Clients often arrive with a screenshot and a request to “trace the coins.” The useful question is narrower: which proceeds can still be identified, which exchanges can be ordered to act, and which conclusions a court will accept.
Moving assets from one blockchain to another is now ordinary. Bridges and swaps are the usual path out of a compromised wallet. A trace that stops at the first bridge is not a trace. The work is to follow the value, not one token contract, and to say when the link is too weak to allege.
Mixers are a fact, not a plot twist. Some are cooperative with process in limited ways; many are not. Heuristics that cluster post-mix activity can be leads. They are rarely, by themselves, proof. We label them that way in every report, because overclaiming is how a good freezing order becomes a bad precedent.
The legal steps have to be chosen while the trace is still moving. Preservation letters to exchanges, disclosure orders against banks that on-ramped the attacker, and criminal referrals are not sequential chapters. They run together, or the assets do not wait.
If you are writing an incident plan, name the person who can retain investigators without a committee, the outside counsel who will sign the letters, and the forum you will use if the main venue is in New York or Singapore. Decide it before the Sunday call.
This note is general information, not advice about your facts. Read the disclaimer.