Match Systems specializes in blockchain analytics and, in cooperation with law enforcement agencies and regulators of various countries, accompanies the process of returning stolen crypto assets.

The majority of Match Systems employees have a background in specialized departments of law enforcement agencies or financial regulators
Our database contains >100 million records about illicit activities in crypto
Case studies
Damage
$530 million
Damage
$560 million
Damage
$125 million
Damage: $7 m
Found: $3 m
Damage: $130 m
Found: $1,1 m
Damage: $1,3 b
Found: $3,2 m
Damage: $100 m
Found: $0,7 m
Damage
$25 million
Introduction:
A client was deceived in a cryptocurrency-to-fiat exchange transaction (received high-quality counterfeit cash and discovered it only at the bank), and the funds were sent in USDT tokens to a cold wallet address. Most of the funds continued to be held in the cold wallet address, and a small portion was sent to exchanges.

Analysis and actions taken:
Considering that the majority of the assets were held in a cold wallet address and there was no technical ability to seize the funds without private keys from the address, the following directions of work were deemed promising: - Initiation of a criminal case in the corresponding jurisdiction
- Analysis of cryptocurrency asset movements and establishing relations with exchanges - Preparation of a special investigation to be provided to law enforcement agencies - Communication with USDT token issuer, Tether LTD
After marking the stolen assets in blockchain analyzers and initiating a criminal case, a request was made to Tether LTD to freeze the funds at the corresponding address for subsequent reissuance of the same amount of USDT tokens to the client's new address. Requests were also made to cryptocurrency exchanges to freeze accounts associated with these transactions.

Result:
The tokens and associated accounts were frozen within 2 days of initiating the work, preventing the perpetrator from withdrawing the frozen assets. At present, procedural aspects of returning the funds to the client's addresses are being resolved.
Introduction:
Through social engineering, cryptocurrency assets worth more than $100,000 were stolen from the victim.

Analysis and actions taken:
During the investigation, it was established that all stolen assets were transferred to centralized cryptocurrency exchanges, specifically Binance and Gate.

Result:
The investigation was forwarded to law enforcement agencies, and with a court order, the funds held on the centralized cryptocurrency exchanges were frozen and subsequently returned to the victim.
Introduction:
As a result of a smart contract hack on a liquidity pool, $1,3 million worth of ETH tokens were stolen.

Analysis and actions taken:
During the investigation, it was established that the stolen ETH tokens were transferred through several intermediate addresses using swap procedures and were eventually converted into 1,3 million USDT tokens, which were then transferred to an unmarked address controlled by the attacker.

Result:
Through prompt collaboration with Tether Limited and law enforcement agencies, the attacker's address was blacklisted in the Tether smart contract. The stolen tokens were subsequently returned to the victim through a reissuance procedure.
Introduction:
As a result of a client hack, assets worth $2.2 million USDC were stolen.

Analysis and actions taken:
In an attempt to obscure the movement of the stolen assets, the attackers transferred the sum through several cryptocurrency addresses, splitting the main balance into two parts. One part was deposited onto the cryptocurrency exchange "Binance", while the other part was exchanged for BNB using a smart contract. The attackers then transferred the BNB tokens through several intermediate addresses to the deposit address of the cryptocurrency exchange "Binance". Based on a request from law enforcement agencies, it was discovered that the recipient account of the stolen cryptocurrency assets was registered on a "drop". The stolen assets in the BSC and ETH networks were exchanged for USDT TRC and withdrawn from the "Binance" exchange. Subsequent investigation focused on tracking the movement of the assets that were withdrawn from the exchange, as the attackers attempted to split and transfer them to different addresses in order to conceal the trail. Ultimately, the movement of the assets was traced to their deposit onto the exchange.

Result:
Thanks to our prompt actions and a timely request from law enforcement, the stolen assets were frozen on the exchange before they could be withdrawn or sold. Based on the evidence gathered during the investigation, a court order was issued, and the entire stolen sum was returned to the client.
Case 1
Introduction:
A client was deceived in a cryptocurrency-to-fiat exchange transaction (received high-quality counterfeit cash and discovered it only at the bank), and the funds were sent in USDT tokens to a cold wallet address. Most of the funds continued to be held in the cold wallet address, and a small portion was sent to exchanges.

Analysis and actions taken:
Considering that the majority of the assets were held in a cold wallet address and there was no technical ability to seize the funds without private keys from the address, the following directions of work were deemed promising: - Initiation of a criminal case in the corresponding jurisdiction
- Analysis of cryptocurrency asset movements and establishing relations with exchanges - Preparation of a special investigation to be provided to law enforcement agencies - Communication with USDT token issuer, Tether LTD
After marking the stolen assets in blockchain analyzers and initiating a criminal case, a request was made to Tether LTD to freeze the funds at the corresponding address for subsequent reissuance of the same amount of USDT tokens to the client's new address. Requests were also made to cryptocurrency exchanges to freeze accounts associated with these transactions.

Result:
The tokens and associated accounts were frozen within 2 days of initiating the work, preventing the perpetrator from withdrawing the frozen assets. At present, procedural aspects of returning the funds to the client's addresses are being resolved.
Case 2
Introduction:
Through social engineering, cryptocurrency assets worth more than $100,000 were stolen from the victim.

Analysis and actions taken:
During the investigation, it was established that all stolen assets were transferred to centralized cryptocurrency exchanges, specifically Binance and Gate.

Result:
The investigation was forwarded to law enforcement agencies, and with a court order, the funds held on the centralized cryptocurrency exchanges were frozen and subsequently returned to the victim.
Case 3
Introduction:
As a result of a smart contract hack on a liquidity pool, $1,3 million worth of ETH tokens were stolen.

Analysis and actions taken:
During the investigation, it was established that the stolen ETH tokens were transferred through several intermediate addresses using swap procedures and were eventually converted into 1,3 million USDT tokens, which were then transferred to an unmarked address controlled by the attacker.

Result:
Through prompt collaboration with Tether Limited and law enforcement agencies, the attacker's address was blacklisted in the Tether smart contract. The stolen tokens were subsequently returned to the victim through a reissuance procedure.
Case 4
Introduction:
As a result of a client hack, assets worth $2.2 million USDC were stolen.

Analysis and actions taken:
In an attempt to obscure the movement of the stolen assets, the attackers transferred the sum through several cryptocurrency addresses, splitting the main balance into two parts. One part was deposited onto the cryptocurrency exchange "Binance", while the other part was exchanged for BNB using a smart contract. The attackers then transferred the BNB tokens through several intermediate addresses to the deposit address of the cryptocurrency exchange "Binance". Based on a request from law enforcement agencies, it was discovered that the recipient account of the stolen cryptocurrency assets was registered on a "drop". The stolen assets in the BSC and ETH networks were exchanged for USDT TRC and withdrawn from the "Binance" exchange. Subsequent investigation focused on tracking the movement of the assets that were withdrawn from the exchange, as the attackers attempted to split and transfer them to different addresses in order to conceal the trail. Ultimately, the movement of the assets was traced to their deposit onto the exchange.

Result:
Thanks to our prompt actions and a timely request from law enforcement, the stolen assets were frozen on the exchange before they could be withdrawn or sold. Based on the evidence gathered during the investigation, a court order was issued, and the entire stolen sum was returned to the client.
Investigation (Comprehensive case support)
Research
Marking of addresses involved in asset theft 
(client asset freeze)
$3 000
Retrospective analysis
$2 500
Interaction with state authorities
Training of crypto-compliance officers
4
3
2
1
  • Registering and verifying the victim on the platforms where the assets were seized;
  • Assisting the exchange/issuer in providing the token with a law enforcement order to transfer/re-issue assets to the affected party;
  • Transfer or reissue of assets by the exchange/issuer to the affected party.
Refund
  • Providing research to law enforcement agencies with a criminal case opening statement;
  • Assisting law enforcement in obtaining information on deposit addresses, their disposers, and asset blocking;
  • Assisting in the preparation of inquiries to VASPs and issuers;
  • Analysis of responses received and recommendations for further necessary inquiries and actions;
  • Assistance in preparation of court orders for seizure and recovery of assets in favor of the victim.
Launching a criminal case
  • Description of the full cycle of movement and dilution of stolen assets;
  • If there is a connection between OTC exchangers and VASPs, the deposit addresses to which the funds were withdrawn are specified;
  • Analyzing in order to deanonymize the villain;
  • Providing recommendations for further actions to recover stolen assets.
Carrying out the study
  • Establishing key areas of work within the case;
  • Labeling cryptocurrency addresses with analyzers;
  • Interacting with exchanges and exchangers to block funds urgently;
  • Monitoring addresses that contain stolen assets to trace them in case of movement.
Executing preliminary analysis and urgent actions
Ddigital asset recovery process
FAQ
Is it possible to recover stolen cryptocurrency assets?
How long does it take to recover the funds?
Are there cases when it is impossible to recover the funds?
Do you provide any guarantees of successful work?
Which countries' law enforcement agencies do you cooperate with?
How specifically can you help me in the investigation of cryptocurrency incidents, especially if all the arrests are being made by law enforcement agencies?
Can we work solely on a success fee basis for the recovery?
What is the approximate success fee you charge?
What actions can increase the chances of a successful recovery?
How does working with you proceed?
What does the blocking of USDT/USDC tokens look like?
Is it possible to recover stolen cryptocurrency assets?
How long does it take to recover the funds?
Are there cases when it is impossible to recover the funds?
Do you provide any guarantees of successful work?
Which countries' law enforcement agencies do you cooperate with?
How specifically can you help me in the investigation of cryptocurrency incidents, especially if all the arrests are being made by law enforcement agencies?
Can we work solely on a success fee basis for the recovery?
What is the approximate success fee you charge?
What actions can increase the chances of a successful recovery?
How does working with you proceed?
What does the blocking of USDT/USDC tokens look like?
Submit
an application
Leave a request