Victim recovery and civil routes

Seizing funds is half of asset recovery; the other half is getting them to the people who lost them. In scam and theft cases the victims may number in the thousands, live in dozens of countries and hold weak records of what they sent, while fraudsters target them a second time with fake recovery offers. This lesson covers how investigators identify victims, verify claims, support civil and insolvency routes, protect victims from recovery scams and return assets across borders.

Identifying victims

Victims do not always come forward, and those who do may not be the only ones. Investigators combine four sources.

The on-chain source is the most complete. Once the scheme's deposit addresses are established (see the lesson From address to entity to person), every inbound transfer is a potential victim payment.

-- Potential victim payments into the scheme's deposit addresses
SELECT t.from_address,
       COUNT(*)            AS payments,
       SUM(t.amount)       AS total_sent,
       MIN(t.block_time)   AS first_payment,
       MAX(t.block_time)   AS last_payment,
       l.entity_type       AS sender_label   -- e.g. exchange, unknown
FROM token_transfers t
JOIN scheme_addresses s ON s.address = t.to_address
LEFT JOIN labels l      ON l.address = t.from_address
WHERE t.from_address NOT IN (SELECT address FROM scheme_addresses)
GROUP BY t.from_address, l.entity_type
ORDER BY total_sent DESC;

The query lists every sender into the scheme, excluding the scheme's own addresses so internal transfers are not counted as victims. Senders labeled as exchanges point to customers the exchange can identify under legal process; unlabeled senders are probably self-hosted wallets whose owners may come forward. The result is a list of addresses and amounts, not people: each line still needs a claimant and proof. Record the label source and version, since labels change (see the lesson Attribution sources and their reliability).

Verifying claims

A claim is an assertion that a person controlled a sending address or account and lost a stated amount. Verification tests each part.

1. The transaction exists with the stated txid, amount, token and time, and it reached a scheme address.
2. The claimant controlled the sender. Proof is an exchange statement showing the withdrawal to the scheme address, or a message signed with the sending address's key. A screenshot of a wallet app is weak on its own.
3. The claim is not duplicated. The same txid claimed twice, by one person or by two, is caught by checking claims against each other.
4. The claimant is not part of the scheme. Addresses that also received payouts from the scheme, or that funded its infrastructure, need closer review: insiders sometimes pose as victims, and early participants in a Ponzi-type scheme may have received more than they put in.
5. Net loss is computed. Payments in minus any payouts received from the scheme.

Each claim ends in a recorded status (verified, partly verified, rejected) with reasons, so the distribution can be defended and challenged. The examiner who traced the scheme is well placed to run the on-chain checks, but deciding entitlement belongs to the court or the administrator.

Distribution when there is not enough

Recovered assets rarely cover all losses. Suppose an authority recovers 1,200,000 USDT and verified net losses total 3,000,000 USDT. A pro rata distribution gives each victim 40% of their loss: a victim who lost 50,000 USDT receives 20,000. Pro rata is common where victims' funds were pooled in the same addresses, because tracing cannot honestly say whose coins remain. Where one victim's funds can be traced separately into a specific seized balance, some systems allow that victim a stronger claim to it. Which rule applies is a legal question; the examiner presents the traced facts under the stated tracing method (see the lesson Tracing methods and their consequences) so either rule can be applied. Costs of custody and distribution, and whether they are deducted, should be visible in the figures.

Civil and insolvency routes

Criminal confiscation is not the only route. Victims and their lawyers, and the administrators of failed platforms, pursue assets through civil courts, often in parallel with a criminal case. The tools vary by country, but most systems offer some version of:

• Freezing orders against a defendant's assets, in some systems even against persons not yet identified, used against stolen crypto held at exchanges.
• Disclosure orders against third parties, such as an exchange that received the funds, to obtain account holder details.
• Proprietary claims to specific traced assets, which can rank ahead of other creditors if the defendant is insolvent.
• Insolvency proceedings, in which a liquidator or trustee of a failed platform traces and collects assets for all creditors, usually valuing crypto claims in fiat at a cut-off date.

Some courts have allowed documents to be served by sending a token to the defendant's address when no other contact exists. For the forensic examiner, civil work demands the same standard as criminal work: the same documented trace, confidence grading and report discipline (see the lesson Writing the forensic report). Two cautions apply. Civil action must not tip off suspects in an ongoing criminal investigation, so coordination with prosecutors matters. And evidence obtained in one proceeding can usually be used in another only under the rules governing it.

Cooperation with exchanges and issuers

Exchanges and stablecoin issuers are frequent partners in victim recovery, as described in the IDFE-CC lesson Freezes, law-enforcement requests and asset recovery. For investigators, three practices help: give providers precise, verifiable requests tied to traced amounts; tell them when holds can be released, so innocent customers are not frozen indefinitely; and agree how frozen balances will be transferred once an order exists, including issuer burn-and-reissue for stablecoins. Some exchanges also hold victims' own accounts, which simplifies proof of ownership and payout.

Recovery scams

Victims of crypto fraud are prime targets for recovery scams: fraudsters who pose as investigators, lawyers, regulators or "blockchain recovery specialists" and promise to retrieve the lost funds for an upfront fee. They find victims through social media posts, complaint forums and leaked customer lists from the original scheme, and some are run by the same groups. Common signs:

• a guaranteed recovery, or a claim to have "found" the funds already;
• an upfront fee, a "tax" or a "release charge" before funds can be returned;
• a request for the victim's seed phrase or remote access to their device;
• claims of special powers to "hack back" or reverse blockchain transactions;
• forged court orders, police letters or official-looking logos;
• contact from a personal messaging account rather than an official channel.

Investigators warn victims at the first contact, in writing: the authority will never charge a fee or ask for a seed phrase, and all contact will come through a named officer or an official portal. They give victims one verifiable point of contact. Reports of recovery scams are new crimes, and their payment addresses are new leads.

Returning assets across borders

When victims are abroad, or assets were confiscated in another country, return follows international cooperation channels. Recommendation 38 expects countries to have arrangements for coordinating seizure and confiscation and for sharing confiscated assets. The UN Convention against Corruption sets out return of assets in Article 57, and the UN Convention against Cybercrime covers return and disposal of confiscated proceeds in Article 52, including returning property to its legitimate owners and compensating victims. Treaties set the framework; the practical work is in the payout:

Exam focus: the four sources for identifying victims and their limits; listing inbound transfers to a scheme while excluding its own addresses; the five checks in verifying a claim, including proof of control and insiders posing as victims; computing a pro rata distribution and why pooled funds are often shared pro rata; civil freezing, disclosure, proprietary and insolvency routes in general terms, and coordinating them with a criminal case; the signs of recovery scams and how investigators warn victims; cross-border return under Recommendation 38 and the UN conventions, and verifying payout addresses.