Background
The client — a professional in their 40s — met a person claiming to be an overseas business owner on a mainstream dating application. After six weeks of daily communication, the contact introduced a cryptocurrency investment platform and demonstrated what appeared to be consistent profits. The client made eight deposits over three months totalling $127,000 in Bitcoin and Ethereum. When they attempted to withdraw funds, the platform cited a tax compliance issue requiring a further $18,000 payment. The client contacted us the day after refusing this payment.
How the Scam Operated
The scammer used a professionally created persona with consistent social media presence and a convincing backstory. Communication was moved from the dating app to WhatsApp within days, and emotional investment was built over weeks before cryptocurrency was introduced.
The investment platform appeared sophisticated — with live charts, a customer service chat function, and an account dashboard showing fabricated profits. The platform's domain had been registered three months prior. Multiple payment addresses were provided across both the Bitcoin and Ethereum networks.
Funds were swept from each deposit address within hours of receipt and routed through a layered structure of intermediate wallets before being consolidated at a deposit address belonging to a major regulated exchange.
Our Approach
We secured all transaction IDs, communication records, and platform details provided by the client and began on-chain analysis within two hours of engagement.
We traced all eight deposit transactions across the Bitcoin and Ethereum networks, mapping the full 14-wallet chain from the client's wallets to the exchange deposit address.
The consolidated exchange deposit address was identified as belonging to a major regulated exchange with established law enforcement cooperation processes.
We submitted a comprehensive forensic package to the exchange's compliance team, including transaction maps, timing analysis, and supporting evidence from the client. The account was frozen within 72 hours of submission.
We assisted the client in filing a report with the relevant US cybercrime authority, which supplemented the exchange cooperation request and accelerated the return process.
Challenges We Overcame
- Funds were split across two blockchains, requiring parallel tracing operations on both Bitcoin and Ethereum networks.
- The intermediate wallet chain included a mixing step on the Ethereum network which required additional analytical techniques to trace through.
- The exchange's initial response required supplementary documentation — a second forensic submission was prepared and submitted within 48 hours.
- The client was simultaneously targeted by a secondary recovery scam during the engagement, requiring us to advise them on avoiding further loss.
Outcome
Final Outcome
The full $127,000 was returned to the client's nominated bank account 38 days after the case was opened. The exchange confirmed the account holder's identity had been flagged with the relevant law enforcement authority. Our success fee was charged as a percentage of the recovered amount — nothing was owed until funds were returned.
I spent three weeks convinced I would never see the money again. The team was honest with me from day one — they told me what was realistic and they delivered exactly what they said they would.
Client, United States (name withheld)
Key Lessons
- Romance scam funds reported within the first 72 hours have significantly higher recovery rates — the same exchange chain was still accessible when we began tracing.
- The secondary scam attempt demonstrates that once a victim's details are known, they are targeted repeatedly. Always verify any recovery service before engaging.
- On-chain mixing steps slow tracing but do not prevent it — blockchain forensics tools have specific techniques for tracing through common mixer patterns.
- Exchange cooperation is achievable when forensic documentation is thorough and presented through the correct compliance channels.