September in on-chain investigations.
About 7 minutes to read · Forward freely
September put several stages of asset recovery on public view: identifying stolen funds, restricting their movement, taking control of them and returning them to an owner. Each required different evidence and a different party able to act. This edition follows those transitions, alongside our work with investigators and financial professionals.
Last weeks · 31 August – 27 September
The patterns we saw
The month’s incidents exposed weaknesses in the information that systems trusted before releasing money. They also showed why a recovery update needs to say exactly where the funds are and who controls them.
01 / Valid signatures can authorise a theft
Bitget revised its estimate of the 24 September theft to USD 387.5 million after adding transfers on Zcash and TRON. The increase reflected a fuller reconciliation of the original incident. According to the exchange’s account, reported by TRM Labs, attackers manipulated a backend approval process while the private keys remained secure.
For investigators, that makes the withdrawal instructions and approval records part of the evidence alongside the blockchain transfers. A valid signature establishes that a key authorised a transaction; it leaves the legitimacy of the instruction to be examined.
Bitget’s revised figures · TRM’s analysis
02 / A false internal record can release real assets
On Liquid, a software flaw allowed unbacked L-BTC to be exchanged for approximately 4,000 real BTC from the federation’s reserve. TRM reported on 8 September that around 3,400 BTC had subsequently been returned. The initial outflow and the amount still outstanding therefore describe different things.
Chainflip’s Tron incident involved a different error: the system interpreted an attacker-added transaction memo as a failed swap and issued an extra payout. Chainflip reported 736,442.17 USDT taken. Both cases point investigators towards the same reconciliation task: compare the system’s accepted record with the assets actually received and released.
TRM on Liquid · Chainflip’s incident report
03 / A wallet’s history defines its exposure
DCENT’s App Wallet incident returned to a lesson from August: moving an existing recovery phrase between devices carries its history with it. DCENT’s guidance considers whether the phrase was ever entered into its App Wallet, which app version was used when signing, and the address’s activity. A hardware wallet can therefore share exposure through a phrase previously used in software.
The case file needs that history. The device a client uses today may tell only part of the story. DCENT’s current guidance sets out the affected criteria and migration steps.
DCENT’s incident report and guidance
04 / Secured funds still need a route back to their owners
After the Neutron attack, Cosmos Hub validators moved approximately 1.227 million ATOM into a recovery wallet controlled by multiple signers. Their published update says onward transfers require a governance mandate. A later THORChain refund reached the attacker outside the intervention’s scope and was moved away.
Separately, the Crypto Recovery Trust announced a completed repayment: more than 20 BTC returned to a verified Coldcard claimant. Steptoe, counsel to the trust, confirmed the return was made without charging the owner. These are distinct recovery milestones, and reporting them separately makes the remaining work visible.
Cosmos Hub’s response and recovery update · Steptoe’s repayment announcement
Incident coverage follows our four completed weekly reviews. Figures retain their source’s measurement basis; we have not combined gross outflows, outstanding losses and recovered assets into a monthly loss total.
CONCEPT OF THE MONTH
The civil route in crypto cases
Victims can pursue civil proceedings independently of whether the police investigate. In some cases, this provides an alternative avenue when law enforcement is unable to progress a case. Its viability depends on the jurisdictions involved, where the relevant exchanges or assets are located, enforceability abroad and the cost of pursuing orders relative to the loss.
Different orders serve different purposes
Ontario provides useful examples of the tools local counsel may consider, subject to the court’s requirements:
- A Norwich order can require a third party, including a cryptocurrency exchange, to disclose relevant account-holder or transaction information.
- A Mareva injunction restrains dealings with assets to prevent their dissipation.
- An Anton Piller order permits a supervised search to preserve evidence at risk of destruction, with safeguards including an independent supervising solicitor.
Disclosure in practice
In Hao Chen v. Moazen-Safaei, 2025 ONSC 3098, paragraph 21, the judgment records that specified banks and cryptocurrency exchanges were ordered to produce records, and that documents were produced in response. The case illustrates how civil proceedings can obtain information needed to advance a crypto-related claim.
Availability depends on the case
These orders are not automatic. Norwich relief is exceptional, and a court may refuse it where ordinary disclosure or third-party document production can provide the information. Disclosure or an asset freeze does not, by itself, return funds.
Recoveris supports the investigative and evidential work. We leave the assessment of specific legal options and procedural requirements to local counsel, as we do not provide legal advice. A civil route needs to be assessed against the circumstances of the individual case before it becomes a practical recovery strategy.
PRODUCT SPOTLIGHT
CoTrace
More capacity for digital asset investigations
CoTrace is Recoveris’ vendor-neutral AI copilot, helping investigators prioritise transaction leads and reduce repetitive tracing. Informed by investigator-confirmed casework, it recommends useful next steps so specialists can spend more time assessing uncertainty and working through complex cases.
Its white-box approach makes recommendations explainable and repeatable: investigators can inspect the reasoning, review it against transaction data and explain the basis for their decisions. CoTrace is data and tool agnostic, independent of any single blockchain analytics provider, so teams can retain their tool choices.
Built for exchanges, financial institutions, law enforcement and forensic specialists, CoTrace keeps human judgement central. Investigators assess its recommendations and retain control of the investigation.
Illustrative detection path. The example risk score and confidence value shown are not performance metrics.
FIELD INTELLIGENCE
What the AI-fraud figures measure
The City of London Police’s September assessment recorded 956 reports in which victims identified AI as a factor during 2025/26, up from 193 in 2024/25. Reported losses associated with those cases rose from GBP 1.2 million to GBP 9.6 million. Investment fraud accounted for the largest share of AI-enabled reports.
The measurement boundary matters: these are victim reports identifying AI involvement, rather than a count of all AI-assisted crime. For investigators, the practical response is to preserve the material that created trust, including messages, websites, voice recordings and apparent endorsements, alongside the payment trail. That evidence helps explain how the victim was induced to transfer the assets.
Read the City of London Police assessment
RECOVERIS THIS MONTH
Our appearances and company news
A workshop with NCA and FCA investigators
Roman Bieda, Aleksander Góra and Sol Cinosi delivered a workshop for officers from the UK National Crime Agency, joined by colleagues from the Financial Conduct Authority. The discussion focused on cross-checking intelligence, understanding differences between analytics providers and recognising when an investigation needs evidence beyond the blockchain.
Cross-border recovery in Luxembourg and London
At the 10th Global Conference on Criminal Finances and Cryptoassets in Luxembourg, Marcin Zarakowski joined the panel on cross-border seizure and public-private cooperation. His message was practical: the speed of the institutional response has to match the period in which assets can still be restricted. Sol Cinosi also represented Recoveris at the conference.
Sol subsequently attended Seize 2026 at the U.S. Embassy in London, hosted by Asset Reality and IRS Criminal Investigation. Discussions included the continued development of the IVAN public-private partnership and the operational challenges of international virtual-asset investigations.
Luxembourg recap · Seize London recap
Training in Frankfurt and cooperation in Strasbourg
Patrick Prinz and Dominik Konopacki delivered a two-day lecture at Frankfurt School of Finance & Management for banking and legal professionals, covering blockchain analytics, risk assessment and digital asset recovery. Umberto Buonora and Alessandro Rella represented Recoveris at Team Cymru’s Underground Economy Conference, which brings investigators, threat-intelligence practitioners and policymakers together in a closed-door setting.
Frankfurt training · Underground Economy Conference
On Currency of Power
Marcin Zarakowski and Patrick Prinz joined Marieke Flament and Nicolas Colin to discuss the practical route from tracing stolen crypto to seeking its return. The conversation covered cross-border coordination, the points where assets can be restricted, and Europe’s need to develop its own blockchain-intelligence capabilities.
Listen to the Currency of Power conversation
Aleksander Góra joins as Chief Business Officer
Aleksander will lead Recoveris’ business and commercial strategy, develop strategic partnerships and expand our international reach, with a particular focus on Institutional Compliance. He brings more than 15 years of experience across product development, digital transformation and the commercialisation of emerging technologies.
Read the appointment announcement
OCTOBER CALENDAR
Meet us here next.
44th ICC FraudNet Autumn Conference
1–3 October · Copenhagen, Denmark
Speaking: Sol Cinosi.
Invest Cuffs Poznań 2026
5–6 October · Poznań, Poland
Speaking: Dominik Konopacki.
ONIF Seminar 2026
16 October · Genoa, Italy
Speaking: Umberto Buonora and Alessandro Rella.
Plan B Forum 2026
23–24 October · Lugano, Switzerland
Attending: Marcin Zarakowski and Patrick Prinz.
AML Summit 2026
27 October · Vilnius, Lithuania
Speaking: Patrick Prinz and Dominik Konopacki.
MERGE Madrid 2026
27–29 October · Madrid, Spain
Speaking: Sol Cinosi.
If you’ll be there, get in touch to arrange a conversation about a case, your investigation workflow or digital-asset compliance.
Arrange a meeting with the team
