Numinah is a blockchain-forensics and digital-asset recovery firm. We trace stolen and lost funds across UTXO and account-based chains — clustering co-spending wallets, unwinding peel chains, and de-anonymising hops through mixers, bridges and DEX swaps — then compile court-grade evidence and coordinate freeze requests with exchanges and law enforcement. Methodical, fully documented, and without false promises.
Recovery is difficult and never guaranteed. The initial case review is free, with no obligation.
Live valuations, live evidence
Tracing isn’t only where assets went — it’s what they were worth at the time of loss versus now. We pull live reference prices and 7-day history so the value of your case is anchored to real market data, not a screenshot.
The losses we investigate
Every loss leaves a different on-chain signature — a drainer’s approve(), a peel chain, a bridge hop. Each has its own tracing playbook and its own honest outlook, which we give you before any work begins.
Investment & “pig-butchering” fraud
Counterfeit trading dashboards and long-con scripts funnel deposits through layered intermediary wallets. We reconstruct the deposit path hop-by-hop and pin the off-ramp where value is cashed out.
Phishing & wallet drains
A malicious setApprovalForAll, a spoofed airdrop, or a drainer contract can sweep a wallet in a single block. We reconstruct the approval, identify the drainer cluster, and trace the outflow.
Exchange & account takeover
SIM-swaps, session-token theft and API-key abuse trigger unauthorised withdrawals. We rebuild the timeline from on-chain movements and login artefacts into evidence a custodian can action.
Rug pulls & protocol exploits
Removed liquidity, mint backdoors, and reentrancy exploits. We read the contract bytecode and event logs, isolate the exploit transaction, then follow extracted liquidity through routers and bridges.
Lost keys & forgotten wallets
Partial BIP-39 seeds, corrupted keystore files, forgotten passphrases, legacy hardware. A constrained-search recovery problem with honest, math-bound odds we’ll quantify for you up front.
Mistaken & wrong-network transfers
Funds sent to a contract, the wrong chain, or a stalled bridge. We check finality, contract recoverability and bridge state to tell you what is actually retrievable — and what isn’t.
How a case moves, step by step
We work like investigators, not salespeople. Every stage is documented and explained, and you decide whether to continue after each one — these steps run in order because the evidence builds on itself.
Free case review
You tell us what happened and share whatever you have — TXIDs, addresses, dates, the platform involved. We give a candid first read on whether on-chain work can realistically help. No charge, no obligation.
Feasibility & triage
We pull the transactions, check whether funds are still traceable or already off-ramped, estimate hop depth and time-to-exit, and tell you plainly what a realistic outcome looks like before you spend a penny.
Engagement & scope
If you continue, we agree a written scope and transparent fees before any paid work. We never demand a large upfront “release fee,” and we never ask you to send crypto to recover crypto.
On-chain tracing
Using commercial analytics and manual graph analysis, we follow funds across wallets, DEX swaps, bridges and chains — applying co-spend clustering, change-address and peel-chain heuristics — and flag every touchpoint at a mixer or regulated exchange.
Evidence package
We compile a chain-of-custody report: annotated transaction graphs, address attributions, hashes and timestamps, exported in a format a bank, VASP, officer or court can understand and act on.
Liaison & legal levers
Where funds reach a regulated service, we help you and your counsel pursue the available levers — suspicious-activity reports, freeze requests, and information requests — strictly through proper legal channels.
Outcome & reporting
We report honestly on what was achieved — frozen or returned assets, a stronger police/insurance case, or the candid finding that funds are beyond reach. You get the full picture either way.
What “tracing” actually means
A blockchain is a permanent public ledger — every movement leaves a record. The skill isn’t reading one transaction; it’s reconstructing intent across thousands of them, then proving it.
- 01Address clustering
Grouping wallets controlled by one actor using common-input-ownership and behavioural co-spend heuristics.
- 02Peel-chain analysis
Following long sequences where small amounts are “peeled” off at each hop to obscure a moving balance.
- 03Mixer & bridge analysis
Estimating flows through CoinJoin-style mixers and cross-chain bridges, where naïve tracing breaks down.
- 04Attribution & KYT
Matching clusters to known services and deposit addresses so funds can be pursued where they touch the regulated world.
- 05OSINT corroboration
Tying on-chain findings to off-chain evidence — domains, profiles, reused infrastructure and metadata.
We do not, and cannot, guarantee recovery.
Anyone who promises you guaranteed recovery is not telling the truth. Here is what actually decides whether assets can be returned — most of it outside any investigator’s control.
- Where the funds went. If assets are already cashed out, off-chain, or sitting in an uncooperative jurisdiction, tracing can locate them without retrieving them.
- Whether a third party acts. Freezes and returns are decided by exchanges, banks, courts and police — not by us. We build the case; they hold the keys.
- Time. The sooner we start, the better the odds. Stolen funds move through hops and off-ramps fast, and once gone they rarely return.
- What our work can do. Tracing, evidence and coordination materially improve your chances — but a real, valuable outcome is sometimes a strong evidence file rather than returned coins. We’ll always tell you which.
Beware “recovery” scams that target victims twice
A whole industry of fake recovery agents preys on people who already lost money. Treat any of these as a serious red flag — including from anyone claiming to be us.
- Guaranteed recovery. No legitimate firm can promise it. The certainty is the scam.
- Upfront crypto payments. Being asked to send crypto to “unlock,” “release,” or “verify” funds is the classic move.
- Unsolicited contact. A stranger who DMs you claiming they can get your money back — especially one who “already found” it.
- Fake authorities. Impersonators posing as police, regulators, or an exchange’s “recovery department.”
- Pressure and secrecy. Urgency, instructions to keep quiet, or to avoid the real police.
- Remote-access or screen-share demands. Being told to install AnyDesk, TeamViewer or similar, or to share your screen so someone can “secure” or “access” your wallet for you.
How we hold ourselves to that standard
- We never guarantee an outcome, and we give you our honest read even when it isn’t what you hoped.
- We never ask you to send crypto to recover crypto — not ever, for any reason.
- Fees are agreed in writing before any paid work, and the first case review is always free.
- We encourage you to report to authorities and work alongside them, never around them.
- We never ask for remote access or to screen-share your wallet, seed phrase, logins or 2FA codes — we don’t need them to trace funds on-chain.
In the UK, report fraud to Action Fraud (actionfraud.police.uk) or Police Scotland on 101. In the US, file with the FBI’s IC3 (ic3.gov). Reporting is free, and it’s the step that makes most recoveries legally possible.
We show our faces — not our passports
Real investigators are happy to prove who they are. We’ll meet you on a video call and show our Numinah employee badge, so you can see you’re dealing with real people. What we will never do — and what you should never do either — is send or accept photos of passports or government ID. That’s exactly the data identity thieves and impersonators harvest; a face on a call and a verifiable badge prove who we are without putting anyone at risk.
Screen sharing: handle with care
Screen sharing and remote-access tools like AnyDesk or TeamViewer are a favourite trick of scammers — once someone can see or control your screen, your wallet is exposed. We will never ask to control your device or watch you open your wallet. If you ever share your screen with anyone, never reveal your seed phrase, private keys, passwords, recovery files or 2FA codes on it — and end the call the moment you’re asked to.
How to check we’re really us. Every Numinah employee carries a badge with a name and a unique ID number. Before you act on anything, confirm the person is genuine: contact us only through the official phone number and email published on this site — never details a “representative” gives you — and ask us to verify their badge number. A real member of our team will always be happy for you to check.
What people ask first
Can you guarantee you’ll get my money back? +
How much does it cost? +
What information do you need from me? +
How quickly should I contact you? +
Should I also go to the police? +
Are my details kept confidential? +
Can you recover a lost seed phrase or password? +
Tell us what happened
Share the details below for a free, no-obligation assessment. The more you tell us, the more useful our first read will be. We will never ask you to send any cryptocurrency.
Prefer to reach out directly? Email [[hello@yourdomain.com]] or call [[+44 …]].
Owner note: submissions are saved to your Supabase table once you set SUPABASE_URL and SUPABASE_ANON_KEY in the script. Until then the form runs in demo mode.