You met someone online or were approached on a messaging app. Over weeks or months they earned your trust, then introduced you to an investment opportunity that looked legitimate, that showed real-looking gains in a real-looking dashboard, and that started by accepting small deposits before scaling to your retirement, savings, or home-equity funds.
When you tried to withdraw, the platform demanded fees, then taxes, then a recovery deposit. Then it went silent.
Or you wired crypto to what you believed was a legitimate broker, exchange, or DeFi platform, and the wallet you sent it to turned out to be controlled by a criminal organization.
The amounts involved typically run from tens of thousands to several million dollars per case. This is the moment we step in.
Important. We do not recover funds directly. We deliver forensic investigation, evidence preservation, and coordination with licensed asset-recovery partners.
The recovery industry is full of operators who promise recovery and either do nothing or are themselves running a second-round recovery scam targeting victims who have already been scammed once.
Our work is the honest version of this: forensic case-file production at hourly rates, no fees contingent on recovery, and the explicit acknowledgement that fund recovery is controlled by law enforcement, licensed counsel, and the cooperation of receiving exchanges, not by us.
Quinnlan Varcoe, Founder and CEO, oversees every crypto scam recovery engagement and reviews every case before findings leave the practice. The practitioner team executes the technical work.
Engagements are confidential, NDA-protected, and structured to begin within 48 hours of the consultation. Pricing is hourly at $400 per hour, the same standardized rate every SleuthX engagement bills at, including expert witness. The alternative is a done-for-you device package from $3,000, each including the $995 lifetime license. Optional fixed-fee tracks for well-bounded scope and sliding-scale pricing for survivors who lost retirement or savings funds are available on the first call.
What this is
A forensic crypto scam recovery engagement produces the documented evidentiary record that the FBI Internet Crime Complaint Center, the FBI Cyber Division and Secret Service Cyber Fraud Task Force, your state attorney general, the IRS for Form 4684 and Schedule A theft-loss documentation, your cyber and crime insurance carrier, civil counsel pursuing recoverable defendants, licensed asset-recovery partners, and where applicable, plaintiff trial counsel can act on.
The investigation traces the social-engineering pattern that originated the scam (the contact vector, the persona, the trust-building methodology, the platform that received the funds), preserves the wallet and transaction-hash documentation, coordinates with specialist blockchain-tracing partners for the on-chain analytical work, identifies the off-ramp jurisdictions and exchanges where the funds came to rest, and produces a written report structured for the specific recovery and prosecution pathways that apply.
Who this is for
- Pig-butchering victims who were romanced or befriended online over weeks or months and were progressively induced to deposit crypto into a fake investment platform. This is the highest-volume crypto-scam vector and pairs with our romance scam investigation service.
- Investment-scam victims who sent Bitcoin or other tokens to fake exchanges, fake brokers, fake DeFi platforms, fake ICOs, or fake yield products on the basis of a sustained social-engineering pretext that did not involve a romantic relationship.
- Wire-then-crypto scam victims who wired traditional currency to a third party who then converted it to crypto and moved it through criminal-controlled wallets, where the recovery analysis spans both wire-fraud and crypto-fraud forensics.
- Family members and adult children whose elderly relative was the target of a crypto investment scam and where elder-fraud forensics needs to be combined with crypto-loss documentation in a single engagement.
- Attorneys representing crypto-scam victims who need a forensic partner producing FRE 901 / 902(13) / 902(14) compliant electronic evidence and coordination with licensed asset-recovery partners and blockchain-tracing specialists.
How the engagement works
- Free confidential consultation by phone or video. NDA-protected. 30 to 60 minutes. Direct conversation with Quinn, the founder and CEO who oversees every engagement. We hear the timeline, identify the recovery and prosecution pathways that may apply (IC3 and law-enforcement referral, IRS theft-loss documentation, civil suit against recoverable defendants, asset-recovery partner introduction), and tell you whether forensic investigation will materially help in your case.
- Scoped engagement with a written proposal and pricing. Fixed-fee where scope allows; hourly with milestone caps for open-ended cases. Sliding-scale options on the table on the first call for survivors with significant financial loss.
- Forensic acquisition of relevant artifacts. The full communication thread with the scammer (chat logs, voice notes, screenshots, video calls), the platform's account interface (where still accessible), wallet addresses and transaction hashes for every deposit and any subsequent fee or recovery payment, banking records for any fiat-to-crypto conversion, mobile devices that hosted the messaging and trading apps, and any documentary records of the scammer's claimed identity, employer, or location.
- Investigation and reconstruction. Social-engineering timeline of how the scam developed, persona and infrastructure analysis on the scammer's identity, fake-platform attribution (domain registration, hosting infrastructure, payment-rail off-ramps), wallet documentation and transaction-hash chain-of-custody, coordination with specialist blockchain-tracing partners for the on-chain analytical work, and identification of the off-ramp jurisdictions and exchanges where the funds came to rest.
- Written report to court-admissible standards, structured for the specific pathways that apply: FBI IC3 and Cyber Division referral, state attorney general consumer-protection complaint, IRS Form 4684 and Schedule A theft-loss documentation, cyber and crime insurance claim, civil action against recoverable defendants, and licensed asset-recovery partner evidence package.
- Coordination with licensed asset-recovery partners (introduction, evidence handoff, ongoing forensic support), blockchain-tracing specialist firms, federal and state law enforcement, your CPA or tax attorney for the IRS theft-loss filing, civil counsel, and where applicable, the cooperative platform or exchange where funds came to rest.
How we work a crypto-scam case
- Written scope before any work. You see a written scope covering deliverables, timeline, and price, and you approve it before we begin. You are never billed for work you did not authorize.
- We commit to findings, not outcomes. We tell you up front what the evidence can and cannot establish. Recovery, attribution, and prosecution are decided by banks, platforms, insurers, and courts. We produce the record they act on, and we put that distinction in writing.
- Every case is investigated, not just scanned. A credentialed examiner reviews every case before findings leave the practice. You get a documented investigation to court-admissible standards, not a single automated scan and a one-line answer.
- We will tell you if you do not need us. If a free or simpler step would resolve your situation, whether a police report, an IC3 filing, or a platform's own recovery flow, we point you there first.
- No fees contingent on recovery. We charge for the forensic and coordination work at standard rates, never a percentage of funds recovered. A contingent fee aligns an operator with overpromising, and it is the structural marker of the recovery-scam ecosystem we exist to be the alternative to. Asset recovery itself is the domain of licensed counsel, law-enforcement seizure, and exchange cooperation; we coordinate the introduction and provide the evidence package.
Pig butchering is the dominant pattern in 2026
The FBI IC3 2023 report logged $3.96 billion in losses to pig-butchering and confidence-investment scams, with the volume continuing to climb in subsequent reporting periods.
Pig butchering is functionally one operation with two surfaces: a romance-scam social-engineering pretext that builds trust over weeks or months, followed by progressive crypto deposits into a fake investment platform that displays fictitious gains until the victim attempts to withdraw and the platform demands escalating fees.
Victim demographics are broad (adults of every age and background) but the highest-loss cases concentrate among professionals in their forties through sixties with retirement assets to deploy.
The forensic methodology integrates the romance-scam communication forensics with the crypto-loss documentation in a single engagement, and the case file produced supports both criminal referral and the IRS theft-loss documentation that recovers a meaningful portion of the loss through tax treatment when other recovery pathways do not.
Related SleuthX services
- Pig butchering scam investigation: dedicated forensic methodology for sha zhu pan cases combining romance-pretext and fake-platform investment scams. The dominant crypto-scam vector for individual victims at $4.4B+ in 2023 US losses.
- Romance scam investigation: social-engineering forensics for romance-scam cases that did not include a crypto investment surface.
- SIM swap attack recovery: when the crypto loss followed a SIM swap that bypassed exchange-account MFA.
- Wire fraud recovery: when the loss involved a fiat wire converted to crypto downstream.
- Elder fraud investigation: when the targeted person is an older adult and the crypto scam was extracted under a sustained elder-targeting pretext.
- Identity theft investigation: when the crypto scam chain includes new-credit-line fraud or synthetic identity downstream.
- Digital forensics for attorneys: for civil-suit and expert-witness support in crypto-scam litigation.
- Digital forensics in Naples, FL: local forensic engagement.
