Independent on-chain investigation
MBTrace
We show where the funds went.
On-chain investigation PDF for counsel or police — a KYC cash-out to write to, or a clear dead end. From $50+, quoted per case. Not a recovery service.
Read this first
We are not a crypto recovery shop.
The recovery space is full of scammers. MBTrace sells a paid investigation report — nothing else.
- We never ask for your seed phrase or private keys.
- We never promise guaranteed recovery or a refund of stolen funds.
- We never charge a percentage of “recovered” value or an upfront recovery fee.
01 — Scope
What we do. What we do not.
If you need someone who promises to get the coins back, that is not us — and you should treat that promise as a red flag.
What we do
- Trace funds on-chain from a source address or transaction hash.
- Look for where value enters a KYC service that can receive a letter.
- Deliver a PDF evidence report you can give to a lawyer or the police.
- State a clear dead end when the trail has no defensible recipient.
What we do not
- Recover, reverse, or freeze stolen crypto.
- Give legal advice or file a case on your behalf.
- Ask for seed phrases, private keys, or wallet passwords.
- Sell a percentage of “recovered” funds or a guaranteed outcome.
Transaction flow
Example path — not a live wallet.
Addresses and amounts are fictional.
- 01
Start address
Source wallet
18 ETH
- 02
Intermediary
First hop
11.4 ETH
- 03
Intermediary
Output split
6.2 ETH
- 04
Cash-out
KYC exchange
4.1 ETH
02 — How it works
Four steps from panic to a document.
An analyst reviews your case before any payment. Typical delivery is 24–48 hours after you pay.
01
Report a case
Send network, source address or hash, time window, and a short description — by form or Telegram @MBTraceBot.
02
Analyst review
An analyst looks at the material. If we cannot take the case, we decline it and you pay nothing.
03
Pay after acceptance
Only after review and acceptance do you get a quote and pay — crypto or Stripe. From $50+, quoted per case.
04
Receive the PDF
You get an investigation report: path, labels with confidence, cash-out or clear dead end — typically in 24–48h.
03 — What you get
A PDF you can hand to counsel or police.
You pay for a path you can defend — not a chat thread and not a recovery fantasy.
- 01
Flow tracing
A graph from the source event: bridges, swaps, splits, peel chains. Backward only when it establishes origin.
You get a path, not a dump of the whole chain.
- 02
Service attribution
An address gets a label only where it can be defended: known contract, hot wallet, public cluster. Everything else stays unknown.
You get confidence next to every label.
- 03
Cash-out point
We look for where value leaves the chain or enters a KYC service. That is usually the only practical letter recipient.
You get a recipient — or a clear “none”.
- 04
Letter-ready material
Hop, amount, time, hash, limitation. Language counsel, compliance, or an authority can attach without translating jargon.
You get a document, not a chat thread.
04 — Console
Three cases. One way of reading.
Examples are fictional. Each hop has amount, time, and confidence. The last case ends without a cash-out — and stays that way.
Victim signs on a fake positions panel. Funds leave Ethereum for Tron and enter a known KYC exchange hot wallet.
MB-DEMO-014 · 12 Mar 2026 · 14:02–15:40 UTC · 18.60 ETH
Swipe sideways to see further hops.
Hop 1 of 6 · Source
Victim wallet
Address provided by the reporter. Funds leave in a single transaction with no earlier movement that day.
- Network
- Ethereum
- Amount
- 18.60 ETH
- Confidence
- high
- Address
0x91c4A7b18E9033D2C0aA91E77b1D44c8e2Ab0914
05 — Report
An extract you can attach to a letter.
This document follows the case selected in the console. In a real file, hashes sit beside the table — and a sentence for what on-chain cannot show.
Sample extract
MB-DEMO-014
Wallet drain · 12 Mar 2026 · 14:02–15:40 UTC
Fictional addresses and amounts. For illustration only.
| Hop | Time | Network | Event | Amount | Confidence |
|---|---|---|---|---|---|
| 1 | 14:02 | Ethereum | Victim wallet | 18.60 ETH | high |
| 2 | 14:02 | Ethereum | Draining contract | 18.60 ETH | high |
| 3 | 14:11 | Ethereum | Swap to USDT | ≈ 18.41 ETH | medium |
| 4 | 14:19 | Ethereum → Tron | Bridge to Tron | ≈ 18.22 ETH | high |
| 5 | 15:02 | Tron | Split across four addresses | 4 outs | low |
| 6 | 15:40 | Tron | KYC exchange hot wallet | ≈ 11.4 ETH | high |
Finding
About 61% of value enters an identified KYC exchange deposit within two hours. That is a letter recipient — not a recovery promise.
What the report does not claim
A service hot wallet is visible, not a named person’s account. The split immediately before deposit was not tied to a single deposit id.
06 — Method
First question: does the graph have a chance.
If there is nobody to write to at the end, the document says so. That is the whole method.
01
Scope
Hash, network, time window, who is reporting. If the material cannot start a graph, we say so before work begins.
02
Graph
Forward from the event. Every branch stays in the case or drops — with a reason, not a hunch.
03
Attribution
Known service or no label. We do not stretch an exchange name we cannot defend under “how do you know.”
04
Document
Finding and boundary sit side by side. If the trail dies in a mixer, the report says so. No forced ending.
Networks in standard scope
- Bitcoin
- Ethereum
- Arbitrum
- Base
- Polygon
- BNB Chain
- Tron
- Solana
Outside this list we discuss before starting — not mid-graph.
07 — Pricing
Quoted per case. From $50+.
An analyst reviews every case before any payment. If we cannot take it on, we decline and you pay nothing. Typical delivery 24–48h after payment; complex graphs may take longer.
From
$50+
Quoted in USD. EUR and PLN equivalents available on request.
Typical turnaround
24–48 hours
Payment after review
Crypto · Stripe
You pay only after an analyst has reviewed and accepted the case. No percentage of “recovered” funds — we do not sell recovery.
Questions
Before you send anyone a seed.
No. Blockchain transactions cannot be reversed, and we do not take a cut of a recovery promise. We show where funds went and whether a KYC service exists to write to.
08 — Intake
Send details to the bot — or through the form.
Share how to reach you, the network, and an address or hash. Never paste a seed or private key.
Never send a seed phrase, private key, or screenshots that reveal them.