Day one is preservation, not analysis
The instinct is to start tracing straight away. The better first move is to freeze what can still be lost: the devices the wallets were created on, the email and messaging accounts that hold the seed phrase or recovery prompts, and any exchange account the funds passed through.
Exchanges respond to properly framed preservation requests, but they keep logs for a limited window and they will not act on an informal email. A short, precise notice naming the account, the transaction hashes and the retention period does more than a long letter.
Attribution is evidence, not arithmetic
Following a chain of transactions on a public ledger is the easy part. Tying a wallet to a person is the part the court cares about, and it almost always comes from ordinary digital evidence: an app installed on a work laptop, a screenshot in a chat thread, a device backup, an exchange onboarding record.
That is why a crypto instruction is a normal forensic collection with a ledger analysis bolted on, and why the collection should be scoped before anyone opens a blockchain explorer.
What it usually costs
Preservation notices and a first device image typically sit in the low thousands. Ledger tracing and attribution across several hops sits higher, and the cost is driven by the number of hops and the number of counterparties, not by the value in dispute.
Figures on the worked case pages are indicative and exclude VAT. Every instruction gets a stage by stage budget in writing after the first call.
The statement is the product
A trace that cannot be explained to a judge in plain English is not worth much. The output of the work should be an exhibit with the method, the tooling, the assumptions and the limits set out, so the other side can test it and the court can rely on it.