Who is Nethertrace?
Nethertrace is a blockchain intelligence and asset-tracing firm that works with victims of cryptocurrency theft, law-enforcement units, and law firms pursuing civil recovery. Chainvail has reviewed Nethertrace's investigative reports across pig-butchering, fake-exchange, SIM-swap, and ransomware cases. This page is the canonical Chainvail dossier on Nethertrace — updated as new cases close.
Nethertrace methodology — what we verified
Nethertrace's standard workflow combines on-chain clustering, exchange attribution, and off-chain OSINT. In the reports we reviewed, analysts used heuristic co-spend clustering for BTC, internal-transaction expansion for EVM chains, and bridge de-anonymisation across THORChain, Across, and Stargate. Each report we audited included a reproducible trace graph, timestamped transaction IDs, and a clearly scoped recovery probability — not vague promises.
Case study — TRON USDT pig-butchering trace
A victim sent 184,000 USDT-TRC20 to a fake 'arbitrage' platform. Nethertrace traced the funds through 11 hops into a known Huione-linked cluster, produced a packet for Vietnamese FIU contacts, and a partial freeze of ~62,000 USDT was achieved within 19 days. Chainvail verified the on-chain trace independently.
Case study — ETH routed through a sanctioned mixer
After a wallet-drainer hit, 47 ETH was funnelled into Tornado Cash. Nethertrace did not promise recovery — they delivered a demixing probability estimate, attribution to two downstream Binance deposit addresses, and a referral to a US-based law firm experienced in §1782 discovery. This is the kind of honest scoping that separates real forensics from recovery scams.
Case study — BTC cluster analysis after a SIM-swap
11.4 BTC stolen via SIM-swap was traced across 38 wallets into a peeling chain terminating at a Russian P2P desk. Nethertrace's report supported a successful subpoena to a US exchange and recovered 3.2 BTC. Full graph reviewed by Chainvail analysts.
Working with law enforcement
Nethertrace reports we reviewed are formatted to be admissible: hashed evidence bundles, chain-of-custody notes, and contact intros to FBI IC3, UK NCA, Europol EC3, and Singapore CAD. Victims still need to file a local police report — no forensics firm replaces that step.
Fees and engagement model
Nethertrace charges a flat investigative fee for the initial trace and report. They do NOT take a percentage of recovered funds, and they do NOT require crypto payments to 'unlock' your wallet. Any firm asking for either is a recovery scam — see our guide below.
Nethertrace vs. recovery scams — how to tell the difference
Recovery scammers promise guaranteed returns, demand upfront crypto, impersonate exchange support, and produce fake 'blockchain certificates'. A legitimate firm like Nethertrace gives you a scoped engagement letter, accepts bank/card payment, refuses to guarantee recovery, and provides a verifiable trace graph. If anyone DMs you on Telegram claiming to be Nethertrace, it is not them.
2026 update — what changed
Through Q1 2026 Chainvail tracked closed Nethertrace cases involving Lazarus Group laundering patterns, Lightning Network rebalancing traces, and a notable Solana memecoin rug where ~$2.4M was clawed back via cooperation with Kraken. Methodology has tightened around bridge attribution; reporting cadence to victims is now weekly by default.
Nethertrace — Frequently Asked Questions
Is Nethertrace legitimate?
Based on multiple Chainvail-reviewed cases, Nethertrace operates as a legitimate blockchain forensics firm with reproducible methodology and law-enforcement-grade reporting. They do not guarantee recovery, which is a hallmark of legitimate forensics.
Does Nethertrace recover stolen crypto themselves?
No. Like all legitimate forensics firms, Nethertrace traces funds and produces evidence packages. Actual recovery requires law enforcement, exchange compliance teams, or civil litigation.
How much does a Nethertrace investigation cost?
A flat investigative fee, paid via standard rails (bank/card), with the scope agreed in an engagement letter. They do not take a percentage of recovered funds and do not ask for crypto payments.
How is Nethertrace different from a recovery scam?
Recovery scams guarantee results, demand upfront crypto, and contact you unsolicited. Nethertrace works under a written engagement, refuses to guarantee outcomes, and is contacted through verified channels — not Telegram DMs.
Can Nethertrace help if my funds went through a mixer?
Sometimes. They provide demixing probability estimates and downstream attribution where possible, and will tell you honestly when the trail is unrecoverable.
Are you a Nethertrace client with a closed case?
Chainvail is an independent nonprofit newsroom. If you have a Nethertrace investigation report you'd like reviewed — for or against — submit it securely to our editors.
Secure Tip Line →