01 · Typology12 min
Intake desk · openAvg. response · under 4hLondon · New York · Singapore
Confidential · privilegedOpen a case↗
EE / 001
Est. London
MMXXIII
We trace it.
We freeze it.
We get it back.
Private crypto investigators. We turn on-chain traces into recovered funds — with blockchain venues and police forces across India, Cyprus, Dubai & the UK.
- Assets traced
- £ 80M+
- Jurisdictions recovered in
- 14
- Police-force partnerships
- 8+
- Public breaches
- 0
UK-registered✦FINRA-regulated specialties✦Global law-enforcement liaison✦Exchange & issuer partnerships✦Confidential mandates✦Recovery-led methodology✦UK-registered✦FINRA-regulated specialties✦Global law-enforcement liaison✦Exchange & issuer partnerships✦Confidential mandates✦Recovery-led methodology✦UK-registered✦FINRA-regulated specialties✦Global law-enforcement liaison✦Exchange & issuer partnerships✦Confidential mandates✦Recovery-led methodology✦
§ 01 — PostureA small firm,
A small firm,
deliberately.
Most of crypto is a confidence game. We built the boutique that isn't.
Four partners. Every mandate partner-led. Every step documented to a standard that survives a regulator reading it.
No cold calls. No impossible promises. No unregulated wrappers.
§ 02 — Method
How a thread through the noise becomes a result.
- 01
Intake & triage
Confidential, partner-led briefing. We assess viability before a single invoice is raised — and tell you honestly if we can't help.
- 02
On-chain forensics
We follow value across bridges, mixers, OTC desks and exchange clusters. Every hop is annotated; every heuristic is auditable.
- 03
Counterparty mapping
We translate wallets into entities — KYC'd venues, custodians, principals — using a combination of proprietary tooling and human intelligence.
- 04
Freeze & recovery
We coordinate with exchanges, issuers and police-force liaisons to freeze funds at the venue and route them home through regulated rails.
§ 03 — Success rates
The numbers, filtered.
Aggregate outcomes across closed mandates. Filter by year or asset class to see how the desk performs. / placeholder data
Recovery rate
78%
Funds recovered as a share of traced value.
Avg. days to freeze
11
From intake to first venue-side freeze.
Jurisdictions reached
14
Police forces, regulators and venues coordinated with.
Cases closed
142
Assets recovered
£80M
Public breaches
0
Partner-led
100%
§ — Process
Intake to recovery, in five steps.
Cases reach us directly from the chain — not from cold outreach. We only get paid once funds are recovered and settled, straight from the recovery itself.
- 01
On-chain signal
Cases come to us directly from the blockchain — flagged wallets, victim reports and forensic alerts route into the desk.
- 02
Trace
On-chain forensics across bridges, mixers and exchange clusters to map the full path of funds.
- 03
Freeze
Coordinate with venues to immobilise funds at the destination before they move again.
- 04
Coordinate
Brief police liaisons across involved jurisdictions to a court-grade standard.
- 05
Recover & settle
Funds routed home through regulated rails. We're paid on completion, directly from the recovered assets — no recovery, no fee.
§ 03 — SpecialtiesSix disciplines.
Six disciplines.
One desk.
Each specialty is overseen by a named partner. Tap any card to open the full service brief — or contact the desk directly.
01 / 06↗
On-chain investigations
Wallet attribution, fund tracing, mixer demixing, bridge-hop analysis.
Open service →
02 / 06↗
Asset recovery
Coordinated with counsel, venues and law enforcement across 14 jurisdictions.
Open service →
03 / 06↗
Law-enforcement liaison
Direct working channels with police forces across India, Cyprus, Dubai and the UK.
Open service →
04 / 06↗
Expert testimony
Court-grade reporting and expert witness work for civil and criminal proceedings.
Open service →
05 / 06↗
Counterparty diligence
Pre-trade screening of wallets, counterparties and protocols at institutional grade.
Brief the desk →
06 / 06↗
Treasury advisory
Custody architecture, key ceremonies and policy design for funds and family offices.
Brief the desk →
§ — Services
All services →Four routes in.
01↗
Crypto Tracing & On-Chain Forensics
Wallet attribution, bridge-hop analysis, mixer demixing — annotated and auditable.
02↗
Asset Recovery & Freezing
Coordinated freezes at exchanges, issuers and bridge operators — then funds routed home.
03↗
Law Enforcement Liaison
We brief police and regulators in their format, in their jurisdiction, on day one.
04↗
Expert Testimony & Court-Ready Reports
Civil and criminal proceedings, in the witness box and on the page.
§ 04 — The deskFour operators.
Four operators.
One desk.
Elliptic Enterprises is a partnership of four. No associates, no juniors, no outsourced casework. The partner you brief is the partner who runs the recovery.
⏵ Names & credentials disclosed privately under NDA on engagement.
P/01[ redacted ]
Partner
Investigations
Ex national cyber-crime command
Mandate lead · law-enforcement liaison↗
P/02[ redacted ]
Partner
Recovery & Regulated Trading
Ex tier-one FICC desk
Execution & settlement of recovered assets↗
P/03[ redacted ]
Partner
On-Chain Forensics
Ex blockchain-analytics lead
Mixer demixing · cross-chain attribution↗
P/04[ redacted ]
Partner
Counsel & Expert Testimony
England & Wales Bar · federal cyber-crime
Court-grade reports · expert witness↗
4 / 4 partners · no associates · no sub-contractorsRequest the partner dossier →
§ 05 — Recovery networkWe don't just trace stolen funds.
We don't just trace stolen funds.
We get them back.
A trace on its own is a report. Recovery requires a network — of venues that will freeze, of regulators who will listen, and of police forces who will act. That network is what we've spent years building.
01
Blockchain partners
We work directly with exchanges, stablecoin issuers, bridge operators and on-chain analytics platforms. That relationship is what turns a trace into a freeze.
02
Global police liaison
We support and coordinate with law enforcement across India, Cyprus, Dubai, the UK and beyond. Our reports are written to their evidentiary standard from page one.
03
Recovery, not just reports
Our mandate is to get money back. Every investigation is scoped toward a recovery outcome — freeze, seize, settle, or return.
Active law-enforcement liaison
8+ jurisdictions
United KingdomIndiaCyprusDubai (UAE)SingaporeGermanyUnited StatesHong Kong
§ — JurisdictionsClick a country.
Click a country.
See the partnership.
Highlighted nodes are jurisdictions where we have active police-force or regulator liaison. / placeholder figures
§ 06 — Casework
Selected work, redacted.
Featured engagement up top. Tap any card for the unredacted brief.
Featured · Live mandate · 2025EE/2025/0217
Inside the Bybit recovery effort.
When the largest exchange hack in history hit Bybit in February 2025, we were one of the private teams chasing the flow in real time — bridging on-chain forensics with our police liaisons across Dubai, the UK and APAC. Several tranches frozen at exchange. Work continues.
On-chain forensicsMixer demixingExchange liaisonPolice coordination
Request unredacted brief →
⏵ Engagement telemetry
- $1.5B+
- Total stolen in incident
- < 6 hrs
- Disclosure → first attribution
- 14
- Venues coordinated on freeze
- 4
- Police liaisons activated
Figures reflect public reporting + our engagement scope.
↗
02 · Recovery2025
£12.4M bridge exploit traced, frozen at a regulated venue, returned
8 chains · 41 days · UK & UAE liaison
↗
03 · Recovery2024
Multi-jurisdictional fraud unwound with Indian and Cypriot police
Tornado + Sinbad · funds recovered at exchange
↗
04 · Advisory2024
Custody architecture for a London family office
9-figure mandate · ongoing
⏵ Video case studies arriving shortly — supplied by the partners.
§ 07 — Why us
The only firm in this category we trust — our own.
The crypto investigations market is full of operators who are, in practice, indistinguishable from the people they claim to be chasing. We built Elliptic Enterprises because we couldn't find a firm we'd hand our own families' assets to.
We're registered in England & Wales, our specialties operate within the FINRA framework, and every engagement is documented to a standard that survives court. Credentials are verifiable privately under NDA on engagement.
✓
UK-registered
Registered in England & Wales. Verifiable privately under NDA on engagement.
✓
FINRA-regulated
Specialties operate within the FINRA regulatory framework.
✓
End-to-end auditable
Every trace, partner action and recovery step documented to court-ready standards.
§ — FAQ
What people actually ask.
The questions we get most often, answered plainly. If yours isn't here, the partners answer it personally on intake.
Often, yes — when we're engaged early. Recovery depends on where the funds land. If they reach a regulated venue we have a relationship with, we can usually coordinate a freeze and a return. Mixers, OTC desks and self-custody complicate things, but rarely make them impossible.
Within hours, ideally. The first 24–72 hours are when funds are most likely to land at a venue we can reach. We open files outside business hours for time-critical cases.
We're registered in the UK and have active law-enforcement liaison across the UK, India, Cyprus, UAE, US, Germany, Singapore, Japan, Australia, Netherlands, Switzerland and Canada. We can pull other jurisdictions in via partner counsel where needed.
Both, subject to a minimum loss threshold. Institutional mandates take priority on intake but we do take significant individual cases — particularly where there's a credible recovery path.
Fees are scoped per mandate after triage. We don't take a case we don't believe is recoverable, and we tell you that honestly up front. We do not operate on success-only fees in the way most of the market claims to.
Yes. Our reports are written to the evidentiary standard of the jurisdictions we work in, and partners give expert testimony in civil and criminal proceedings.
No. Every mandate is under NDA from first contact. Case studies on this site are anonymised and published only with client consent.
We use the same tooling — and we built parts of it. The difference is that we run the case end-to-end: trace, freeze, coordinate, recover. Analytics firms sell a tool. We deliver an outcome.
§ — Insights
From the desk.
Long-form notes on the typologies we keep seeing and the playbooks that work against them.
02 · Typology8 min
Anatomy of a bridge exploit: 41 days from drain to return
⏵ Coming soon
03 · Guide6 min
The first 72 hours after a wallet compromise
⏵ Coming soon
§ 08 — Contact usOpen a confidential
Open a confidential
file with us.
All briefings are under NDA from first contact. Partner-led response within one business day.
§
Engagement
Strictly partner-led
Office address withheld. We come to you.
§ 09 — DisclosuresNo two cases
No two cases
are the same.
Every mandate is independent. Outcomes, timelines, recovery percentages and case figures shown on this site reflect historical work and are illustrative — they are not a forecast, guarantee or representation of what will happen in your matter.
Strategy is bespoke. We build a recovery strategy from scratch around the facts, jurisdictions, counterparties and risk profile of each client. Many of the matters we accept involve significant sums, and the work is sized accordingly.
Funds will move during a case. Active recovery routinely requires assets to move between wallets, accounts, custodians, venues and regulated payment rails as part of the freeze, escrow and settlement workflow. All movements are agreed with the client in advance, logged with a full audit trail, and routed exclusively through regulated counterparties.
Not legal or investment advice. Nothing on this site constitutes legal, tax, regulatory or investment advice, nor an offer to provide services in any jurisdiction where doing so would be unlawful. Engagement begins only after intake, conflicts clearance and a signed engagement letter.