Crypto Incident & Fraud Response (Freezes, Scams, Evidence Preservation) — Coordinated via Bosnia
If you are dealing with a crypto scam, a frozen exchange account, a wallet compromise, or unauthorized transfers, speed and documentation quality matter. This service is designed for clients from the United States and Canada who need structured, cross-border support: we preserve evidence, build a coherent legal and compliance narrative, communicate with exchanges/banks/PSPs, and coordinate with local counsel where required.
We do not promise “guaranteed recovery.” We focus on maximizing your chances through fast evidence preservation, coherent communications, and correct cross-border escalation.
Situations we handle
We focus on cases where legal positioning, evidence quality, and communications strategy materially affect outcomes. Typical scenarios include:
1) Exchange account frozen
Account restrictions, enhanced due diligence (EDD), KYC/SoF/SoW requests, withdrawal blocks, “risk review” holds.
- Build a coherent compliance narrative
- Package evidence (SoF/SoW, transaction history)
- Communicate with compliance without contradictions
2) Bank freeze / de-risking
Account closures, transaction reversals, compliance escalations due to crypto-related activity, merchant disputes.
- Evidence pack for bank compliance
- Transaction explanation narrative
- Remediation plan (controls improvements)
3) Investment scam / impersonation
Fake investment platforms, “pig butchering,” impersonation of exchanges, brokers, or law firms, social engineering.
- Preserve evidence & timeline
- Coordinate reports and requests
- Prevent secondary scam losses
4) Wallet compromise / unauthorized transfers
Seed phrase theft, malware, SIM swap, phishing, compromised hot wallets, unauthorized signing.
- Evidence preservation
- Counterparty notifications
- Recovery strategy planning
5) PSP/merchant disputes & holds
Reserves held, settlements paused, chargeback-driven freezes, KYB disputes, “high-risk” classification issues.
- Bank/PSP narrative and evidence
- Operational remediation
- Negotiation support
6) Multi-jurisdiction escalation
Cases involving multiple countries, exchanges, banks, and service providers, requiring coordinated steps.
- Cross-border coordination
- Local counsel involvement where needed
- Evidence consistency across jurisdictions
First 24 hours checklist (do this before you lose evidence)
If you’re in an active incident, these steps reduce damage and preserve your ability to act. We can guide you through them, but if you need to act immediately, start here:
Evidence preservation
- Save screenshots of the platform, chat logs, emails, and case IDs
- Export transaction history (exchange + wallet + bank if relevant)
- Record TXIDs, addresses, timestamps, and amounts
- Preserve KYC communications and all compliance requests
- Save the website URL, domain info, and any payment receipts
Containment and safety
- Stop further access: rotate passwords, revoke sessions, secure email
- Move remaining funds to a safer wallet (if possible and safe)
- Do not pay “recovery agents” or “unlock fees”
- Do not send contradictory explanations to compliance teams
- Document every step you take (timeline)
What you receive (deliverables)
Deliverables depend on your scenario. Our focus is always the same: evidence quality, coherent narrative, and the right escalation path.
| Deliverable | What it includes | What it helps achieve |
|---|---|---|
| Evidence pack & timeline | Structured case timeline, supporting files index, transaction references (TXIDs), screenshots, communication logs. | Preserves your ability to act; supports counterparties and law enforcement communications. |
| Compliance narrative (SoF/SoW / activity explanation) | Clear explanation of source of funds / source of wealth, transaction purpose, and supporting evidence structure. | Helps unlock freezes and reduces “inconsistency” flags. |
| Letters / structured communications | Drafted messages/letters to exchanges, banks, PSPs, or counterparties; evidence attachments strategy. | Improves response quality and reduces escalation friction. |
| Cross-border coordination plan | Jurisdiction map, recommended escalation steps, when to involve local counsel, and what to request. | Prevents random actions; aligns steps across countries. |
| Remediation plan (optional) | For businesses: controls improvements, updated AML/KYB flow, monitoring changes, vendor risk actions. | Helps prevent repeated freezes or de-risking. |
We can coordinate with local counsel where required. We do not impersonate law enforcement and we do not provide “guaranteed recovery” promises.
Process: how we handle cases
Crypto incidents require a structured approach. We prioritize speed, evidence integrity, and consistent messaging.
Intake + NDA (if needed)
We collect a concise description of what happened, affected platforms, TXIDs, and current status. NDA can be signed before you share sensitive documents.
Evidence preservation & case map
We create a timeline, list all counterparties, identify critical missing evidence, and structure the case file so it remains consistent under scrutiny.
Communications strategy
We prepare structured communications to exchanges/banks/PSPs, align narrative with evidence, and avoid contradictions that increase risk flags.
Escalation & coordination
Where appropriate, we coordinate cross-border steps and involve local counsel. We track responses and refine the approach based on counterparty feedback.
What we need from you (to start)
Minimum information
- Platform(s) involved (exchange, wallet, bank, PSP)
- Case IDs and support ticket references
- TXIDs, addresses, timestamps, amounts
- What exactly is frozen/compromised and since when
- What actions you already took (timeline)
Helpful documents (if available)
- Transaction exports (CSV, screenshots)
- Emails/chats with the platform(s)
- KYC/EDD requests and your prior responses
- Bank statements or payment confirmations (if relevant)
- Any scam platform URLs, receipts, or domain info
Safety note: avoid secondary scams
After an incident, victims are often targeted by “recovery services” promising guaranteed refunds—usually a scam. Be cautious with anyone asking for upfront fees to “unlock” funds, requesting seed phrases, or insisting on secrecy.
Never share seed phrases
Legitimate support will not ask for your seed phrase or private keys.
Beware of “unlock fee” requests
Scam platforms often demand additional payments to release funds.
Don’t rush communications
Contradictory explanations can worsen freezes and reduce credibility.
FAQ
Do you guarantee recovery of stolen funds?
No. No one can guarantee recovery outcomes. We maximize your chances through fast evidence preservation, coherent communications, and correct cross-border escalation.
Can you help with frozen exchange accounts and enhanced due diligence (EDD)?
Yes. We help structure your response to compliance teams: source of funds/wealth narrative, transaction history, and evidence packaging, while avoiding contradictions and preparing for follow-up questions.
How is confidentiality handled?
We can sign an NDA before you share sensitive information. We request only what is necessary and can use secure channels for file exchange.
Do you work with US/Canada clients?
Yes. We frequently work with cross-border scenarios and coordinate steps across jurisdictions, involving local counsel when required.
What if I already reported the scam to the platform or police?
That’s fine. We will integrate existing reports and communications into a consistent case file and refine the strategy based on the responses you received.
Contact BHL
If this is urgent, write a short message with: platform(s) involved, what is frozen/compromised, TXIDs (if any), and current status. We’ll respond with next steps and can proceed under NDA for sensitive disclosures.
Disclaimer: This page is for general informational purposes only and does not constitute legal advice, an individualized recommendation, or a public offer. Scope, deliverables, timelines, and fees are confirmed in a signed engagement. Outcomes depend on third parties, evidence availability, and jurisdiction-specific procedures.