- Client
- Digital-asset fund (anonymized)
- Outcome
- Restraining orders and a substantial recovery
The problem
The loss was discovered on a Sunday. Assets had already moved through a bridge, split across dozens of fresh addresses, and begun to touch a mixer. The fund’s existing counsel could describe the hack. They could not yet say where value still sat, or which court could reach it.
Speed mattered more than a perfect complaint. Every hour, a fraction of the proceeds was consolidating toward venues that respond to legal process and a fraction was not.
The work
We stood up a joint team with the fund’s internal security lead. Within the first day we had a transaction graph separating unspent proceeds from dust and change, and a short list of centralized venues with documented deposits. Attribution was labeled by confidence: direct client evidence, behavioral clustering, and weaker heuristics were not treated as the same thing.
Preservation notices went out the same day. We then filed in a forum that could issue interim relief against the two venues actually holding material balances, supported by an affidavit that walked the court through the path in plain language. Parallel criminal referrals were made where the facts supported them, without waiting on civil timing.
The result
Both venues complied with restraining orders. A later negotiated return, combined with assets seized through the criminal process, produced a substantial recovery relative to what remained reachable on day one. Amounts and party names are withheld. The fund kept a playbook for the next incident, including who is authorized to instruct a tracer at 2 a.m.