An anonymized corporate phishing case showing how investigators prioritized restrictable assets while following the remaining proceeds across Bitcoin, Ethereum and XRP.
A business email compromise operation deceived key personnel at a corporate organization and triggered fraudulent wire transfers totalling approximately USD 40 million. The proceeds reached a regulated centralized exchange, were withdrawn as stablecoins and entered a multi-chain laundering structure.
The USD 40 million figure describes the value of the fraudulent transfers. It is not the amount frozen, seized or recovered. The documented intervention secured approximately USD 1.6 million in stablecoins and preserved 1 BTC through a courtesy freeze, while other identified balances remained subject to continuing legal and investigative work.
How did a fiat wire fraud become a blockchain investigation?
The initial loss occurred through the banking system, but the asset trail changed once the proceeds reached a cryptocurrency exchange. The perpetrators converted value into stablecoins and distributed it through several routes.
One portion moved through wallets with behavior consistent with over-the-counter service operators. Another passed through non-custodial instant exchanges. A further balance remained unspent in stablecoins, creating the most immediate opportunity for restriction.
That structure required investigators to connect off-chain and on-chain evidence. Bank records established the fraudulent wires. Exchange records and blockchain transactions showed how the value entered the digital-asset ecosystem. Subsequent wallet activity identified where issuer action, exchange preservation or formal law-enforcement process might still be effective.
Why were unspent stablecoins the first priority?
Unspent stablecoins represented a closing intervention window. When the relevant issuer can restrict an address, a documented stablecoin balance may be more immediately actionable than assets already converted into native BTC, ETH or XRP.
Recoveris triaged the case around those balances and prepared a forensic memorandum that linked the corporate loss, the exchange withdrawals and the current wallets. The report gave law enforcement a concise evidentiary route for seeking issuer action without waiting for the entire laundering network to be attributed.
Approximately USD 1.6 million in stablecoins was frozen through that initial coordination. The restriction preserved the balance while authorities and legal representatives pursued the procedures required for seizure and return.
How were instant-exchange withdrawals correlated across chains?
The remaining proceeds required cross-chain reconstruction. Non-custodial instant exchanges can accept one asset and pay out another, which breaks the simple same-chain transaction path. Investigators must correlate deposits and withdrawals using timing, value, asset conversion, service behavior and other case-specific signals.
Recoveris analyzed deposits into the instant exchanges and compared them with outgoing transactions across Bitcoin, Ethereum and the XRP Ledger. This work identified downstream wallets holding meaningful residual balances and separated likely laundering flows from unrelated customer activity.
One sequence involved 1 BTC deposited into a non-custodial service through three transactions. Recoveris intervened while the service still controlled the value and secured a courtesy freeze pending formal law-enforcement action.
The distinction between a courtesy freeze and a seizure is important. A service may voluntarily preserve assets for a limited period after receiving credible evidence, but a competent authority still has to provide the legal process required to maintain the restriction and transfer the assets.
What remained after the initial freezes?
The investigation identified additional Bitcoin, Ethereum and XRP balances that had not yet moved. Those wallets remained visible and could be monitored, preserving future opportunities if the assets entered a cooperating exchange, issuer-controlled token or other identifiable service.
Attribution work also continued around the suspected over-the-counter operators. A wallet pattern can indicate an OTC function without proving who controls it. Turning that signal into an enforceable lead may require exchange records, open-source intelligence, legal disclosure or cooperation from another jurisdiction.
The case therefore did not end with the first freeze. Monitoring, service attribution and legal coordination remained necessary because a known wallet is an investigative target, not automatically a recoverable balance.
What does this case show about BEC recovery?
Corporate phishing response must connect the banking investigation to the blockchain investigation early. A bank-recall request addresses the fiat leg, while wallet tracing, stablecoin analysis and exchange engagement address the digital-asset leg. Treating them as separate cases creates gaps that perpetrators can exploit.
The case also demonstrates why investigators should prioritize by control point. Unspent issuer-controlled stablecoins came first, then balances held by identifiable services, followed by monitored self-custody wallets and attribution work around opaque operators. That sequence directed limited time toward the assets most capable of being preserved.
Precise reporting protects the integrity of the result. Recoveris traced a USD 40 million fraud, supported a USD 1.6 million stablecoin freeze and preserved 1 BTC. Further balances were identified, but identification alone is not recovery.
Source: anonymized Recoveris engagement, summarized in the Recoveris investigations case-study section and the Recoveris business and VASP solution page. Corporate identity, service names and operational details have been withheld to protect confidentiality and ongoing proceedings. The related 1inch Tornado Cash case provides another example of evidence reconstruction after standard analytics reach their limit.
Coordinate the banking and blockchain response
If a corporate payment fraud has entered cryptocurrency rails, contact the Recoveris team to connect the fiat evidence, on-chain trace and available intervention routes.
