The most critical variable in digital asset recovery is no longer just geographic jurisdiction or the type of asset stolen. The defining metric of success is now speed. We are witnessing a fundamental “speed asymmetry” in the blockchain ecosystem where threat actors utilize automated scripts to compress the money laundering lifecycle into seconds, while compliance and investigation teams are often forced to rely on manual workflows. In 2025, over $4.04 billion was stolen across major hack incidents. In the fastest recorded cases, funds were moved and layered in a matter of seconds. The operational window to execute a successful freeze before funds are bridged or mixed is now estimated at just 10 to 15 minutes. (Sources: Global Ledger Hack Report 2026, TRM Labs 2026 Crypto Crime Report)
In our experience, this automation leaves a distinct behavioral signature on the blockchain. Human investigators can easily spot when software takes the wheel.
“Usually, there are many indicators, like speed, with assets moved out just a few seconds after being received,” explains Umberto Buonora, Head of Investigations at Recoveris. “We look for schematic patterns with the same number of hops before a deposit to a service, or the use of many ‘fresh’ wallets that would take humans significant time to set up and back up.”
This programmatic execution is evolving rapidly. Threat actors are no longer just using simple mixers. They are executing complex, multi-chain evasion tactics that are designed to overwhelm traditional single-chain forensic tools.
“I would say we are seeing complex layering of stolen assets and the use of multiple blockchains to do it,” notes Dawid Koperski, Blockchain Investigations Manager at Recoveris. “There are numerous swaps between stablecoins that look very automatic and well organized. I’ve seen this specific pattern emerging strongly over the last five to six weeks.”
For investigators, tracking these cross-chain transfers creates a massive manual bottleneck. Standard blockchain analytics tools frequently hit a wall when funds move through newly deployed or unattributed cross-chain bridges. At this exact point, investigators must manually figure out which bridge was used and then trace the corresponding withdrawals on the destination chain. Furthermore, synthesizing this raw, multi-chain data into a court-admissible forensic report requires extensive manual labor, triple-checking of data, and continuous monitoring of new wallet activity.
As generative AI makes it easier for criminals to find vulnerabilities in platforms and deploy better drainer contracts, the volume and velocity of these attacks will only increase. To counter this, the industry requires an entirely new operational standard.
“In our work, timing is crucial,” Dawid Koperski emphasizes. “Fraudsters are getting quicker and smarter thanks to AI, and we are most of the time banging at the door while they’re lurking by the window, hoping we will go away. To counter that, it would be highly beneficial to have better cooperation between VASPs and good actors like Recoveris.”
This is exactly why manual crypto investigations are becoming obsolete and why we are building the Blockchain Investigations Management System (BIMS). By automating the cross-chain correlation of unattributed bridge transfers and standardizing the drafting of forensic reports, BIMS removes the most time-consuming manual tasks from the investigator’s desk. Coupled with our strict 24-hour Incident Response program, Recoveris provides Virtual Asset Service Providers and legal professionals with the rapid, AI-enhanced intelligence required to break down the door before the perpetrators can escape.
