Cutting-edge technology in the form of crypto assets (also known as virtual currencies) can serve as the perfect cover, letting stolen funds scatter across the globe within seconds. Watching assets vanish in an instant—through a malicious smart contract approval or a stolen seed phrase—is an experience that leaves anyone in deep despair. Yet the blockchain, a vast digital ledger, keeps an indelible record of every step a criminal takes.

Advanced tracing technology capable of following the money trail through a maze of obfuscated transactions has now become a globally established infrastructure. Yet even with a shield of forensic fact-finding at the data layer, lost funds will never flow back to their rightful owner without a legal sword capable of actually clawing assets back from malicious fraud rings.

To avoid falling into the secondary-victimization trap set by unlicensed operators offering false promises of relief, and to set the wheels of a proper legal process in motion, technology and law need to work together correctly. This article shines a spotlight on the technical capabilities of top-tier cyber forensics firms that support national investigative agencies and major corporate governance, and examines why a strong collaborative framework with lawyers who confront crypto asset crime is so important.

The State of Crypto Fraud and Hacking, and How ‘Tracing the Money’ Actually Works

As sophisticated crimes targeting crypto assets proliferate, many victims are confronted with the despairing thought that stolen funds can never be traced again. The short answer, however, is that the technical nature of blockchain makes it entirely possible to electronically trace the route the funds themselves have taken.

This article organizes the specific realities of the incidents currently on the rise, then explains in detail the technical mechanism behind why money movements can be traced—along with the pitfalls that lie beneath it.

The Growing Reality of Crypto Asset Trouble

As the Web3 ecosystem expands and DeFi (decentralized finance) develops, crimes targeting crypto assets are growing more sophisticated.

One of the most damaging schemes is the international ‘romance scam,’ in which relationships built on social media are exploited to lure victims onto fake investment platforms. Under the guise of high-yield liquidity mining and similar offers, these schemes get users to grant smart contract ‘Approve’ permissions, structurally defrauding them of control over the crypto assets in their wallet. In addition, the theft of seed phrases (private keys) via phishing sites and malware, and hacks that exploit protocol vulnerabilities, have become routine risks that can wipe out assets in an instant.

Because these crypto crimes exploit blockchain's pseudonymous nature and move funds across borders in a matter of seconds without any centralized intermediary, the reality is that initial investigations and asset freezes by law enforcement—built around traditional financial institutions—are extremely difficult.

Blockchain’s Transparency Makes It Possible to Trace Fund Movements

When facing the unauthorized outflow or fraudulent loss of crypto assets, the foothold toward a resolution is the inherent transparency of the blockchain, a distributed ledger.

With a conventional fiat currency bank transfer, the transfer history is kept confidential within each financial institution's internal database, making it impossible for a third party to trace the transfer route without a police search warrant or a court disclosure order. Public blockchains such as Bitcoin (BTC) and Ethereum (ETH), however, are designed so that every transaction history is published on the network, allowing anyone to view and verify it in real time.

Specifically, starting from the ‘source address (public key)’ where the unauthorized transfer originated, exactly which ‘destination addresses’ the funds were split and dispersed to, and which smart contracts they passed through, is fully visible along with timestamp and gas fee records. Even against obfuscation tactics that route funds through multiple addresses in a complex chain, advanced graph-analysis techniques (blockchain forensics) that statistically analyze the continuity of transactions make it technically possible to ultimately identify which centralized crypto asset exchange service provider (CEX) wallet the funds flowed into.

However, ‘Traceable’ Does Not Mean ‘Recoverable’

It is true that blockchain's technical characteristics make it possible to identify the route funds have taken, but there is an enormous gap between ‘being traceable’ and ‘actually being able to recover the assets.’

No matter how advanced the analytical technology used to pinpoint a destination address, an individual victim cannot personally identify the real-world identity—the name and address—of the person controlling that address. Even once it becomes clear that funds ultimately flowed into a wallet at a domestic or overseas centralized exchange (CEX, an order-book exchange model where users trade against each other rather than against the platform), getting that exchange to freeze the account, disclose customer information, or force a refund requires either investigative cooperation from law enforcement such as the police, or legal disclosure and seizure procedures carried out through a lawyer.

A bar association inquiry (bengoshikai shokai) is a legal system (Article 23-2 of the Attorney Act) established to allow lawyers to smoothly carry out their professional duties—such as gathering evidence and materials and investigating facts—for a case they have been retained on. It is not something an individual lawyer carries out on their own; rather, the bar association reviews the necessity and appropriateness of the request before making the inquiry.

Bar Association Inquiry System (Bar Association Inquiry System Committee) | Japan Federation of Bar Associations https://www.nichibenren.or.jp/activity/improvement/shokai.html

Furthermore, when an attacker layers privacy-focused decentralized exchanges (DEXs), cross-chain bridges, and unregulated overseas exchange service providers on top of one another, legal enforcement cannot reach them, and the difficulty of recovery rises sharply. In other words, tracing is ultimately only a means of ‘proving the facts’ of a crime and ‘preserving evidence’—without accompanying legal enforcement power, it does not, in reality, lead to the ultimate goal of a refund.

[Top Priority] Contact the Police or the National Consumer Affairs Center (188) First

When facing crypto asset losses, the natural impulse driven by urgency is to want to turn to a private-sector operator to ‘get the money back quickly.’ But consulting a public institution is the golden rule for handling the situation as reliably and safely as possible. To prevent the damage from spreading and to secure legal enforcement power, before approaching any private operator you should first correctly understand the role of trustworthy public contact points such as the police and the National Consumer Affairs Center, and reach out to them as a top priority.

Public Consultation Contact Points and Their Roles

If you become a victim of crypto asset fraud or hacking, the top priority is to promptly contact a ‘public consultation window’ in order to prevent secondary victimization and secure legal enforcement power. The following three institutions primarily share the relevant roles.

  • Police (police consultation line: ‘#9110’; emergencies: ‘110’) — This is where you file a ‘victim report’ (higaitodoke) for a case to be pursued as a criminal matter, for future investigation, and for identifying the other party. If it is not an urgent incident or accident but you want expert advice about a fraud-related problem, use the nationwide consultation dial ‘#9110’ (which connects to the cybercrime consultation desk at your local prefectural police headquarters, among others). The police carry out an initial response as a law enforcement agency based on technical evidence you present, such as transaction history.
  • National Consumer Affairs Center / Consumer Affairs Centers (Consumer Hotline: ‘188’) — This window accepts consultations at the stage of ‘this might be an investment scam’ or ‘I’ve signed a contract with a suspicious operator.’ Dialing ‘188’ (no area code) connects you to your nearest Consumer Affairs Center or the National Consumer Affairs Center, where a specialist counselor draws on a vast archive of past cases to give you objective advice on concrete countermeasures and next steps.
  • Financial Services Agency (FSA) (Financial Services User Consultation Office: weekdays ‘0570-016811’ / IP phone etc. ‘03-5251-6811’) — This window lets you confirm whether a crypto asset exchange service provider is registered and provide information about operators engaged in improper solicitation. It does not mediate individual disputes or negotiate refunds, but it plays a role in preventing damage from spreading through market monitoring and public alerts.

Every legal procedure and investigation aimed at recovering crypto assets starts from a record of consultation with these public institutions and the acceptance of a victim report (or simply a documented history of consultation), so contacting them should always be your first step, before consulting any private-sector operator.

Hiring a ‘Refund Specialist’ or Contingency-Fee Firm on Your Own Risks Secondary Victimization

Extreme caution is required with private operators that target crypto asset victims and attract customers online and on social media with sweet-sounding pitches such as ‘fast resolution of crypto asset fraud damage’ or ‘guaranteed results on a contingency-fee basis.’ Hiring one of these self-described ‘refund specialists’ on your own, without first consulting a public institution such as the police or the National Consumer Affairs Center, carries a high risk of ‘secondary victimization’—suffering further financial loss.

The most common pattern in these disputes is that victims are made to pay a large ‘retainer fee’ or ‘investigation fee’ up front, yet see no recovery result whatsoever. Operators lower the psychological barrier to signing up by advertising a contingency-fee model along the lines of ‘X% of the amount recovered,’ but once it comes time to sign the contract, it has become routine for them to demand a separate, hefty upfront fee—running from several hundred thousand to several million yen—citing the need to ‘prepare a detailed fund-tracing report’ and similar justifications.

There is also a more serious problem: a private operator with no legal authority taking on tasks such as ‘negotiating with the other party to force a refund’ or ‘seizing an account’ is suspected of constituting a criminal act in violation of Article 72 of the Attorney Act (prohibition of unauthorized legal practice). Even if a private operator with no legal enforcement power or refund-negotiation authority acts on its own, the chance of actually recovering funds from a fraud ring based overseas is close to nil. The result can be a worst-case scenario in which, on top of the assets already lost, the payment to the operator inflates the damage even further—so you should never place easy trust in an opaque ‘refund’ or ‘contingency-fee’ window.

A person who is not a lawyer or a legal professional corporation may not, for the purpose of earning compensation, engage in the business of handling—or brokering—legal affairs such as appraisal, agency, arbitration, or settlement in connection with litigation, non-contentious proceedings, administrative appeals (requests for review, requests for reinvestigation, requests for re-examination, etc.), or other general legal matters (except where the Attorney Act or another law provides otherwise). (Article 72, Attorney Act)

Measures Against Unauthorized Legal Practice and Improper Tie-Ups with Adjacent Professions (Headquarters for Countermeasures Against Interprofessional Boundary and Unauthorized Practice Issues) | Japan Federation of Bar Associations https://www.nichibenren.or.jp/activity/improvement/gyosai.html

What Investigation Firms Can and Cannot Do

When you fall victim to a crypto asset crime, ‘investigation firms’ (forensics companies) that take a technical approach to tracking activity on the blockchain can come up as an option. These firms, however, are ultimately ‘experts who uncover facts from data,’ not organizations that directly ‘recover’ stolen funds. To chart the right path toward a resolution, you need a clear understanding of an investigation firm's technical capabilities and limits, and how its role is clearly divided from that of the police and lawyers.

What Investigation Firms Can Do

The services provided by companies specializing in crypto asset investigation (forensics firms) and incident-response providers are specialized in ‘visualizing the digital trail’ using advanced blockchain analysis tools. The main areas they can specifically handle are the following three.

  • On-chain tracing (transaction analysis) — Tracks the route by which funds moved from the address where the unauthorized outflow occurred to other addresses. It visualizes a transfer history with multiple layers of complexity and pinpoints which centralized exchange (CEX) the funds are ultimately sitting in, or whether they have been cashed out (exited) into fiat currency.
  • Preparation of forensic reports for investigations and legal proceedings — Builds and issues an official analysis report from the objective data gathered through tracing, formatted so it can be submitted as ‘evidence’ when filing a victim report with the police or when a lawyer files a seizure request.
  • Technical support for incident notification and freeze requests to exchanges — Once a fraudulent destination address has been identified, promptly notifies the relevant crypto asset exchange service provider (exchange) of the outflow incident and supplies the technical facts (evidence data) needed to prompt a trading restriction (account freeze).

In this way, what an investigation firm handles is ‘objective proof of facts’ at the data layer of the public blockchain—its principal function is to visualize the route crypto assets have moved through in a form that can withstand use as legal evidence.

Division of Roles with Lawyers and the Police

To turn the recovery of crypto asset losses into a reality, it is essential to understand the structure in which investigation firms, the police, and lawyers each concentrate on their own function while cooperating with one another. Breaking down each party's role and limits looks like this.

Institution / Organization

Main Role (Function)

Limits (What It Cannot Do)

Investigation firm

Blockchain analysis, transaction tracing, and preparation of evidence (reports).

Identifying the perpetrator’s identity, negotiating refunds, and carrying out legal seizure procedures.

Police

Investigating the matter as a criminal case, identifying and arresting suspects, and making investigative inquiries to exchanges.

Negotiating a civil refund or recovering assets on behalf of an individual victim.

Lawyer

Negotiating a refund as the victim’s representative, and civil preservation/seizure procedures through the courts.

Advanced technical analysis or forensics of on-chain data.

No matter how meticulous a tracing report an investigation firm produces, it is ultimately nothing more than data that proves the fact of the route the funds took. Investigation firms are granted no authority whatsoever to compel domestic or overseas crypto asset exchange service providers (CEXs) to disclose customer information, or to legally demand the return of outflowed assets.

The role of the investigation firm is to supply the ‘objective weapon (evidence)’ that lets the ‘police,’ exercising state power to conduct a compulsory investigation, and the ‘lawyer,’ executing effective recovery procedures as the victim’s legal representative, do their work. Mistaking this division of roles and trying to have the investigation firm alone bring the matter to a close is a major cause of unnecessarily delaying a resolution.

How to Identify a Trustworthy Investigation Firm

When seeking the cooperation of a private company or investigation body, the most important thing is to thoroughly rule out any operator that makes excessively hyped-up claims or runs an unreasonable fee structure. Crypto asset forensics (technical investigation) is a field that requires highly specialized expertise, and a trustworthy firm clearly presents its own capabilities and limits along with its fee structure. To avoid being deceived by a bad-faith window that exploits the chaos of a crisis, you need to set concrete criteria to guide your choice.

Beware of ‘% of Damages’ Billing and ‘Contingency Fees’

As public institutions such as the National Consumer Affairs Center have repeatedly warned, extreme caution is needed toward any private operator investigating crypto asset losses whose fee structure prominently features a percentage-of-damages billing model—‘we charge X% of the loss amount’—or a contingency-fee model such as ‘you pay only if we recover the funds.’

By nature, on-chain tracing and forensic investigation of the blockchain are technical work billed for ‘analyst working hours’ and ‘specialized-tool license fees,’ regardless of the outcome (whether or not a refund is achieved). For that reason, a legitimate technical investigation firm clearly sets its ‘investigation fee’ as either a flat rate based on the scope of the investigation (such as the number of address layers to trace or the amount of work involved), or an actual-cost basis derived from an upfront estimate.

On the other hand, as noted above, most operators advertising a ‘contingency-fee model’ have no recovery authority backed by legal enforcement power. There is a steady stream of cases in which technical investigation is used as bait, and once the contract is signed, the operator claims ‘the difficulty is high, so an additional analysis fee is required’ and effectively extracts an upfront payment under false pretenses. The easy assumption that ‘a contingency fee means it’s safe’ is a breeding ground for opaque billing, so the golden rule is to choose a firm that discloses a flat and transparent fee structure.

Spotting Unauthorized Legal Practice and Exaggerated Recovery Claims

Another important criterion for assessing trustworthiness is whether the firm maintains legal compliance and whether it uses exaggerated language.

Under Japanese law, a private operator without a lawyer's license (a private investigator, an investigation firm, etc.) negotiating a refund with a fraudster on a victim's behalf for compensation, or acting as an agent in legal recovery procedures, constitutes unauthorized legal practice in violation of Article 72 of the Attorney Act. If an investigation firm or private investigator advertises claims such as ‘we will negotiate directly with the perpetrator and get your money back’ or ‘we have a track record of X recoveries,’ promising to handle legal procedures or guaranteeing a refund outright, that alone is strong grounds for suspecting a legal violation.

A legitimate technical investigation firm, aware that its own authority is limited to ‘fact-finding and evidence preparation’ as noted above, thoroughly avoids definitive language such as ‘we will definitely get it back’ and excessive claims that hint at legal recovery. Whether a firm sincerely explains the limits of its technical role and confines itself to serving as a bridge to affiliated lawyers or the police on legal matters is the litmus test for whether it is a sound company.

What to Check Before Signing a Contract

Before finalizing your decision to request an investigation from a private firm, there are three minimum requirements you should confirm to prevent later disputes or misunderstandings. If you cannot get a clear answer or written documentation on the following points, you should hold off on signing.

  • The technical basis for its track record — Rather than a vague, qualitative phrase like ‘numerous investigation cases,’ confirm the objective, quantitative technical foundation: ‘which blockchain analysis tool (a globally standard specialized tool, etc.) does it use?’ and ‘what professional qualifications or forensic experience do its in-house analysts hold?’
  • A clear fee structure and cost breakdown — Scrutinize the breakdown of the fee quoted to you: how many addresses, traced through how many layers, does the fee cover, and what is the unit cost if additional investigation is needed? It is also an important point to confirm whether the cost of the report (analysis document) issued after the investigation is included in the initial base fee.
  • A smooth system for coordinating with lawyers and law enforcement (the police) — A report prepared by an investigation firm only becomes effective for recovery once it is finally submitted to a lawyer or the police. Check whether ‘the report format aligns with what the police have a track record of accepting’ and whether ‘the firm has a system in place to introduce and coordinate with lawyers experienced in IT and crypto assets, as needed,’ so you can judge whether the transition into a legal process after the investigation will go smoothly.

A firm that provides transparent explanations on these points is one you can trust as a technical partner.

Investigation and Forensics Firms That Handle Crypto Asset Fund Tracing

Here we introduce top-tier investigation and forensics firms with globally high reputations and track records in crypto asset technical investigation and fraud-related fund tracing. Note, however, that every firm listed here is, in principle, a specialized organization serving ‘corporate and government (B2B) clients’—CEXs (centralized exchanges), financial institutions, and law enforcement agencies including the police. Please review each firm's technical characteristics and positioning bearing in mind that none of them is a window through which an individual victim can directly request a personal refund or recovery.

The World’s Largest Tracing-Technology Firms (B2B Only)

The following two firms are the world's largest, underpinning global crypto asset compliance and the infrastructure for tracing illicit funds on a worldwide scale.

That said, the advanced forensics services these two companies provide are designed for use by ‘corporate and government (B2B)’ clients—law enforcement agencies in each country, major financial institutions, and crypto asset exchange service providers. Please understand correctly that neither is a window an individual victim can approach directly for consultation, refund negotiation, or a personal recovery investigation.

Chainalysis Japan

This is the world's largest company providing crypto asset data platforms and advanced tracing and analytics tools to law enforcement agencies, government bodies, and financial institutions in more than 70 countries. The software and analytics it develops and offers are positioned as the de facto global standard infrastructure for tracing billion-dollar-scale international cybercrime, nation-state hacking incidents, and fund outflows caused by ransomware.

It boasts world-leading precision in the technology of analyzing the vast on-chain data recorded on public blockchains with its own advanced algorithms, stripping away an address's pseudonymity to identify the entity (the organization or exchange behind it). This enables comprehensive digital forensics that ranges from real-time monitoring of suspicious transactions to retrospective investigation of past illicit-outflow routes.

In Japan, the company is also deeply involved as a member of the Japan Crypto Asset Business Association (JCBA), but the advanced infrastructure and solutions it provides are, in principle, designed specifically for B2B use by crypto asset exchange service providers (CEXs), major financial institutions, and law enforcement agencies including national governments and police forces. It therefore has no window through which an individual victim can directly access personal refund negotiation or a private recovery investigation.

https://www.chainalysis.com/

Elliptic Japan K.K.

Headquartered in London, UK, this is a top global forensics firm with worldwide authority and a strong foundation in crypto asset risk management and blockchain analysis. Targeting mainly crypto asset exchange service providers, traditional financial institutions, and institutional investors, it comprehensively provides compliance tools that automatically meet anti-money laundering (AML) and counter-terrorist-financing (CFT) requirements.

The company's strength lies in crypto asset transaction data worth several trillion yen and its own extensive intelligence database of cybercrime-related addresses. Combining this with cutting-edge graph-analysis technology, it delivers an advanced fraudulent-transfer-tracing solution (Forensic) that unravels the continuity of transactions dispersed across multiple layers and technically sees through obfuscation tactics that abuse cross-chain bridges to identify the final resting place of illicit funds.

As a member of the Japan Crypto Asset Business Association (JCBA), it also supports the health of the domestic market, but its function too is specialized in securing the safety of the entire blockchain ecosystem and providing risk management for corporate clients. Like Chainalysis, it offers no consultation window for individuals or any service undertaking personal asset recovery, positioning it as a professional organization that handles corporate incident response and support for investigative agencies in the Web3 space.

https://www.elliptic.co/ja/

Japan’s Major Listed Forensics Firms

Below is a list of the major specialized companies, mainly large and publicly listed firms, that lead the field of cybersecurity and digital forensics (preservation, investigation, and analysis of electromagnetic evidence) within Japan.

As with the world's largest firms noted above, every company listed here is a specialized (B2B) firm serving internal corporate fraud investigations, cyber-incident response, or investigative agencies such as the police. None of them is a ‘consultation window’ or an ‘agent for asset recovery procedures’ for an individual who has been defrauded. Bearing that in mind, use the following as a reference for comparing the technical backbone of Japan's advanced forensics firms.

Company

Area of Focus

B2B / B2C

Track Record

Official URL

Digital Data Forensics

Digital artifact analysis, fraud and hacking investigation

B2B (individual clients: mainly device-based investigation)

Track record of investigative cooperation with the police and investigations for major corporations

https://digitaldata-forensics.com/

PwC Japan (Forensics)

Fraud investigation, cyber-incident response, various consulting services

B2B

Extensive track record as a global consulting firm

https://www.pwc.com/jp/ja/services/forensic/fraud-investigation.html

LAC Co., Ltd.

Cybersecurity, emergency incident response

B2B

Operates JSOC, one of Japan’s largest security monitoring centers

https://www.lac.co.jp/

Deloitte Tohmatsu

Digital forensics, fraud risk management

B2B

Extensive track record in large-scale accounting/fraud investigations and international litigation support

https://www.deloitte.com/jp/ja/services/consulting/perspectives/digital-forensics.html

FRONTEO, Inc.

Legal tech; AI-driven support for international litigation and fraud investigation

B2B

Extensive track record in eDiscovery and other aspects of international litigation

https://legal.fronteo.com/security/

Mitsui Bussan Secure Directions, Inc.

Malware analysis, penetration testing, incident response

B2B

Advanced cybersecurity track record backed by a general trading company group

https://www.mbsd.jp/

Broadband Security, Inc.

Security auditing, forensics and incident response

B2B

Track record supporting PCI DSS compliance and incident response for government bodies and companies

https://www.bbsec.co.jp/

Cyber Defense Institute, Inc.

Penetration testing, advanced incident response

B2B

Track record providing security support to various critical infrastructure operators and government bodies

https://www.cyberdefense.jp/

Ernst & Young ShinNihon LLC

Blockchain-related audit, assurance, and governance

B2B

Track record in governance and auditing of Web3 and crypto-asset-related businesses

https://www.ey.com/ja_jp/services/blockchain

Fortience Consulting

Management consulting, DX and security support

B2B

Formerly QUNIE (renamed October 2025); track record with major corporations and government bodies

https://www.fortience.com/

Anchor Technologies

Authorized Chainalysis reseller; tool deployment and operational support

B2B

Support deploying advanced analytics tools for financial institutions and CEXs

https://anchor-u.com/product/chainalysis/

As this shows, the digital forensics services offered by Japan's listed companies, major consulting firms, and dedicated security vendors are advanced B2B (organization-facing) infrastructure for maintaining corporate governance, handling legal disputes, and countering nation-state-scale cybercrime.

None of these companies is a window an individual victim can access directly to seek a ‘refund’ or to ‘pursue the perpetrator.’ Even if you want the cooperation of a private forensics firm for the purpose of submitting an investigation report to the police or a court, applying directly as an individual is not the way to do it. Retaining a ‘lawyer experienced in crypto assets and cybercrime’ as your legal representative first, and then coordinating with these specialized firms through that lawyer (or through a police request), is the only correct process that carries genuine legal effect.

What to Do First If You Become a Victim

When you are hit by crypto asset fraud or hacking, panicking and acting blindly only makes the situation worse. To trace where the outflowed assets went and eventually connect that trail to legal procedures and an investigation, everything hinges above all on ‘calm evidence preservation in the initial response.’ This section explains the concrete steps to take immediately after discovering you have been victimized.

Preserving Evidence (Saving Transaction History and Correspondence)

No institution can act—whether it's a police consultation, a legal process through a lawyer, or a technical investigation request to an investigation firm—without objective ‘evidence.’ Immediately after the incident, be sure to strictly preserve the following data exactly as it is, in an unaltered form (by taking screenshots and downloading the data).

  • Transaction history from the crypto asset exchange (transaction data) — Be sure to record the ‘source address,’ ‘destination address,’ ‘transfer date and time (timestamp),’ and ‘transfer amount (quantity and currency type)’ from the unauthorized transfer or the transfer you made to the fraudulent operator, as well as the ‘transaction hash (TxID)’ that uniquely identifies the transaction. If possible, download the raw transaction history data from the exchange in a CSV or similar format.
  • The complete history of all communication with the other party — Save everything by screenshot before the account is deleted: solicitation messages on social media (X, Instagram, etc.) or a matchmaking app, conversation content on chat apps such as LINE or Telegram, and any instruction screens you were shown when encouraged to invest. At this stage, keeping not just the other party's ‘account name’ but also their unique ‘user ID’ and ‘profile page URL’ is extremely important for later identifying the perpetrator.
  • Records of the fraudulent website or wallet connection — Also save, as records, the URL of the fake investment site you were directed to, the wallet operation screen at the moment you approved a smart contract, and any account-opening manuals or URLs sent to you by the other party.

In most cases, once the other party deletes their account or takes down their website, this digital data can never be obtained again. Before rushing to confront the other party, put all your effort into first preserving every piece of electronic data you have on hand.

The Priority Order for Who to Consult (Public Windows → Lawyer → Investigation Firm)

Once you have preserved the evidence, the next thing that matters is the order in which you approach the various windows. Rather than rushing to a private operator, proceed step by step in the following order of priority.

  • First priority: Public windows (the Consumer Hotline ‘188’ and the police) — Give top priority to objectively organizing the situation through a consultation via ‘188,’ and to filing a victim report with your nearest police station (cybercrime consultation desk) or otherwise building a documented history of consultation. Contacting public institutions at the outset is the absolute foundation for every legal remedy procedure that follows.
  • Second priority: A lawyer experienced in crypto assets and cybercrime — In parallel with, or immediately after, consulting the police, consult a lawyer—the only party who can carry out ‘effective recovery procedures’ such as civil refund negotiation, requesting an account freeze at a domestic or overseas exchange, or filing for a court preservation order. It is essential to choose a law firm well-versed in how crypto assets work and in IT (for concrete guidance on how to consult a lawyer and how to choose one, see our separate article on how to choose a lawyer to help recover crypto asset losses (in Japanese)).
  • Third priority: A technical investigation firm (forensics company), if needed — Only consider requesting a private investigation firm once the police or your lawyer determine that ‘a detailed on-chain data analysis report would let the investigation or seizure procedures move forward more quickly.’ Absolutely avoid ignoring this order and paying a large sum on your own to a private operator suspected of violating the Attorney Act (unauthorized legal practice).

Proceeding calmly, step by step, is the only way to prevent further financial and emotional secondary victimization and maximize the chances of recovering your assets.

Conclusion: Access the Right Consultation Windows

When facing crypto asset hacking or fraud, what you should be most wary of is secondary victimization by opaque private operators who exploit panic and claim ‘we will definitely get your money back.’ Even if you can trace the movement of funds on the blockchain, the legal authority to freeze an account or negotiate a refund is granted only to a limited set of institutions such as the police and lawyers. Strictly preserving the transaction hash (TxID) and communication logs you have on hand, and consulting a public window such as the Consumer Hotline (188) or the police as a top priority, is the golden rule for a safe resolution.

If you then want to consider civil legal procedures, consulting a lawyer well-versed in how crypto assets work technically and in the realities of overseas exchanges becomes an option, but you need to carefully vet whoever you choose to hire. This site provides, from an objective standpoint, information on law firms nationwide with strengths in Web3 and IT, along with the basic knowledge of the correct legal process to follow when facing this kind of trouble.

Don't try to handle it alone—first make use of a trustworthy public institution's window, and calmly determine your next step. The information on specialized firms and the selection guidelines featured on this site are also available to you as objective material for resolving your trouble safely and reliably.

This article is for informational purposes only and does not constitute financial or investment advice. Please consult a qualified professional before making investment decisions.