Case study: from theft to recovery

This capstone follows one fictional case from the first alert to the return of funds, touching every module of the course. At each step, ask which lesson the action comes from and what record it leaves. All names, addresses and figures are invented, and the figures add up, so the case doubles as a reconciliation exercise (network fees other than the Chain B swap costs are ignored).

The case at a glance

At 02:10 UTC on 14 March 2026, an attacker who had compromised a signing laptop at Nordhaven Exchange (Country A) drained three hot wallets. Prices at the time were ETH USD 2,500 and BTC USD 80,000.

Other parties: Brightwater OTC, a registered broker in Country B; Lumen Exchange in Country C; a stablecoin issuer; a smart-contract mixer with fixed 100 ETH pools; and a lock-and-mint bridge to Chain B, an EVM rollup.

Hour one: intake, preservation and the first freeze

Nordhaven's monitoring alerted at 02:31; its incident lead called the police cyber unit at 02:40. The duty investigator opened a case file and recorded the intake (see the lesson The investigation lifecycle): the seeds were three theft txids, the attacker's addresses on two chains and the amounts per asset. Nordhaven's engineers were asked not to wipe the compromised laptop; it was imaged, and the image hash recorded before analysis (see the lesson Hashing, logging and chain of custody).

At 02:48 the attacker swapped 1,500,000 USDT for 600 ETH on a decentralized exchange. The remaining 2,500,000 USDT sat at one address, so the investigator sent the urgent freeze request shown in the lesson Freezing and seizure options; the issuer blocked the address at 03:05. By 03:30 indicators had gone out through police-to-police channels and an industry alert network.

Nordhaven proposed posting an on-chain message offering the attacker a bounty. The investigator asked it to wait until the case team agreed the wording, so the message would not reveal what investigators knew (see the lesson Ethics, privacy and investigator safety).

Days 1–12: tracing the split

The attacker now held 3,000 ETH (2,400 stolen plus 600 from the swap) and 50 BTC, and split them. The team graded every link (see the lesson Tracing to an evidential standard).

The bridge step followed the lesson Bridges: lock-and-mint, burn-and-release and liquidity bridges: both txids, the message ID and the matching amount went into the trail. The mixer step followed the lesson Smart-contract mixers: the gas-funding link was recorded as an inference with its basis and limits. A second examiner re-ran each trace from node data, with tool versions and label snapshots recorded (see the lessons Tooling, reproducibility and validation and Preserving on-chain evidence).

From cash-out service to suspect

Brightwater's attribution rested on two sources: its own published deposit instructions and a label in two independent datasets, checked and dated (see the lesson Attribution sources and their reliability). As a registered provider in Country B, Brightwater could be asked to preserve records at once through police and FIU channels, followed by a mutual legal assistance request from Country A (see the lessons Legal authority and international cooperation and Working with service providers). Countries A and B set up a joint investigation team.

Brightwater's records showed that all 4,980,000 USDC and the four mixer withdrawals (400 ETH, or USD 1,000,000 at USD 2,500) were credited to one corporate account whose director we call Suspect 1. Brightwater had already paid out USD 2,980,000 (1,980,000 for USDC and 1,000,000 for ETH) to a bank account in Country B; 3,000,000 USDC was still on the account. The records independently corroborated the mixer inference, which rose from grade D to B, with the grade history kept.

Lumen's records showed the six deposits went to accounts opened by three money mules, raising the Lumen label to grade B. The device identifiers used to log in to those accounts matched a device that had logged in to Suspect 1's Brightwater account (see the lesson Linking on-chain and off-chain identifiers). The attribution chain ran address → cluster → service → account → person, each layer with its own evidence (see the lesson From address to entity to person).

On 4 April, Country B officers searched Suspect 1's home under a warrant. Examiners found a photo of a seed phrase in a notes app backup on the phone (see the lessons Wallets on seized devices and Acquisition and analysis of devices). Restored on an isolated examiner device under lawful authority, it derived bc1q…9tm4 (see the lesson Wallet recovery under lawful authority). The 18 BTC were swept the same morning; the transfer record in the lesson Securing seized crypto-assets is that sweep.

Freezes and seizures

The bank account had been opened two weeks before the theft and received no other money, so no allocation method was needed; the report said so explicitly rather than leaving the point open (see the lesson Tracing methods and their consequences). Each seizure was valued at the time of transfer with a stated price source (see the lesson Managing and realizing seized assets). Nordhaven asked for the bitcoin back in kind, so no interim sale was sought.

The report and the testimony

The lead examiner's report followed the structure in the lesson Writing the forensic report: instructions, materials (with hash values of every provider return and image), methods, findings by link with confidence grades, limitations and appendices with txid tables. A flow chart showed traced, inferred and untraced value in different line styles (see the lesson Visual evidence for courts). Before trial, unused material, including label sources and published research on the mixer heuristic's error rates, was disclosed (see the lesson Disclosure and defense scrutiny).

In cross-examination, defense counsel put it to the examiner that mixer heuristics are unreliable. The examiner agreed that the gas-funding pattern alone is only an inference (grade D), pointed to the independent corroboration in Brightwater's records that raised it to grade B, and noted that the link concerned USD 1,000,000 of the USD 14,000,000 and that no other link depended on it (see the lesson Testimony and cross-examination). Conceding the limit made the rest of the evidence more credible.

Return of funds and reconciliation

Nordhaven had reimbursed its customers from reserves, so it stood as the claimant. Countries B and C returned what they held to Country A under asset-return arrangements of the kind Recommendation 38 expects, with each payout address verified by signed message before transfer (see the lesson Victim recovery and civil routes). Meanwhile, Nordhaven customers were contacted by fake "recovery agents"; the police published a warning that they would never charge fees.

Recovery was 72.9% of the loss at theft-time prices; the bitcoin, returned in kind, was fully restored. The ETH and USDT losses (USD 10,000,000) were covered at 62% by the stablecoins and fiat.

Exam focus: first-hour priorities (seeds, preservation, freezable assets first, verified requests, indicators out); grading each link on the A–D scale and keeping the grade history when records raise an inference; matching bridge deposits to releases; attribution layer by layer from cluster to person; choosing the lever for each asset (issuer, provider, bank, keys); valuing seizures and choosing in-kind return; conceding limits under cross-examination; reconciling recovered and lost amounts to the total loss.