A multisig theft investigation reconstructs how an attacker got enough control over a multi-signature wallet to move funds. It then follows those funds across public blockchains and packages the findings in a report that lawyers, exchanges and law enforcement can use. The work has four parts: preserve evidence, map the wallet’s signers and configuration, trace the outgoing funds, and document everything. Speed matters at every step.
This guide explains each part in plain terms for US victims, investors and attorneys. It also covers what you can realistically expect from tracing.
TL;DR
- Multisig thefts usually come from a compromised setup, tampered software or stolen signer keys, not from “breaking” the multisig itself. The threshold and the number of compromised keys decide who controls the funds.
- Investigators trace stolen funds hop by hop on public blockchains, group addresses into clusters, and look for points where funds touch exchanges that hold identity records.
- Preserve devices, wallet files, addresses, transaction hashes and a written timeline now, and report to the FBI’s IC3 promptly.
- Recovery depends on speed, whether funds reached an exchange, and whether they were laundered through mixers or privacy coins.
- Be wary of anyone who promises to recover your funds. The FBI warns about secondary recovery scams.
Table of Contents
- How a multisig wallet works, and where theft happens
- What a multisig theft investigation covers
- How investigators trace stolen funds
- What to preserve in the first hours
- Who to report to in the United States
- Can traced crypto be frozen or recovered?
- How forensic findings support a legal case
- Perspective
- Beware of recovery scams after a theft
- Start an investigation with Recovera
- FAQ
- Sources
How a multisig wallet works, and where theft happens
A multisig wallet requires more than one key to approve a transaction. In a 3-of-4 wallet, for example, a transaction stays pending until three of the four signers approve it. That design removes the single point of failure of a standard wallet. According to Trezor’s educational guide, it also adds operational complexity and room for user error, because many non-custodial setups need every cosigner’s extended public key.
That complexity is where thefts tend to start. Common patterns investigators look for:
- Tampered configuration. The Bitcoin standard for secure multisig setup, BIP 129, warns that an attacker who modifies a multisig configuration can redirect funds or hold them for ransom. It advises participants to compare the wallet’s first address and policy parameters to detect tampering.
- Substituted keys. Malicious wallet software can swap in attacker-controlled public keys, so funds sent to the apparent multisig end up controlled by the attacker.
- Too many compromised signers. If an attacker controls enough keys to meet the threshold, they can sign alone. If they control only some, they may still block spending and demand a ransom.
- Fake “multisig” scams. Some fraud simply tricks victims into paying fees to access a wallet they never controlled. This is a deception case, and the investigation focuses on the scammer’s addresses and communications.
Which of these happened shapes everything that follows. A tampered setup points to the software and the signing devices. A deception scam points to messages, domains and payment trails.
What a multisig theft investigation covers
A thorough investigation answers five questions, in roughly this order.
- What exactly was the wallet? The type of multisig, the threshold (such as 2-of-3), the list of signers and any changes to signer settings before the theft.
- How did the attacker get control? Compromised device, phishing of a signer, tampered interface, or social engineering.
- Where did the funds go? Every outgoing transaction, from the first hop to the current location.
- Who or what controls the receiving wallets? Clusters, exchange deposits and links to known fraud networks.
- What can be proven? A documented, reproducible account suitable for a lawyer, an exchange compliance team or an agency.
Our blockchain forensics guide walks through how this tracing becomes proof of fraud.
How investigators trace stolen funds
Blockchains are public, so every movement of the stolen assets is visible. Tracing means following funds from one address to the next. Investigators typically work through these stages.
Start from the theft transaction
The starting point is the transaction hash or the address that received the funds. From there, you review the address’s activity, flag the leads, and identify the services that may hold account records. The DOJ Journal of Federal Law and Practice describes tracing as following the movement of funds from one address to another.
Group addresses into clusters
The same DOJ article explains the co-spend heuristic: when several addresses are inputs to one transaction, investigators can infer that one user likely controls them. It describes this as the most-used and highly reliable metric in commercial blockchain analysis tools. The technique helps turn a long list of addresses into a handful of actors.
Follow the laundering pattern
Thieves rarely leave funds sitting still. They split them into smaller amounts, swap tokens, cross bridges and use mixers. This is why surface-level wallet tracking often stalls and why reconstructing complex flows, including through mixers and bridges, is a core part of what we do. The goal is to find the point where funds land somewhere that keeps records.
Find the attribution point
Tracing alone does not necessarily name the owner of an address. The DOJ article notes that off-chain information can help identify owners. In practice, the most useful attribution points are exchanges and custodians that collect identity information. A signer or receiving wallet that interacted with a regulated exchange can give a lawyer or agency a lead for a subpoena or account request.
A real example shows the scale this can reach. In the Bitfinex case, US authorities traced about 119,754 BTC through thousands of transactions, and the DOJ statement of facts describes how the wallets were identified as controlled by two defendants. That case combined on-chain tracing with off-chain evidence, which is typical of successful attributions.
If you need to know who is behind a wallet quickly, see our page on how we identify scam wallets within hours.
What to preserve in the first hours
Evidence disappears fast, and funds can move within minutes. Do these things before anything else.
- Write down the basics. Wallet addresses, the cryptocurrency type and amount, date and time, and every transaction hash you have.
- Record how contact happened. If a scammer or fake support agent was involved, save the contact method, usernames, domains, apps used and any one-time codes requested.
- Keep the devices as they are. The Scientific Working Group on Digital Evidence says examiners should recognize and preserve wallet applications, addresses, passwords, seed phrases, encryption keys, wallet files, hardware wallets and paper records. Its guidance also says a device found powered on should be kept on and prevented from locking, while considering the order of actions because funds may be moved before seizure.
- Do not wipe, reinstall or “clean” anything. That can destroy the very traces that show how the signing software was compromised.
- Write a timeline. When you noticed, who had access, which signers approved what, and any recent changes to signers or software.
We cover the legal side of this in our guide to chain of custody for crypto cases and digital evidence preservation.
Who to report to in the United States
The FBI’s August 2023 cryptocurrency victim guidance asks victims to report promptly to the Internet Crime Complaint Center (IC3) or a local FBI field office. It lists the details to include:
- Addresses, cryptocurrency type and amount, date and time, and transaction hash
- The contact method and any scammer identifiers
- Domains or applications used
- Two-factor or one-time-code information
- Exchanges involved, and a timeline
The FBI says to report even if you do not have transaction information. A June 2024 FBI warning adds that reports should cover how the person first contacted you, payment dates and amounts, account numbers, receiving institutions and receiving cryptocurrency addresses.
To understand what happens after a report, read our page on what to report so police investigate crypto scams.
Can traced crypto be frozen or recovered?
Sometimes, and the odds depend on a few factors. According to Legal500’s overview of US tracing and recovery, recovery depends on how quickly action is taken, whether funds have moved to an exchange, and the willingness of authorities to intervene. The same source notes that funds laundered through mixers or converted into privacy-focused coins such as Monero or Zcash are significantly harder to track, and that chances drop sharply once funds are cashed out into fiat.
That is why a fast start counts. The sooner the movement is mapped, the more likely it is that funds are still at a point where an exchange, a lawyer or an agency can act. Our overview of US cryptocurrency tracing explains the timing in more detail.
No honest provider can guarantee an outcome. What a good investigation can do is give you the facts, the documentation and the leads that make any legal or law enforcement step possible.
How forensic findings support a legal case
Blockchain analysis can serve three roles. According to the DOJ Journal article, investigators can use it as a lead, as support for subpoenas and warrants, or as evidence. It also cautions that proprietary methods can create admissibility and disclosure challenges at trial. A warrant affidavit may explain clustering assumptions such as co-spending and change addresses, their basis in observed behavior, and corroboration from other investigations.
Courts have engaged with this evidence. In United States v. 280 Virtual Currency Accounts (D.D.C. 2024), the court ordered forfeiture of 279 accounts holding funds linked to North Korean exchange hacks. It noted that investigators group transactions into clusters and can identify parties despite the anonymity of addresses. Norton Rose Fulbright reports that one court accepted publicly available clustering analysis as reliable enough for probable cause, while treating it as investigative direction rather than automatic proof of identity.
The practical lesson: a report should state its methods, assumptions and limits clearly, so that opposing counsel and a judge can follow it. Attorneys can see what that looks like in our guide to what a usable tracing report contains and our steps for admitting blockchain evidence in US court.
Perspective
In our experience, multisig cases are won or lost on the first documents. A multisig theft is rarely a single event. It is a chain: a configuration change, a signing approval, a sweep, then layers of movement. If the configuration history and signer devices are preserved, that chain can be reconstructed. If they are not, the investigation starts blind.
We built our process around that reality. We analyze transaction patterns on public blockchains, connect wallet activity to potential fraud networks, and document each step so the findings can stand up in legal proceedings. We work directly with law firms, and we write reports for the people who will read them: attorneys, compliance teams and judges.
Our approach is victim-centered and transparent. We explain what the chain shows, what it does not show yet, and what the next lawful step could be. We do not promise recovery. We aim to give you the strongest factual foundation to pursue it.
cristian
Beware of recovery scams after a theft
Victims of a multisig theft are prime targets for a second fraud. The FBI warns about secondary recovery scams and tells victims to be wary of anyone claiming they can recover funds. Safe habits:
- Never share seed phrases, private keys or signing approvals with someone who contacts you first.
- Be cautious about any provider who guarantees recovery or asks for payment in crypto before explaining the work.
- Ask for a clear scope: what will be investigated, what the deliverable is, and how it will be used.
Start an investigation with Recovera
If you lost funds from a multisig wallet, or you are an attorney handling such a case, our team can trace the movement of the assets, analyze wallet activity, preserve the digital footprint and prepare a technical report for legal proceedings. See our cryptocurrency scam investigation services or, for law firms, our services for professional offices. Pricing is set per engagement, so contact us with your case details. The more of the items above you have preserved, the faster we can begin.
FAQ
Can a multisig wallet be hacked?
The cryptography itself is rarely the weak point. Thefts usually involve tampered configurations, malicious wallet software, or enough compromised keys to meet the threshold. In a 2-of-3 wallet, an attacker holding two keys has full control. BIP 129 describes how modified configurations can redirect funds.
Can stolen multisig funds be traced?
Yes, because blockchain transactions are public. Investigators follow the funds from address to address and cluster related addresses together. Mixers, bridges and privacy coins make tracing harder, but they rarely make it impossible, and exchange deposits can provide attribution leads.
What should I do first after a multisig theft?
Record the addresses, amounts, transaction hashes and a timeline, and keep all devices and wallet files untouched. Then report to the FBI’s IC3 or a local field office. Contact a forensic investigator and, where appropriate, an attorney quickly, since speed affects recovery odds.
Does a forensic report hold up in court?
It can support subpoenas, warrants and civil claims, and some courts have accepted clustering analysis as a basis for probable cause. Admissibility depends on documented methods and the court’s standards, so the report should be written with a lawyer’s needs in mind.
Sources
- Coinbase: What is Multi-Signature (Multi-Sig)?
- Trezor: Multisig Wallets, How Multi-Key Security Protects Your Bitcoin
- BIP 129: Bitcoin Secure Multisig Setup
- DOJ Journal of Federal Law and Practice: Using Blockchain Analysis From Investigation to Trial
- DOJ Statement of Facts, Bitfinex case
- SWGDE: Tech Notes on Cryptocurrency
- FBI IC3: Guidance for Cryptocurrency Victims (2023)
- FBI IC3: Fictitious Law Firms warning (2024)
- Legal500: Cryptocurrency Tracing and Recovery
- United States v. 280 Virtual Currency Accounts (D.D.C. 2024)
- Norton Rose Fulbright: Blockchain analytics in the courts
