The Brief
A claimant company had paid a substantial invoice to what it believed was a long-standing supplier. The bank details had been changed by email three days before payment. Within forty-eight hours of the funds clearing, they had been moved through two intermediary accounts and partially converted to cryptocurrency. The instructing solicitors needed evidentially robust tracing material to support a freezing application and a Bankers Trust order.
Our Approach
Our digital forensics team triaged the email environment first, identifying the point of compromise — a forwarding rule silently installed on a finance mailbox six weeks earlier. In parallel, our cryptocurrency tracing analysts followed the on-chain trail through a peel chain into a clustered wallet group attributable, with high confidence, to a specific exchange. OSINT enrichment tied two of the intermediary fiat accounts to documented mule patterns we had previously catalogued.
What We Delivered
A tracing report admissible as expert evidence; a chain-of-custody log for every artefact handled; a wallet attribution memorandum with on-chain visualisations; and a witness statement prepared in the form expected by the court. The instructing solicitors used the package to support a successful without-notice application.
Outcome
A meaningful proportion of the misappropriated funds was preserved at the regulated exchange identified in our work and ultimately recovered through proceedings. The compromise vector was closed. The client's finance team received a tailored briefing on the indicators they had narrowly missed, so the same pattern could not run twice.
The evidential discipline was the difference. We had something a judge could rely on, not a narrative we had to defend.— Instructing partner, anonymised