You will get Crypto Hack Investigation & Action Plan
Project details
I specialize in crypto asset tracing and evidentiary reports for real victims—not just law firms. I’ll take your incident from “I have TX IDs and screenshots” to a clear, organized case file you can submit to the FBI (IC3), CFTC, exchanges, or your attorney.
In this project I will:
Review your incident and key wallet / transaction data
Perform a full on-chain trace (wallets, hops, exchanges, mixers, bridges)
Identify likely targets: exchanges, counterparties, and off-ramps
Deliver a PDF report with visuals, timeline, and findings in plain English
Draft suggested wording for your FBI IC3 and CFTC complaints
Include email templates you can send to exchanges/platforms
Walk you through the results and next steps on a Zoom call
I cannot guarantee fund recovery or law-enforcement action, and I don’t provide legal advice—but I give you professional, investigation-grade documentation and a clear path forward.
Thinking
In this project I will:
Review your incident and key wallet / transaction data
Perform a full on-chain trace (wallets, hops, exchanges, mixers, bridges)
Identify likely targets: exchanges, counterparties, and off-ramps
Deliver a PDF report with visuals, timeline, and findings in plain English
Draft suggested wording for your FBI IC3 and CFTC complaints
Include email templates you can send to exchanges/platforms
Walk you through the results and next steps on a Zoom call
I cannot guarantee fund recovery or law-enforcement action, and I don’t provide legal advice—but I give you professional, investigation-grade documentation and a clear path forward.
Thinking
Programming Language
Java, Python, TypeScriptWhat's included $1,000
These options are included with the project scope.
$1,000
- Delivery Time 5 days
- Number of Revisions 1
Optional add-ons
You can add these on the next page.
Additional Revision
+$75
2 reviews
(2)
(0)
(0)
(0)
(0)
This project doesn't have any reviews.
MW
Mike W.
Nov 3, 2025
30 minute consultation
Sean Michael know his stuff
RC
Rama C.
Nov 3, 2025
30 minute consultation
About Sean
Crypto Forensics / Asset Recovery / Crypto Trading
100%
Job Success
Miami Beach, United States - 11:58 am local time
Crypto forensics investigator focused on cross-chain asset tracing and court-ready evidence. I map flows across DEXes, bridges, mixers, and CEX off-ramps, then deliver clear exhibits, timelines, and subpoena/preservation targets that judges and attorneys can use immediately.
On Upwork I support law firms (divorce/fraud/IP), receivers/trustees, and corporate/HNW clients. I work fast: 48-hour triage to confirm feasibility and prevent dissipation; 5–7 day sprints for deeper investigations; and expert reports/testimony when needed.
My workflow includes entity attribution + OSINT, deterministic exports, SHA-256 hashing, and chain-of-custody throughout. Tool-agnostic and partner-friendly: experienced with Chainalysis/TRM/Elliptic, plus GraphSense, Bitquery, and on-chain explorers (Etherscan, Solscan, Mempool, Tronscan).
If you need to prove the flow fast—and in a format courts will accept—I can help.
Conduct end-to-end blockchain asset tracing across EVM and non-EVM chains; reconstruct DEX→bridge→mixer paths to KYC off-ramps.
Deliver judge-ready exhibits: flow diagrams, timelines, holdings tables, and subpoena/preservation target lists aligned to legal strategy.
Run 48-hour triage to assess feasibility, identify likely off-ramps, and prevent dissipation; escalate to 5–7 day sprints for full cases. Apply OSINT and entity attribution to cluster wallets, link exchanges/vasps, and surface counterparties. Produce expert declarations and support counsel for depos/trial as needed. Implement evidence integrity: deterministic exports, SHA-256 hashing, tamper-evident archives, and chain-of-custody.
Standardize work via SOPs; collaborate with attorneys and receivers on preservation letters and exchange outreach.
Tooling: Chainalysis Reactor / TRM Forensics / Elliptic (as licensed); GraphSense, Bitquery, and explorers (Etherscan, Solscan, Tronscan, Mempool).
Case types: divorce asset discovery, fraud/theft, compromise incidents, sanctions/AML exposure, receivership estate mapping.
Built a partner-friendly investigation practice with SLAs (Triage ≤48h; Sprint 5–7d), white-label capacity, and court-ready deliverables.
Created productized services: WalletWatch, ChainSight, BridgeGuard, FlowProof, ExitGuard with clear scopes and timelines.
Divorce asset discovery (multi-chain): Clustered wallets, mapped DEX→bridge flows to CEX; identified subpoena targets; supported settlement leverage. Outcome: *[e.g., undisclosed holdings identified; preservation initiated].
Theft response (CeFi exit): Traced exploit proceeds through mixer peel chains; tied to [exchange] accounts; coordinated preservation letters. Outcome: *[e.g., flagged accounts; recovery pathway defined].
Receivership estate mapping: Built holdings & flow tables across ETH/BTC/TRON; produced timeline exhibits and affidavit-ready appendix. Outcome: *[e.g., consolidated view for clawback].
Sanctions/AML exposure check: Screened counterparties/bridges; documented risk narrative and remediation steps. Outcome: *[e.g., cleared path for transaction / escalated findings].
Skills
Blockchain forensics; Crypto investigations; Cross-chain tracing; DeFi/DEX analysis; Bridge/mixer heuristics; Entity attribution; OSINT; Subpoena/preservation targets; Evidence handling; SHA-256 hashing; Chain-of-custody; Timeline/exhibit creation; Expert reports/testimony; Chainalysis Reactor; TRM Forensics; Elliptic; GraphSense; Bitquery; Etherscan/Solscan/Tronscan/Mempool; CSV/Excel; Python basics for data cleanup; Legal collaboration; Client communication.
Certifications
Chainalysis Reactor Certification (CRC) — In progress
TRM Academy: Foundations / Forensics — In progress
Steps for completing your project
After purchasing the project, send requirements so Sean can start the project.
Delivery time starts when Sean receives requirements from you.
Sean works on your project following the steps below.
Revisions may occur after the delivery date.
Step 1 – Intake & Scope Confirm (Day 0)
Client submits incident description, wallet addresses/txids, screenshots, and any exchange info. I review quickly, confirm that the case is in scope, and lock the delivery date.
Step 2 – Full On-Chain Investigation (Day 1–2)
I trace the hacked funds, map key hops, identify exchanges/mixers/bridges and likely off-ramps, and compile evidence. I draft suggested wording for FBI IC3, CFTC, and emails to exchanges/platforms.