner the analysis starts and a report is filed, the better the odds.

04

How we work

Five steps

A transparent process: you always know where your case stands and what comes next.

Case assessment is free

  1. Step 1 01

    Request

    Describe your situation in the form or message us. Be sure to include wallet addresses and transaction hashes — without source data no analysis is possible.

    • Website form, Telegram or email
    • No seed phrases or passwords
  2. Step 2 02

    Free assessment

    A specialist reviews the data, asks follow-up questions and gives an honest view of the prospects.

    • Usually 1–2 business days
    • We’ll tell you if there’s no chance
  3. Step 3 03

    Contract

    We fix the scope, timeline, cost and confidentiality terms.

    • Fixed fee or percentage
    • Non-disclosure agreement
  4. Step 4 04

    Work

    We run the analysis, prepare documents and handle correspondence — keeping you updated at every stage.

    • Interim reports
    • One dedicated specialist
  5. Step 5 05

    Report and result

    We hand over the report, transaction graph and document package, and explain how to use them next.

    • Documents in a usable format
    • Recommendations on next steps

Timing

Timelines are individual and can range from 1 day to 1 year or more, depending on complexity.

05

Pricing and timing

Fair terms after a free assessment

Cost depends on the situation. We share exact terms after a free assessment — you pay nothing before that.

01

Fixed fee

For tasks with a clear scope: AML address screening, a fund-flow report, a police document package, a claim to an exchange.

02

Percentage

For tasks where the result is directly tied to recovering funds or access: partial seed phrase recovery, support through to unfreezing.

0 $

Free assessment

We review the data and tell you honestly about the prospects before any contract.

Submit a request

What affects the cost

  • Number of addresses, networks and transactions
  • Route complexity: mixers, bridges, swaps
  • Volume of documents and correspondence
  • Urgency

Be careful with anyone who guarantees recovery for an upfront fee — it’s a common re-victimisation scheme.

06

Fraud warning

«We never ask for private keys or passwords without a signed agreement.»

Victims of crypto theft are often targeted again. Here is how to tell us apart from scammers.

Learn more

We never

  • Ask for private keys, seed phrases or passwords without a contract — and even then only over a secure channel.
  • Contact you first on social media or messengers offering to “recover funds”.
  • Guarantee recovery or charge “insurance” on withdrawals.
  • Ask you to send crypto to “verify” a wallet.
  • Ask you to install remote-access software.
07

Questions

Frequently asked questions

Didn’t find an answer? Write to us — we reply during business hours.

What is Catenorix?

A US-registered company working in AML compliance and blockchain investigations: we trace stolen crypto, prepare documents for law enforcement and exchanges, and help recover lost words of a seed phrase.

Is the assessment really free?

Yes. We review your case and tell you honestly about the prospects before any contract. Payment is discussed only if you decide to proceed.

Do you guarantee recovery?

No. Nobody can honestly guarantee recovery: funds are frozen and returned by exchanges and law enforcement. We do everything to give them the grounds and the evidence to act.

How do you protect my data?

Only the specialists working on your case have access. Confidentiality terms are set in the contract. We don’t share data with third parties without your consent, except where required by law.

Can crypto be traced?

Yes: transactions on most blockchains are public. We rebuild the chain of transfers and identify which addresses belong to exchanges and services. But tracing is not the same as recovering.

What if funds went through a mixer or bridge?

It complicates the analysis and lowers the odds, but doesn’t always break the trail. We’ll assess this during the free assessment.

Should I file a police report?

Yes, we recommend doing it as early as possible. Exchanges usually freeze funds at the request of law enforcement, and our report supports the investigation.

An exchange froze my account. What should I do?

Don’t open new accounts or try to bypass the freeze. Keep your support correspondence and transaction history — and describe the situation to us.

Will you log in to my exchange account?

No. We don’t need access to your account. We prepare all the documents, and you or your lawyer send them.

How long does unfreezing take?

From a few days to several months — it depends on the exchange, the reason for the freeze and how complete the documents are.

Can a seed phrase be recovered if I remember some words?

Yes, if no more than 6 words are missing and the remaining words and the wallet address are known. The more words are missing and the less is known about their positions, the longer the search. We only work with wallets whose ownership has been proven.

Can a wallet be restored without the seed phrase?

No. If the whole seed phrase is lost, it cannot be guessed or “hacked” — nobody can do that. Anyone promising such a recovery is most likely a scammer.

Why do you ask for proof of ownership?

So we never help attackers. We only work with people who have proven that the wallet and funds belong to them.

Get started

Describe your case

Fill in a short form — a specialist will review the details and get in touch. The assessment is free and non-binding.

Submit a request
Message us on Telegram Email us at Email