Scam / Theft Investigation
Trace stolen funds, map wallet clusters, flag service touchpoints, and prepare a case file.
Canadian digital asset investigation practice
Find out what can actually be done after a crypto loss.
NorthLedger helps Canadian victims of scams, theft, account compromise, missing transactions, and wallet-access loss move from confusion to a qualified investigation plan.
Ethereum · 4 hops · 9 addresses
- Value out
- 4.20 ETH
- First hop
- 14:02 UTC
- Pattern
- same-day sweep
- Endpoint
- hosted service
Case pipeline
- Triage complete
- Evidence · 2 open
- Forensic report
- Partner routing
Reading this: the money left the victim’s wallet, was split across throwaway addresses to break the trail, then regrouped and landed at an exchange. An exchange is a regulated business with a compliance desk, which is what makes recovery possible.
- Your keys stay yours
- Guarantees are a red flag
- Crypto payment never required
The scale of the problem in Canada
These are reported national figures, not NorthLedger results. They are why a qualified triage step matters before anyone pays for investigation work.
$0.0M
Reported losses to cryptocurrency investment scams in Canada
2025 · CANADIAN ANTI-FRAUD CENTRE
$0M
Total fraud losses reported nationally, the highest year on record
2025 · CANADIAN ANTI-FRAUD CENTRE
0%
Upper estimate of fraud that is ever reported at all, so real losses run far higher
CAFC ESTIMATE · 5–10%
Figures as reported by the Canadian Anti-Fraud Centre for 2025. Check them yourself. NorthLedger is an independent private practice and is not affiliated with, endorsed by, or acting on behalf of the Canadian Anti-Fraud Centre, the RCMP, or any police service.
Recovery is never guaranteed. Legal, investigative, or enforcement steps may be provided by appropriately licensed Canadian partners. NorthLedger does not custody client assets at launch.
Case types
What happened to your crypto?
The first assessment is designed to decide whether there is a real transaction trail, a realistic next step, and enough evidence to justify paid work.
Free assessment
Submit the facts. We qualify the case before paid work starts.
Free triage is limited to a practical review of your evidence. It is not a full forensic report, legal opinion, or recovery guarantee.
- Confirm whether the transaction exists on-chain.
- Identify the first destination and obvious service exposure.
- Score urgency, evidence quality, and recovery pathway.
- Recommend whether paid investigation is worth considering.
If a transaction cannot be located or traced, we will tell you. A clear “this is not worth paying to investigate” is a legitimate outcome of the free assessment, and it costs you nothing.
Report it officially as well. Whatever you decide about paid work, Canadian victims can report fraud to their local police service and to the Canadian Anti-Fraud Centre. Filing early costs nothing and strengthens any later escalation to an exchange or a court.
Free case assessment
Five fields are required. Gaps are normal at this stage, and a missing hash or date does not disqualify a case. You get back a written read on whether the transaction can be traced and whether paid work is worth it. “It is not worth it” is a real answer, and it costs you nothing.
We have your case.
It is logged and queued for triage. Keep the reference below; quote it in any email to us. You will get a written update at every stage, and you never need to chase us for one.
Nothing has been sent yet. Use the button below to send the summary to our intake address from your own email client — your details stay in your hands until you choose to send them.
Draft reference
NL-0000
- We confirm receipt and check whether the transaction can be located on-chain.
- You receive a plain-language triage summary: what we can see, and what we cannot.
- If, and only if, there is a realistic pathway, we quote paid investigation work.
We could not reach our intake service just now, so nothing has been logged. Your answers are safe below — send them by email and we will pick it up from there.
Send summary to intake@northledger.claimsNo mail app? Copy the summary and send it to intake@northledger.claims from webmail.
Services
Investigation first. Recovery coordination second.
The model is built around evidence, chain-of-funds analysis, and proper partner routing. It is not a promise to “get your crypto back.”
Transaction Resolution
Diagnose wrong-network deposits, unsupported tokens, stuck transfers, memo/tag errors, and bridge disputes.
Wallet Access Recovery
Coordinate non-custodial wallet recovery work for forgotten passwords, damaged files, and hardware wallet cases.
Full Asset Recovery Coordination
Coordinate exchange escalation, legal notices, licensed investigative partners, and documentation where appropriate.
Method
A controlled path from loss report to action plan.
Each stage has a defined output and a decision point. Nothing moves to the next stage, and nothing is billed, until the previous one justifies it.
Time matters most at stage one. Funds that reach a hosted service can sometimes be frozen if the exchange is notified quickly and with the right documentation. That window is measured in days, not months.
Free triage
Review the basic facts, evidence quality, and whether the transaction can be located.
Output: go / no-go recommendationCase qualification
Score urgency, loss size, traceability, likely destination services, and partner requirements.
Output: scope and fixed quotePaid investigation
Produce a structured forensic report, evidence bundle, and recommended escalation path.
Output: forensic report and evidence bundleRecovery coordination
Route exchange, legal, or licensed investigative steps through the right partner where required.
Output: partner-led escalation and follow-through
Coverage & capability
What we can actually look at.
Tracing quality depends on the chain, the tooling, and how the funds moved. This is where our analysis is strongest, stated plainly rather than implied.
BTC
StrongBitcoin
UTXO clustering, peel chains
ETH
StrongEthereum
Tokens, contracts, internal txs
TRX
StrongTron
High-volume stablecoin flows
SOL
ModerateSolana
SPL tokens, program transfers
BNB
StrongBNB Chain
BEP-20, bridge activity
POL
ModeratePolygon
Bridged assets, L2 exits
L2
ModerateArbitrum · Optimism · Base
Rollup traces and withdrawals
XMR
Not traceablePrivacy coins
Generally not traceable, and we say so
Traceability describes how far funds can usually be followed on that chain with current tooling. It is a general rating, not a prediction about your case.
Where a chain, mixer, or privacy protocol defeats analysis, that is a finding we report rather than a reason to keep billing. Coverage is not a promise of attribution on any specific case.
- Chain-of-funds tracing across multiple hops, with wallet clustering and consolidation patterns.
- Service exposure identification where funds touch exchanges, bridges, or other hosted services.
- Evidence packaging in a structured format suitable for exchange compliance teams and counsel.
- Transaction diagnostics for wrong-network deposits, memo/tag errors, and stuck bridge transfers.
- Exchange escalation support including the documentation those teams actually require.
- Licensed partner routing for legal notices, private investigation, and enforcement steps.
Trust & safety
Built to avoid the behaviours that make recovery sites risky.
Most crypto-recovery complaints trace back to the same handful of practices. These are the ones we have designed out.
Never seed phrases or keys
No part of our process requires them. If anyone claiming to be from NorthLedger asks, it is not us.
Never guaranteed recovery
Outcomes depend on where the funds went and who controls them. We tell you the odds, not a promise.
Never required crypto payment
Fees are payable through normal traceable channels. Demanding crypto up front is a common fraud pattern.
Never custody recovered assets
At launch we do not hold client funds. Anything recovered moves to accounts you control, or through a licensed partner.
Partner-led regulated work
Legal advice, private-investigation services, and enforcement steps are handled by appropriately licensed Canadian partners, not by us.
Privacy by design
We collect what the investigation needs and nothing more. Your case details are not used as marketing material.
Pricing
Free assessment first. Paid work only after qualification.
You will know the scope and the price before anything is charged. No case proceeds to paid work without a qualification step.
Free Case Assessment
C$0 Triage only, no obligation- On-chain existence check
- Evidence and urgency scoring
- Honest go / no-go recommendation
Transaction Resolution
C$450–950 Per transaction issue- Wrong-network and memo/tag diagnosis
- Bridge and stuck-transfer review
- Exchange ticket documentation
Forensic Report
C$3,500–12,000 Scoped after qualification- Chain-of-funds analysis
- Structured evidence bundle
- Recommended escalation path
Recovery Coordination
Quoted Depends on partner requirements- Exchange escalation handling
- Licensed partner routing
- Documentation and follow-through
Final pricing depends on complexity, evidence quality, urgency, networks involved, and partner requirements. Legal and licensed investigative fees, where they apply, are set by the partner and quoted separately.
Staying informed
You will always know what stage your case is at.
At every stage you get a written update by email: what we found, what is waiting on you, and what happens next. You never have to chase anyone for an answer, and you never have to connect a wallet or hand over a key to see where things stand.
Why it matters: the worst part of a crypto loss is silence. The people who took your money went quiet — the firm you hired should not.
NL-2047
Updating
Example
TriageComplete
Evidence checklist2 items open
Forensic reportPending approval
Partner routingNot started
Example of a stage update. No wallet connection, no key storage, no asset custody — ever.
FAQ
Straight answers to the questions that matter first.
The six things people ask before they will talk to anyone about a crypto loss.
Something here not covered? Put it in the assessment form and we will answer it directly.
Do you guarantee recovery?
No. Nobody credibly can. Whether funds can be recovered depends on where they went, how quickly the trail was followed, and whether a regulated service or court process can reach them. We tell you what the evidence supports and what it does not.
Will you ask for my seed phrase or private key?
Never: not at intake, not during an investigation, not at any point. Nothing we do requires them. Treat anyone who asks for them as a threat, including anyone claiming to be from NorthLedger.
Do I have to pay in crypto?
No. Fees are payable through normal traceable channels. A demand for crypto payment up front is one of the clearest signals of a recovery scam.
What happens after the free assessment?
You receive a plain-language triage summary: whether the transaction was found, where the funds first moved, and whether there is a realistic pathway. If there is, we scope and quote the paid work. If there is not, we say so and you owe nothing.
Are legal or private-investigation services included?
Not from NorthLedger directly. Legal advice, private-investigator work, and enforcement steps are regulated in Canada and are provided by appropriately licensed partners where a case requires them. We coordinate that routing and the documentation around it.
Can you recover lost wallet access?
Sometimes. Cases involving a forgotten password, a partial seed, a damaged wallet file, or a hardware wallet issue are assessed on the technical facts, and the work is coordinated on a non-custodial basis; we never take possession of your wallet. Cases with no remaining recoverable material cannot be solved by anyone, and we will tell you that at triage rather than bill you to find out.
Get started
Before you pay anyone, find out whether the case is worth investigating.
The assessment is free, the answer is honest, and there is no obligation to continue.