£2.7M recovered

Full client summary

Malware altered a clipboard address at the moment of transfer. We traced the movement across two chains and a mixer, identified the cash-out exchange, and worked with its compliance team to freeze the balance before withdrawal.

Case timeline

1. 1

   Intake & evidence

   Endpoint forensics confirmed clipboard-hijacking malware.

2. 2

   Tracing

   Cross-chain tracing followed the funds through a mixer to one exchange.

3. 3

   Freeze & claim

   Compliance freeze obtained within 96 hours of the transfer.

4. 4

   Recovery

   Majority of the treasury transfer returned to the firm.