Forensic report BFR-EXAMPLE — BlockchainFraud

This is an example report, not yours. It was produced by the real engine, from a real address that is genuinely on the U.S. Treasury's sanctions list, so every finding below is a live lookup rather than a mock-up — but the account of events is illustrative. Nobody described this to us. Run your own, free, in about ten seconds.

This matched an official sanctions list or a recognised threat database. We recommend you do not send any further funds.

This is a direct match against an official list or a recognised threat database, the strongest type of finding this report can contain.

Why we are saying that

This address appears on the U.S. Treasury's sanctions list. That is an official government listing. U.S. persons are generally prohibited from transacting with parties on the SDN list. Speak to a lawyer before any further transaction involving this address.

Source: OFAC SDN (Treasury) · concerning 0x098B716B…383E2f96
An independent sanctions screening service also reports this address as sanctioned, which agrees with the official listing.

Source: Chainalysis sanctions oracle · concerning 0x098B716B…383E2f96
The domain is not currently registered, so the link as written does not lead to a website. That can mean it was taken down, mistyped, or never live.

Source: RDAP registration record · concerning coinvestpro-secure-wallet-verify…
What you described matches a documented fraud pattern. A long-grooming fraud in which a synthetic relationship built on a dating app, social platform or 'wrong number' text leads the victim onto a fabricated trading platform showing fictitious profits. The displayed balance is a database entry, not custody of assets. Withdrawal is then blocked behind escalating fees. The submission contains: how contact was made, a payment demanded before withdrawal.

Source: Narrative pattern classifier

The next day or two genuinely matters

This is the window in which the mechanisms that can actually freeze money still reach it. That is not a reason to be hopeful, but it is a reason to move today rather than tomorrow.

We are reasonably confident. Most of the sources we use answered.

What we could not check: the website security-certificate record, the security-researcher database. Those sources did not answer when we asked. We have left them out of the score rather than assuming they would have come back clean — but it does mean this picture is less complete than we would like.

100

HIGH

risk tier · indicator score, not a probability

Reference: BFR-EXAMPLE
Issued: Fri, 16 Oct 2026 06:01:26 GMT
Threat category: Pig Butchering (relationship-led investment fraud) — a characterisation of the described events, not of any named party
Situation: Funds Sent — within the last 72 hours — stated by the submitter on intake
Action urgency: IMMEDIATE — Next 24–72 hours
Signal strength: Strong — the majority of technical sources returned results (how much evidence supports the result; not a probability that fraud occurred)

Download this report as a PDF Download for an AI assistant

The PDF is a real file — hand it to your bank, a lawyer, or the officer taking your report. The text version exists so you can paste the whole thing into ChatGPT, Claude, Gemini or any assistant and ask it questions in your own words: it opens with instructions telling the assistant what it is looking at and what it must not claim. Remove personal details before pasting into third-party AI tools; their privacy terms apply.

How this actually happens

The pattern matched is Relationship-led investment fraud (also called pig butchering, romance investment scam, sha zhu pan). This is the free part of the report and the part to read twice: the mechanism, every red flag the pattern carries, and which of them were present in what you pasted.

Contact begins somewhere ordinary — a dating app, a professional network, or a text that appears to be a wrong number and is answered politely. There is no pitch for days or weeks. The relationship is the product being manufactured, and the people doing it are often trafficked workers reading from a script with quality control above them.

Investing is mentioned in passing, as something they do, not something you should do. Reluctance to involve you comes next, which is the move that makes you ask. Eventually you are helped onto a platform, sometimes an app installed outside the official stores.

A small deposit performs well. A small withdrawal succeeds — this is the pivotal moment, and it is paid out of your own money. Deposits increase. The balance rises impressively. When you try to withdraw meaningfully, a fee appears, then a tax, then a compliance hold, each urgent and each final.

Red flags found in what you pasted

The classifier matched cues in 2 distinct categories: how contact was made, a payment demanded before withdrawal.

“wrong number”
“WhatsApp”
“fee, tax, or commission before I can withdraw”

Every red flag for this pattern

The relationship moved to WhatsApp, Telegram or Line early on.
They introduced investing themselves, then seemed hesitant to help.
The platform is not on any regulator's register and the app came from a link.
A withdrawal requires new money in rather than being deducted from the balance.
Any pressure involving a deadline, a forfeiture, or a limited window.

What you would see if this were happening to you

Someone attentive, consistent, and unusually easy to talk to, who is never quite able to meet or take an unscheduled video call.
A platform with a professional interface, live-looking charts, and an account manager.
A balance that grows steadily, and one early withdrawal that worked.
Eventually: a withdrawal blocked behind a payment you must fund from outside.

What to do now

Send nothing further. Whatever has gone is fixed; the fee is a separate, still-avoidable loss.
Do not confront them. It changes nothing and sometimes accelerates the account being closed and evidence disappearing.
Screenshot everything before it vanishes — the whole conversation, the profile, the platform, the balance page.
List every payment: date, amount, asset, and the address or account it went to.
Run the free check here, then file with IC3 and your local police the same day.

Full entry, with a PDF you can hand to someone else: Relationship-led investment fraud. Related reading: is the balance mine · fees that are never real. The whole library is free: What to look out for.

What a trace can see, and what to do first

On-chain visibility. Usually visible for the first several hops, and often into an exchange deposit address or a stablecoin balance an issuer can freeze on a law-enforcement request.

Traceable means the path of the money can be followed and documented. It is not a prediction that the money comes back; no honest firm can make that promise.

First moves, whatever you decide next

Stop paying any fee, tax or 'unlock' charge. It does not release the balance.
Save the full chat history, the platform's web address and app name, and every transaction hash.
Report to ic3.gov and your local police today and keep the case numbers.

What an analyst will ask you

Having these answers ready makes any trace faster and more complete:

What is the platform's web address or app name, and how did you install it?
Which exchange did you buy the crypto on before sending it?
Which chain and token was used, and do you have the transaction hashes (or the sending exchange's withdrawal history)?
Did you send it yourself, or did it leave without you sending it?
What were the date and time of the first and the last payment?
Have you reported it to IC3 (ic3.gov) and your local police? What are the case numbers?
Has anyone offered to recover the money for a fee, or is anyone still asking you to pay?

If you want a person on this

Every case starts with a free assessment — we tell you whether it's traceable and what it will take, before you pay anything. Investigations are then a flat fee scaled to complexity.

Trace Report — $750 flat, from. A human analyst follows the money on-chain and documents where it went. Analyst on-chain fund-flow trace · exchange-attributed address identification · ChainAbuse reporting · PDF report · 2–5 days.
Full Investigation — $3,500 flat, from. Multi-hop, cross-chain, document forensics, and the complete filing package. Everything in Trace Report · cross-chain + mixer/bridge tracing · document-metadata review · organized information package for IC3, exchanges or your attorney · 1–3 wks. Opens on a 50% retainer.

Request a free assessment Already assessed? Pay $750 → Pay the $1,750 retainer →

Free assessment, no obligation · Flat fee — never a percentage of recovery · No guarantee of recovery — no honest firm can. Quote BFR-EXAMPLE in the form so the analyst starts from this report.

1 · Technical summary

The section above is the plain-English version. What follows is the full technical record, with sources, for a bank, a lawyer, or the officer handling your report.

The composite risk score is 100/100 (CRITICAL), derived from 5 finding(s), of which 3 are technical confirmations against named data sources.

The most significant finding is: address is on the OFAC SDN sanctions list — Address appears on the OFAC Specially Designated Nationals list under asset code(s): ETH.

The account of events matches the Pig Butchering (relationship-led investment fraud) pattern at 55% classifier confidence, based on cues across 2 distinct categories.

Situation: Funds Sent — within the last 72 hours. This is the window in which the mechanisms that actually freeze money can still reach it. Recovery probability decays over hours, not weeks. The procedures section is sequenced for this stage.

2 · Evidence submitted

Preserved verbatim as received, at the time of submission.

What this section is, and is not. This section reproduces what the submitter told us, word for word and unedited. We have not verified it and we do not adopt it. Any person, company, platform or brand named in it is named by the submitter. We have not investigated them, have not contacted them, and make no finding whatsoever about their conduct. Their appearance in this document is a record of what was reported to us and is not an allegation by us. Any party named here may write to corrections@blockchainfraud.org and we will record their response alongside the original account.

SITUATION: I sent something in the last few days.

WHAT HAPPENED
Someone messaged me out of the blue on WhatsApp saying they had the wrong number.
We talked for several weeks and became friendly. They said an uncle of theirs
worked in trading and showed me a platform where my balance kept going up. When
I tried to take money out, the platform said I owed a 20% tax on the profit
before anything could be released.

WALLET ADDRESSES GIVEN TO ME
0x098B716B8Aaf21512996dC57EB0615e2383E2f96

WEBSITES AND LINKS INVOLVED
https://coinvestpro-secure-wallet-verify-8471923.com

THE MONEY
Total: 42,000 US dollars
Last payment: three days ago
How the money moved: wired from my bank to an exchange account, then sent on

HOW THEY REACHED ME
First contact: they messaged me out of the blue on WhatsApp
They are asking for: a fee, tax, or commission before I can withdraw

3 · Indicators submitted and their validation

Every address is checked against its chain's own checksum before any lookup is attempted. An address that fails this check cannot have received funds as written, so no screening result for it would be meaningful and none is claimed.

Indicator	Type	Validation
https://coinvestpro-secure-wallet-verify-8471923.com	URL	VALID — syntactically valid URL
0x098B716B8Aaf21512996dC57EB0615e2383E2f96	EVM	VALID — EIP-55 checksum VALID

4 · Sources consulted, and what each returned

A source that could not be reached is reported as NOT CHECKED and is excluded from the score. It is never presented as a clean result.

Subject	Source	Status	Result
0x098B716B…383E2f96	OFAC SDN (Treasury)	FLAGGED	Address appears on the OFAC Specially Designated Nationals list under asset code(s): ETH.
0x098B716B…383E2f96	Community scam-address blocklists	CHECKED — NO FLAG	Not listed (2530 community-reported scam addresses screened).
0x098B716B…383E2f96	GoPlus Address Security	NOT CHECKED	Could not be reached (too many requests); this address was NOT screened by this source.
0x098B716B…383E2f96	Chainalysis sanctions oracle	FLAGGED	Oracle returns isSanctioned = true.
coinvestpro-secure-wallet-verify…	Phishing-domain blocklists	CHECKED — NO FLAG	Not listed (341,989 known phishing domains screened, refreshed 2026-10-12T04:51:46.386Z).
coinvestpro-secure-wallet-verify…	RDAP registration record	FLAGGED	No registration record exists for this domain in the .com registry. The domain is not registered, which means the link as written does not resolve to any site. Either it has already been taken down, it was transcribed incorrectly, or it was never a live address.
coinvestpro-secure-wallet-verify…	Certificate Transparency (crt.sh)	NOT CHECKED	Could not be reached (timed out after 9000ms); this address was NOT screened by this source.
coinvestpro-secure-wallet-verify…	GoPlus phishing-site check	CHECKED — NO FLAG	URL is not currently identified as a phishing site. Note that newly stood-up phishing infrastructure routinely predates its listing.

Coverage. 6 of 8 source checks returned a usable result; 2 unavailable. Unavailable at time of analysis: Certificate Transparency (crt.sh), GoPlus Address Security. Their absence is a limit on this report's coverage, not a finding of safety.

5 · Findings

CRITICAL 1. Address is on the OFAC SDN sanctions list

Address appears on the OFAC Specially Designated Nationals list under asset code(s): ETH.

Subject: 0x098B716B8Aaf21512996dC57EB0615e2383E2f96 · Source: OFAC SDN (Treasury) · Weight: 100/100

HIGH 2. Independent sanctions screener reports this address as sanctioned

Oracle returns isSanctioned = true.

Subject: 0x098B716B8Aaf21512996dC57EB0615e2383E2f96 · Source: Chainalysis sanctions oracle · Weight: 70/100

MEDIUM 3. Domain is not registered

No registration record exists for this domain in the .com registry. The domain is not registered, which means the link as written does not resolve to any site. Either it has already been taken down, it was transcribed incorrectly, or it was never a live address.

Subject: coinvestpro-secure-wallet-verify-8471923.com · Source: RDAP registration record · Weight: 50/100

MEDIUM 4. Narrative matches Pig Butchering (relationship-led investment fraud)

A long-grooming fraud in which a synthetic relationship built on a dating app, social platform or 'wrong number' text leads the victim onto a fabricated trading platform showing fictitious profits. The displayed balance is a database entry, not custody of assets. Withdrawal is then blocked behind escalating fees. The submission contains: how contact was made, a payment demanded before withdrawal.

Subject: submitted account of events · Source: Narrative pattern classifier · Weight: 39/100

MEDIUM 5. Narrative matches Advance-Fee / Commission Fraud

The victim must send additional funds before receiving something of greater value that does not exist. Each payment produces a new precondition. There is never a final payment, because the payment IS the fraud. The submission contains: an asset described as held or pending release, escalating or repeated payment requests.

Subject: submitted account of events · Source: Narrative pattern classifier · Weight: 39/100

How to read a pattern match. The pattern classifier operates on the sequence of events as described by the submitter. It characterises that account, not any person, company or platform mentioned within it, and a pattern match is not evidence that any named party did anything.

6 · Recoverability

BANK LEG — TIME-SENSITIVE

The wire or ACH from your bank moved through the banking system, where banks can sometimes request a recall if asked quickly. The IC3 Recovery Asset Team froze 58% of attempted losses it acted on in 2025 — a bank-wire figure, not a crypto one.

On recovery rates. No government agency or credible research body publishes a crypto-fraud recovery rate. Every percentage circulating online traces back to recovery-service or law-firm marketing, and this report will not quote one. For context on scale: US victims reported $11.366 billion in crypto-related losses to IC3 in 2025 across 181,565 complaints, while the largest published freeze and seizure figures across all channels combined run in the hundreds of millions and are concentrated in a handful of very large operations. The honest position for an individual case with no identified custodial endpoint is that recovery should not be expected. The reason to act quickly anyway is that the mechanisms which do work are time-gated in hours, and the cost of using them is a few hours of your own effort rather than a fee.

7 · What to do — the actual procedures

Sequenced for your situation: Funds Sent — within the last 72 hours. This is the window in which the mechanisms that actually freeze money can still reach it. Recovery probability decays over hours, not weeks. Each step states who can actually perform it, because several of the mechanisms that work are available only to a law-enforcement officer, and knowing which those are is what stops you wasting the window on the wrong channel.

Step 1 · Ask your bank to request a wire recall and a Financial Fraud Kill Chain referral

Who performs it: You, by phone, today
Window: Under 72 hours. The hardest deadline in the process.

Call your bank's fraud line — not the branch, not secure message. Ask for the wire investigations or fraud department.
Use precise language, because the words trigger different internal processes.
Follow up in writing the same day and keep the reference number.
File at ic3.gov the same day, completing the Routing Number (ABA/RTN) and SWIFT code fields — those are what the Recovery Asset Team works from.

I was induced by fraud to send wire [NUMBER] on [DATE] for [AMOUNT] to [BENEFICIARY BANK / BENEFICIARY NAME / ACCOUNT]. I am requesting that you send a SWIFT MT199 fraud recall request to the beneficiary bank immediately, and that you contact the FBI IC3 Recovery Asset Team to initiate the Financial Fraud Kill Chain. Please give me a reference number for this request.

What this achieves. The fiat leg — the wire or ACH from your bank to the exchange or mule account — is the most recoverable part of a crypto fraud, because it moves through the banking system where interdiction works. The IC3 Recovery Asset Team's Financial Fraud Kill Chain froze $679.013M of $1.163B attempted in 2025, a 58% success rate, and can extend past the first recipient bank if second-hop information is supplied.

What it does not do. That 58% figure is bank-wire interdiction and must not be read as a crypto recovery rate. A completed wire is not unilaterally reversible: recall depends on the beneficiary bank's cooperation. Regulation E does not apply to wires at all — 12 CFR 1005.3(c)(3) excludes them — and if you initiated the transfer yourself, however deceived, it is not an unauthorised EFT and the ACH return codes R10/R11 are unavailable to you.

Source: 2025 IC3 Annual Report — https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf ; 12 CFR 1005.3 — https://www.ecfr.gov/current/title-12/chapter-X/part-1005/subpart-A/section-1005.3

Step 2 · File at ic3.gov with the fields that make a complaint actionable

Who performs it: You, or a third party filing on your behalf
Window: Same day. Before 72 hours if a bank transfer is involved.
Channel: https://complaint.ic3.gov

File at https://complaint.ic3.gov. There is no separate crypto form — selecting Transaction Type 'Cryptocurrency/Crypto ATM' exposes the crypto fields.
Complete one transaction block per payment. The FBI names four items as most critical: cryptocurrency addresses; the amounts and types of cryptocurrency; transaction hashes; and the dates and times. A complaint carrying these can be clustered with other victims. One that says 'I sent $80,000 of Bitcoin to a scammer' cannot.
Put the technical material in the 'Other Information' field, which allows 5,000 characters and specifically invites cryptocurrency transaction metadata. The incident description is limited to 3,500 characters.
List every prior report — local police, exchange, bank — with report numbers, in the field provided for it.
Check current DOJ and US Attorney press releases for an active narrative code covering your fact pattern and put it verbatim in the narrative. In a $225.3M forfeiture action DOJ instructed victims to add the code BT06182025. This is the only verified way to steer a complaint into a specific federal case, and almost nobody uses it.
Screenshot or print the confirmation page before you close it. IC3 does not email you a copy and you cannot retrieve it later.
Do not put your Social Security number or date of birth anywhere in the form — it says so explicitly.

What this achieves. Enters your loss into the corpus FBI analysts cluster on wallet addresses and hashes, which is how an individual loss becomes part of a case large enough to fund an investigation. If a bank wire is involved and you move fast, it can reach the IC3 Recovery Asset Team.

What it does not do. IC3 does not investigate, will not contact you, gives you no case number, and cannot edit a filed complaint — you supplement by filing a new one and ticking the update box. IC3 states plainly that it works with no non-law-enforcement entity, such as law firms or crypto services, to recover funds.

Source: ic3.gov FAQ — https://www.ic3.gov/Home/FAQ ; PSA I-082423-PSA — https://www.ic3.gov/PSA/2023/PSA230824

Step 3 · File a local police report and get the report number

Who performs it: You
Window: Same day

File with your local police department or sheriff's office. Ask for the report number before you leave, and ask which officer or unit is assigned.
Bring a printed one-page summary: what happened, dates, amounts, the addresses and hashes, and the platform or persona involved. Officers are rarely crypto specialists; a clean document does more than an explanation.
Ask the assigned officer directly to submit the address through https://t3fcu.org if the asset is USDT, and to send preservation requests to any exchange identified.

What this achieves. Produces the report number every other channel asks for. Binance requires a copy of a police report before it will act on a stolen-funds report at all. It also creates the agency relationship needed for any freeze request, since those channels are law-enforcement-only.

What it does not do. Local police usually cannot trace or freeze crypto themselves, and many will decline to investigate. The report's value is as a key that unlocks other channels, not as an investigation.

Source: Binance — https://www.binance.com/en/support/faq/how-to-report-stolen-funds-transferred-to-binance-360000006051

Step 4 · Preserve the evidence in a form that survives

Who performs it: You, today
Window: Before accounts and chats are deleted

Export or screenshot every conversation in full, including the profile, phone number and handle. Capture whole threads with dates visible, not fragments.
Record the platform: URLs, app name and version, the download link you were sent, and screenshots of the account page showing the claimed balance.
List every transaction: date, time, amount, asset, chain, transaction hash, and the address it went to. This table is what every channel asks for.
Keep the bank records for the fiat leg — wire confirmations with beneficiary details and the routing and SWIFT numbers.
Store it all in two places, one of them offline. Do not rely on the platform remaining accessible; these sites disappear.

What this achieves. Makes every later step possible. Most complaints fail on missing hashes and addresses rather than on the merits.

What it does not do. Does not itself advance recovery — it is the precondition for everything that does.

Source: ic3.gov crypto guidance — https://www.ic3.gov/CrimeInfo/Cryptocurrency

Step 5 · Report the addresses on Chainabuse and opt in to contact

Who performs it: You
Window: This week
Channel: https://www.chainabuse.com

Report each receiving address at https://www.chainabuse.com with the hashes and a short description of the scheme.
Opt in to being contacted. That flag is how an agency reaches you later when your address turns up in their case.

What this achieves. Chainabuse is operated by TRM Labs and holds over 700,000 reported incidents. Partner law-enforcement agencies query it to link reports to active investigations and, in TRM's own words, to discover high-impact cases with seizure potential. Many victims reporting the same address is what turns an uninvestigated loss into a funded case.

What it does not do. Freezes nothing, and is not a substitute for an IC3 filing.

Source: Chainabuse LE partners — https://docs.chainabuse.com/docs/law-enforcement-partners

Step 6 · File the parallel regulator complaints

Who performs it: You
Window: This week

SEC Form TCR at https://www.sec.gov/submit-tip-or-complaint/report-possible-securities-law-violations if the offer was framed as an investment, a fund, staking yield, or a token sale.
CFTC at https://www.cftc.gov/complaint if it involved spot or leveraged BTC/ETH trading or a 'trading platform' — which covers the classic fake-platform app.
Your state Attorney General's consumer-protection complaint form. States now pursue criminal forfeiture of cryptocurrency under state law, and a state AG or local DA may act where a federal agency declines on threshold grounds.

What this achieves. Each filing is free, takes minutes, and widens the set of agencies that might cluster your addresses with other complaints.

What it does not do. None of these is a recovery mechanism. SEC and CFTC whistleblower awards pay for original information about violations; a defrauded victim reporting their own loss is generally not award-eligible.

Source: NAAG — https://www.naag.org/attorney-general-journal/crypto-crackdown-criminal-forfeiture-of-cryptocurrencies-by-states/

Step 7 · Understand the escalation chain before paying anyone to pursue it

Who performs it: Law enforcement, or your attorney for the civil routes
Window: Weeks to months

A § 2703(f) preservation request can only be made by a governmental entity, preserves records for 90 days extendable once by 90, and freezes nothing. Your attorney cannot send one; what counsel can send is a contractual litigation-hold letter, which is materially weaker.
A subpoena gets basic subscriber records. A § 2703(d) order, on specific and articulable facts, gets non-content transactional records including full transfer history. A search warrant, on probable cause, gets content including KYC documents. A seizure warrant is the instrument that actually takes custody of assets.
The civil route, where no agency will act: file suit, then use an FRCP 45 third-party subpoena to get exchange records. Coinbase directs civil service to its registered agent CSC, not to its law-enforcement portal.
The verified US template for freezing crypto civilly is LCX AG v. John Doe, N.Y. Sup. Ct. Index 154644/2022: name the asset in rem alongside the issuer, obtain a TRO directed at the issuer's account, then seek leave for alternate service — that court permitted service by airdropped token under CPLR 308(5) and ordered the Doe defendants unmasked.
Where the counterparty or exchange is reachable in England, Bankers Trust and Norwich Pharmacal disclosure orders are often faster and broader than US civil discovery. The applicant bears the respondent's compliance costs and must give a cross-undertaking in damages.

General information. How these legal tools work, for discussion with your attorney. It is not legal advice and may not apply in your jurisdiction.

What this achieves. Clarity about which instrument produces which result, so you are not paying for motion practice that cannot reach the money.

What it does not do. None of this is economically rational at every loss size. Litigation against an unidentified foreign defendant routinely costs more than it recovers. Ask any lawyer for a written view on expected recovery net of fees before funding a case.

Source: 18 U.S.C. § 2703 — https://www.law.cornell.edu/uscode/text/18/2703

Step 8 · If the funds are swept into a federal forfeiture, petition for remission

Who performs it: You, or your attorney
Window: Watch for it over months and years
Channel: https://www.justice.gov/criminal-mlars/remission

Monitor DOJ and US Attorney press releases for forfeiture actions matching your fact pattern or naming addresses in your trace.
When one appears, follow the instructions in it exactly — including any narrative code to add to an IC3 complaint.
File a petition for remission under 28 CFR 9.8 within the stated deadline.

General information. How these legal tools work, for discussion with your attorney. It is not legal advice and may not apply in your jurisdiction.

What this achieves. This is the mechanism by which victims are actually paid from seized assets. Recent actions have been substantial, including a $225.3M civil forfeiture complaint.

What it does not do. Remission values the loss at date of loss and does not cover your costs of pursuing it. DOJ states it will never ask for payment to participate in the remission or restoration process — anyone who does is running a second scam.

Source: 28 CFR 9.8 — https://www.ecfr.gov/current/title-28/chapter-I/part-9/section-9.8

Step 9 · Do not pay anyone who approached you offering to recover your funds

Who performs it: You
Window: Now

Anyone who contacted you after your loss offering tracing or recovery for a fee should be treated as a likely recovery scam until proven otherwise.
The FBI's guidance is explicit: be wary of anyone claiming they can recover your funds, as this may be another scam. IC3 states it works with no non-law-enforcement entity — including law firms and crypto services — to recover lost funds.
DOJ will never ask for payment to participate in or receive funds from a remission process.
Legitimate forensic work is sold at a flat fee stated in advance, produces a document you own, and promises no outcome. A percentage of recovery creates an incentive to promise one.
Never grant remote access to your device, never share a seed phrase with an investigator, and never send a 'gas fee' or 'unlock fee' to release recovered funds.

What this achieves. Prevents the second loss, which is frequently larger than the first because the target is known.

What it does not do. Does not help recover the original loss. Declining a recovery service is a way of not losing more, not a way of getting anything back.

Source: FBI PSA I-082423-PSA — https://www.ic3.gov/PSA/2023/PSA230824

8 · IC3 filing pack

The FBI names four items as the most important content of a crypto complaint: the cryptocurrency addresses, the amounts and types, the transaction hashes, and the dates and times. Copy these into complaint.ic3.gov.

Date	Type	Amount	Asset	Recipient address	Tx hash
	Cryptocurrency/Crypto ATM		ETH	0x098B716B8Aaf21512996dC57EB0615e2383E2f96

Blank cells are values only you hold — fill them in before filing. The form accepts a partial address if you do not have the whole one.

Technical appendix — paste into “Other Information” (5,000 character field)

Forensic reference: BFR-2026-429021 (BlockchainFraud.org automated analysis).

ADDRESSES AND INDICATORS:
URL https://coinvestpro-secure-wallet-verify-8471923.com
0x098B716B8Aaf21512996dC57EB0615e2383E2f96 [EVM] — EIP-55 checksum VALID

TECHNICAL FINDINGS:
[CRITICAL] Address is on the OFAC SDN sanctions list — subject 0x098B716B8Aaf21512996dC57EB0615e2383E2f96 — source: OFAC SDN (Treasury)
[HIGH] Independent sanctions screener reports this address as sanctioned — subject 0x098B716B8Aaf21512996dC57EB0615e2383E2f96 — source: Chainalysis sanctions oracle
[MEDIUM] Domain is not registered — subject coinvestpro-secure-wallet-verify-8471923.com — source: RDAP registration record
[MEDIUM] Narrative matches Pig Butchering (relationship-led investment fraud) — subject submitted account of events — source: Narrative pattern classifier
[MEDIUM] Narrative matches Advance-Fee / Commission Fraud — subject submitted account of events — source: Narrative pattern classifier

Composite risk: 100/100 (CRITICAL). Analytical confidence 75%.
Source coverage: 6 of 8 source checks returned a usable result; 2 unavailable.
Sources unavailable at analysis time: Certificate Transparency (crt.sh), GoPlus Address Security

9 · Limitations — what this report is not

An address is not a person. Nothing in this report identifies who controls any address, and attribution of control is a question of fact that requires records this analysis does not have.
Screening covers only the datasets named in the sources section. Fraud infrastructure regularly operates for weeks before appearing in any of them, so a clean result is a statement about those datasets and not a clearance.
Free sanctions screeners are used here as corroboration only. Measured against the current OFAC SDN Ethereum entries, the two independent screeners consulted flag roughly two-thirds each and about 30% are caught by neither, which is why the authoritative OFAC list is matched directly.
Clustering and attribution — linking an address to an exchange deposit account or a named entity — requires commercial datasets not used in this analysis. Where this report cannot establish a custodial endpoint it says so rather than inferring one.
No recovery outcome is predicted or promised. The recoverability assessment describes which mechanisms exist for this asset and timeline, not what will happen.
This document is a technical analysis, not legal advice. Decisions about litigation, law enforcement engagement, or settlement should be taken with counsel.
This is automated analysis of public data. It is not a licensed private investigation, it is not an audit, and it is not expert testimony. No investigator has been engaged, no surveillance has been conducted, and nobody named in the submitted account has been contacted or investigated.
Names of people, companies and platforms appear in this report only because the submitter reported them. They are recorded as the submitter's account of events. No finding is made about any of them, and any party named may write to corrections@blockchainfraud.org to have their response recorded alongside the original account.
This report is prepared for the submitter and for anyone they choose to give it to — their bank, their lawyer, or an officer taking their report. It is not published, is not indexed, and is served from a link that cannot be guessed.

10 · Evidence integrity

Report hash (SHA-256)	8a36f97f328edb85ce9b176f2b7bfd7caaf458eeb7011af511fd8d695a988247
Hash covers	The complete structured case record: submitted evidence, every extracted indicator, every source result including unavailable ones, all computed signals, the score and the selected procedures.
Generated	2026-10-16T06:01:26.208Z (9000 ms)
Engine	BlockchainFraud forensic engine v3
Coherence check	PASSED — all internal-consistency invariants satisfied. The engine refuses to render a report whose score, band, urgency, stage and findings contradict one another.

Disclaimer. This report is an automated technical analysis of public blockchain and internet data. It is not legal advice, not a financial recommendation, and not an accusation against any identified person: an address is not a person, and control of an address is a question of fact requiring evidence this report does not have. Nothing here guarantees recovery of funds. BlockchainFraud.org charges a flat fee stated in advance and never a percentage of any recovery.