The Schwyz cantonal police announced the recovery of approximately USD 10.5M in crypto from an investment scam reported by a Canton Schwyz company – one of the largest crypto seizures in Swiss history.
The official statement credits “close and efficient cooperation between the Public Prosecutor’s Office and the police” and an “innovative and flexible approach.” It does not mention the on-chain investigation that made the recovery possible. That work was led by Umberto Buonora, our Head of Investigations, and his team.
Below is how the case actually moved from a single criminal complaint to USD 10.5M of recoverable value, in the order it happened.
How the case began
In December 2024, a company in Canton Schwyz filed a criminal complaint with the Schwyz Public Prosecutor’s Office. The perpetrators had pretended to offer an investment opportunity, induced the company to transfer crypto to a wallet they controlled, and disappeared days after the transfer.
Investment fraud at this scale produces a narrow recovery window. Once stolen funds reach mixers, cross-chain bridges, or non-cooperating jurisdictions, the cost and time required to recover them rise sharply. The work begins with the wallet address the victim transferred to, and what happens in the days that follow determines whether recovery is possible at all.
Umberto and the team picked up the trace at this stage.
The on-chain investigation
The first phase was tracing. Stolen funds rarely sit at the address they were sent to. Perpetrators move them across multiple addresses, often across multiple chains, to break the on-chain link to the original receiving wallet. Effective tracing follows the funds through these movements and identifies the receiving infrastructure where they eventually rest, typically wallets controlled by exchanges or stablecoin issuers.
Within days of intake, the team had mapped the receiving infrastructure across multiple addresses and chains. The funds had ultimately landed in custody of two parties capable of acting on them: Tether, the issuer of USDT, and Bitfinex, a major exchange.
This conclusion mattered. A wallet address with no path to a regulated counterparty cannot be frozen. A wallet address with one can.
Coordinated outreach to Tether and Bitfinex
The second phase was VASP outreach. Issuer-level action (Tether freezing USDT at the address level) and exchange-level action (Bitfinex restricting account activity) both require direct, institutional channels with the parties involved. They do not happen through generic abuse-report forms.
Through that outreach, the team secured two outcomes. Tether froze the relevant USDT holdings at the address level. Bitfinex held USD 10.5M of value on its books pending the criminal proceeding.
At that point the funds were locked. The recovery was no longer a question of whether the value could be reached, but of how it would flow back through the legal process.
Handover, prosecution, and the burn-and-remint
The case was handed to the Schwyz Cybercrime unit and, on the basis of findings about the perpetrators, escalated to the Ticino Public Prosecutor’s Office. With the funds frozen and the case file built, the prosecutorial path was open.
Tether has now burned the frozen stablecoins and reminted the corresponding amount at a new address. This is the standard mechanism for releasing stablecoin value back to a rightful owner. The issuer destroys the supply at the seized address and reissues it to an address designated by the relevant authority. The victim is being made whole.
What the press release leaves out
Schwyz cantonal police statement: https://www.sz.ch/verwaltung/sicherheitsdepartement/kantonspolizei/medienmitteilungen/detailseite.html/8756-8758-8802-9496-9613-10011-12161/news/25147
What the statement omits is the part of the case that produced the recoverable USD 10.5M in the first place: the on-chain tracing across multiple addresses and chains, the institutional outreach to Tether and Bitfinex, and the freeze coordination that turned a wallet address into a seized asset. That work was done by Umberto and his team.
Dear Schwyz law enforcement: you’re welcome.
What the case demonstrates
Recoveries of this size hinge on the people doing the tracing knowing which VASPs to call, in what order, with what evidence, and within what window. The legal process can only act on what the on-chain investigation produces. Without the trace, there is no freeze. Without the freeze, there is no recovery.
For Swiss companies, legal professionals, and prosecutors handling cases of this kind, that division of labor is worth being explicit about. The investigative work is the load-bearing element of the recovery, and it is specialist work.
Work with us
If your business or your client has been affected by crypto fraud, immediate on-chain investigation is the difference between a recoverable case and a closed file.
