What it costs to recover stolen ETH in 2026.

Three things move the cost of an on-chain investigation: how cold the trail is when you arrive, how many hops the funds have taken before the investigation opens, and how many of those hops crossed a privacy mixer or a centralized exchange. Everything else is roughly fixed.

A clean trace — funds were taken in the last seventy-two hours, no mixer, one or two bridges at most — is the cheap version of the work. Block heights are recent, the heuristics that work in the first week have not yet decayed, and exchange deposits are still resolvable through fresh subpoena requests. The work is mostly graph reconstruction and exchange liaison.

A cold trace — six months out, multiple mixer hops, terminal addresses now sitting cold — is the expensive version. The same heuristics are noisier at distance. Mixer pools have rolled. Exchange deposit attribution requires preservation requests that may already have aged out. The work shifts from reconstruction to probabilistic argument: here is a candidate path, here is the confidence band, here is the evidence that supports it.

So what does it actually cost?

For a clean trace on a modest amount (under fifty thousand dollars, last few weeks, one or two hops), expect a fixed-fee engagement starting at four to six thousand dollars for individual clients, and slightly higher for counsel-engaged or agency-engaged matters. The deliverable is a written report and an evidence packet ready for your counsel, your investigator, or your exchange contact.

For a moderate-complexity trace (fifty thousand to a million, multiple hops, at least one mixer crossing), expect eight to twenty thousand. The work is sustained — usually two to four weeks — and the report includes both the on-chain analysis and the off-chain coordination needed to put your counsel or law-enforcement contact in front of the right exchange or bridge protocol.

For a complex multi-million-dollar matter with extensive mixer activity or sustained multi-jurisdictional coordination, expect twenty to seventy-five thousand, sometimes more. Here we quote against scope, not against an estimate.

Four things are deliberately not on this list.

We do not work pro-bono. Every engagement runs on a written agreement and an invoice — including agency engagements at the standard rate. We are happy to discuss scope to fit a budget; we are not in a position to absorb the cost of the work.

We do not work on contingency, ever. Contingency-only crypto recovery is a structure that selects for matters where the investigator has financial interest in the outcome. That is a problem on civil matters. It is a non-starter on anything that may eventually involve law enforcement.

We do not appear in court. We deliver evidence packets to the requesting officer or to counsel of record. Courtroom presentation, sworn declarations, and depositions are not part of our scope — that work stays with the agency and the prosecutor, or with counsel.

We do not promise recovery from the chain itself. Public ledgers are immutable. Self-custody wallets are non-penetrable by design. Any firm promising guaranteed on-chain recovery deserves a hard second look. What we deliver is the truth of where funds went, who controls them now, and the evidence packet your counsel or investigator needs to act on it.

If your case is a clean trace and we are the right firm, you will know inside the first week. If your case is cold and the math doesn't work, we will say so during the discovery call rather than open the engagement.