A crypto asset case, start to finish
A worked crypto asset tracing matter from first call to hearing: what happens in each week, what each stage costs, and the questions litigators ask before instructing.
A finance director is alleged to have moved company funds to a personal exchange account, converted them to Bitcoin and withdrawn to a private wallet before resigning. The firm holds bank statements showing three transfers to a UK exchange, a company laptop and the leaver's mailbox. This page sets out what happens next, what each stage costs and the questions litigators ask before instructing.
§ Timeline
What happens, and when
- Day 0, first call
Scope and preserve
We take the facts, identify the custodians, devices, exchange accounts and wallets in scope, and issue preservation instructions the same day. The exchange is put on notice so the account is frozen rather than emptied, and the laptop and mailbox are placed under hold before anything is reissued or wiped.
- Days 1 to 3
Forensic collection
Devices are imaged to ISO 17025 aligned practice with a documented chain of custody. Mailboxes and cloud accounts are exported tenant-side. Where a hardware wallet, seed phrase backup or exchange app is present, it is captured in place and photographed before handling.
- Days 3 to 10
Attribution work
Wallet applications, browser history, exchange logins, KYC records and message threads are searched for the link between a person and an address. Attribution is what wins these cases, and it is almost always found in the device and account material rather than on the chain.
- Days 5 to 15
On-chain tracing
The trace runs forward from the known withdrawal address across hops, mixers, bridges and into exchange deposit addresses, recording each transaction hash so the analysis can be reproduced and tested by the other side.
- Weeks 2 to 4
Interim relief and third-party disclosure
The trace and attribution evidence supports a proprietary or freezing injunction, a Bankers Trust or Norwich Pharmacal order against the exchanges holding the deposit addresses, and service by alternative means where the defendant is unknown.
- Weeks 4 to 10
Disclosure and expert report
Material is processed and reviewed for PD 57AD extended disclosure, and a CPR Part 35 report sets out the method, the assumptions, the limits of the trace and the transactions relied on, in a form the court can follow without a blockchain background.
§ Costs
What each stage costs
Indicative ranges for a single defendant matter, excluding VAT and court fees. Every instruction gets a written stage-by-stage budget after the first call, and we do not move to the next stage without approval.
| Stage | Indicative fee | What it covers |
|---|---|---|
| Preservation and scoping | £1,500 to £4,000 | Hold notices, exchange notification, custodian and system mapping, written scope and budget. |
| Forensic collection | £850 to £1,400 per device | Imaging of laptops, phones and hardware wallets, plus mailbox and cloud exports, with chain of custody. |
| Attribution analysis | £3,500 to £9,000 | Device and account level work to link addresses to people, including KYC and exchange record review. |
| On-chain tracing | £4,000 to £12,000 | Depends on hops, chains and use of mixers or bridges. Simple exchange-to-exchange traces sit at the lower end. |
| Injunction support | £2,000 to £5,000 | Exhibits and a witness statement supporting freezing, proprietary, Bankers Trust or Norwich Pharmacal applications. |
| CPR Part 35 expert report | £6,000 to £15,000 | Written report, response to the other side's expert, joint statement and hearing attendance. |
§ FAQs
Questions litigators ask
- How quickly do we need to move on a crypto matter?
- Immediately. Funds move in minutes and exchange records are the practical route to recovery, so the first steps are notifying the exchange, preserving the devices and accounts, and preparing interim relief. Tracing can follow; preservation cannot.
- Can stolen cryptocurrency actually be recovered?
- Often partially. Recovery depends on value reaching a regulated exchange that will respond to a court order. Where funds sit in a private wallet with no identifiable holder, the realistic outcome is a judgment and a frozen balance rather than immediate repayment.
- What does attribution mean, and why does it matter more than the trace?
- A trace shows where value went. Attribution shows who controlled the address. Courts act against people, not addresses, so evidence linking a wallet to a person, from a device, an exchange account or a message, is what carries an application.
- Do we need a Part 35 expert, or is an analyst report enough?
- For an interim application a factual witness statement exhibiting the trace is usually sufficient. For trial, the analysis has to be given as CPR Part 35 expert evidence, with the method, assumptions and limitations set out so it can be tested.
- How do blockchain records fit into PD 57AD disclosure?
- On-chain data is a known adverse and supportive source like any other. It is listed in the Disclosure Review Document, and the transaction data, the analysis working and the tooling used are all potentially disclosable, so the workflow has to be documented from the start.
- What does a crypto matter cost overall?
- A contained single-defendant tracing matter taken to an interim application usually lands between £12,000 and £30,000. Multi-chain matters with several custodians and a trial report run higher. We give a written stage-by-stage budget after the first call.
More detail is in the 72 page crypto assets guide and the crypto investigation FAQ.
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.