One tamper-evident case record. Every stakeholder's evidence, composed.
For institutions, attorneys, investigators, and victim advocates working the same fraud from different angles.
Bring your Chainalysis, TRM, or Elliptic reports. PEGTrace confirms what's still on-chain, continues the trace to the current KYC wall, and composes everyone's evidence into one tamper-evident record. You can lead a horse to water, but you can't make him drink.
The dark web hides the server. It doesn't hide the money. We follow the money.
PEGTrace does not crawl the dark web, does not access .onion content, does not operate Tor clients or scrape marketplaces. What we do is check every URL, IP, and email you record against public compilations of known dark web mirrors and Tor exit nodes — and continue the crypto trace past dark web endpoints to the KYC wall where the funds surface.
A $16.6 Billion Problem the Ecosystem Isn't Solving
The FBI's 2024 Internet Crime Report (Internet Crime Complaint Center, IC3) records $16.6 billion in losses reported to IC3 in 2024 — in the FBI's own words, a “33% increase in losses from 2023.” That figure is total reported losses across all complaint types, not fraud alone; the report states that “fraud represented the bulk of reported losses in 2024.”
Complaints referencing cryptocurrency account for $9.3 billion of that total across 149,686 complaints, with cryptocurrency investment fraud the largest single driver at $5.8 billion.
Behind every one of those numbers is a fraud team, a plaintiff attorney, or a compliance officer trying to trace money that vanished into wallets they can't identify, at exchanges they can't reach directly, using tools that either don't exist for their budget or don't hold up in court.
PEGTrace exists because that gap is where fraud recovery is dying — not at the enterprise level where nation-state investigations get full attention, but in the community banks, the regional fraud teams, and the boutique litigation firms carrying the actual caseload.
Source: FBI Internet Crime Complaint Center (IC3), 2024 Internet Crime Report (released April 2025).
The trail goes cold the moment money leaves your walls.
Banks and lawyers currently piece together evidence across seven different tools — Etherscan for on-chain data, PhishTank for URL reputation, HIBP for breach exposure, spreadsheets to correlate signals — then rebuild the case narrative manually in Word documents. Each tool answers its own question well; none of them carries a chain of custody across the others. What's missing isn't more data. It's one record that holds together.
With PEGTrace, every signal — wallets, URLs, IPs, breach exposure, contract analysis, exchange relationships — flows into one case. One workspace. One cryptographically verified report ready to submit to FBI IC3, receiving custodians, or the courts.
| Year | Crypto fraud (USD billions) | Wire & email (BEC) fraud (USD billions) |
|---|---|---|
| 2021 | $1.6B | $2.4B |
| 2022 | $3.3B | $2.7B |
| 2023 | $5.6B | $2.9B |
| 2024 | $9.3B | $2.8B |
| 2025 | $11.3B | $3.0B |
Source: FBI Internet Crime Complaint Center (IC3) annual reports.
The scams your customers walk in with
Almost every fraud that ends in a wire, ACH, or crypto transfer starts as one of these. PEGTrace records the evidence trail for each — how the door opened, where the money moved, and who to notify — as a tamper-evident case file.
A long, trust-building conversation ends in deposits to a platform the victim can never fully withdraw from.
A project's operators drain liquidity or disable trading after inflows arrive, leaving holders with worthless tokens.
A lookalike site or app harvests credentials, seed phrases, or one-time codes and reuses them within minutes.
A pretended public figure, exchange, or synthetic video promises multiplied returns in exchange for a deposit that is never returned.
A dashboard shows steady gains until the victim tries to withdraw and is met with new fees, taxes, or verification demands.
Earlier participants are paid with funds from later participants until inflows stall and the structure collapses.
Coordinated buying and promotion inflates a thin-market token so insiders can sell into retail demand at the peak.
A caller claiming to be from an agency, support desk, or fraud team pressures the victim into transferring funds to a "safe" account.
A job offer or prize requires an upfront payment, a check to deposit, or personal data before the promised money ever arrives.
The victim is directed to a cash-to-crypto kiosk and instructed to send funds to a wallet controlled by the fraudster.
A threat to release images or messages is paired with a wallet address and a short deadline for payment.
A signed approval or permit lets a hostile contract move tokens and NFTs out of the victim's wallet on demand.
Scammers impersonate law enforcement, regulators, or bank fraud teams and keep victims on continuous video or phone calls, pressuring them to move funds to "safe accounts" to clear a fabricated investigation.
Fraudsters approach prior fraud victims claiming to recover stolen funds for an upfront "fee" or "tax," turning a single loss into two.
PEGTrace never charges to "recover" funds — recovery is performed by banks, exchanges, or law enforcement.
Also useful for broader consumer-fraud casework
- Phishing & spoofingEvidence: malicious URL scanner, IP / device intel, breach exposure
- Investment fraud (non-crypto)Evidence: external findings, breach exposure
- Romance scamsEvidence: crypto tracing, external findings, breach exposure
- Tech-support scamsEvidence: malicious URL scanner, IP / device intel, external findings
- Government / IRS / SSA impersonationEvidence: telecom signals, malicious URL scanner, external findings
- Advance-fee scams (loans, prize)Evidence: external findings, breach exposure
PEGTrace does not cover fraud that leaves no digital or on-chain trail — check-fraud, in-person schemes, and physical mail scams sit outside our evidence sources today.
Public references: FBI Internet Crime Complaint Center (ic3.gov), FTC Consumer Alerts (consumer.ftc.gov), California DFPI Crypto Scam Tracker.
Automatic tracing to a named legal-process target
PEGTrace traces from any seed identifier — wallet, URL, IP, email, phone number, bank account — to the entity holding identity data behind a legal-process gate, and names that target. Every step is recorded in a hash-chained evidence log. The panels below are a synthetic demonstration; every identifier shown is fabricated for illustration.
▶ Auto-ExpandFrom seed identifier to named legal-process target, with every step recorded.
Every trace terminates at a KYC wall — the entity holding identity data behind a legal-process gate. PEGTrace does not disclose identity; identity attribution requires legal process at the named wall.
Honest scope: this is a synthetic diagram. Every identifier shown is fabricated for illustration. PEGTrace records leads, not proof; identity attribution requires legal process at the KYC wall.
PEGTrace bridges investigation to filing.
Bring every case signal — wallets, URLs, IPs, breach exposure, contract analysis — into one workspace. Auto-expand traces to their exchange destinations. Correlate patterns across your case history. Produce court-ready reports on click.
One case. One hash chain. Every filing system your team already uses.
Foundation-locked evidence integrity. Public verification. Honest scope.
Explainable. Institution-fit. Honest by design.
A visible reasoning trail on every finding — not a score from a black box.
Built for the institutions, counsel, and investigators the enterprise fraud giants ignore or overprice.
We are explicit about what the tool can and cannot do — see below.
The bridge institutions have been missing.
Your fraud team already investigates crypto scams. Your team already files IC3 reports. Your team already requests recall from receiving custodians. PEGTrace is the bridge between those things.
We take your investigation output and produce the exact format each filing system wants, cryptographically verified, with hash-chain integrity that survives court scrutiny.
- For community banks: bridge from case investigation to IC3 filing and the custodian preservation notice.
- For litigation counsel: bridge from client intake to court-ready evidence exhibits.
- For crypto custody desks: bridge from deposit analysis to regulatory documentation.
Same workspace. Same hash chain. Different filing destinations. Institutional-grade reliability that survives cross-examination.
Two camps, and the gap between them
Crypto forensics tooling clusters at two ends. Community banks, regional fraud teams and boutique litigation firms sit in the space between them.
Enterprise forensics suites
Built for nation-state intelligence work and large-exchange compliance. Deep attribution capability, priced and staffed for organizations that can dedicate full-time analysts to them.
Public explorers and tagging tools
Free, fast, and useful for a single lookup. They return raw data. Chain of custody, evidentiary packaging and filing-ready output sit outside what they set out to do.
Where PEGTrace fits
In the space between — taking an investigator from intake to a hash-chained filing package a recipient can verify independently. We work alongside the tools that trace rather than in place of them; a vendor report uploaded to a case is preserved intact as an exhibit.
One case. One workspace. One verifiable filing.
Tracing produces a trail. We produce the record.
Blockchain analytics tools answer where the funds went. That answer is an input. What a filing needs is a record — one report per case, composed from the evidence as it was gathered, carrying a hash any recipient can verify independently.
PEGTrace is the composition layer between the two. We do not replace the tools that trace. We turn what they produce into something a court, a bank, or a bureau can receive.
If you already hold a report from a tracing vendor, it is preserved intact as an exhibit rather than re-analyzed.
What PEGTrace does not do.
- Does not recover funds. Recovery is performed by banks, exchanges, or law enforcement.
- Does not identify the criminal. A wallet or account is not a name — that requires KYC from the receiving institution via subpoena.
- Does not file as an authority or replace BSA/AML. PEGTrace feeds analysts, counsel, and filings; it does not act as a regulated filer.
- Crypto tracing is probabilistic. The output is investigative leads, not proof of who controls a wallet.
- Does not trace fiat between institutions. Once money moves bank-to-bank, that trail is private and requires legal process — we extend the trail on-chain and package the evidence for the people who can compel records.
How a pilot works.
- One design partner at a time — a financial institution, law firm, or investigative unit.
- Run a small set of real or recently-closed cases through PEGTrace.
- We tune the evidence package to your workflow.
- Free during the pilot in exchange for feedback.
- No production or customer-data integration required to start — walkthrough-first.
Built for scrutiny from your security team.
- Tamper-evident, hash-chained evidence ledger — append-only.
- Full read and export audit logs.
- Field-level PII encryption with keys held outside the database.
- Role-scoped access and admin gating on every internal surface.
- PEGTrace holds no SOC 2, ISO 27001, or third-party penetration-test report. Our infrastructure subprocessors (Supabase, Cloudflare) maintain SOC 2 Type II — that is inherited from them, not held by us. PEGTrace's own SOC 2 Type I is gated on our first paying pilot customers. Full posture, including this gap, shared under NDA — we want your security team involved early.
What PEGTrace delivers
Seven composition-layer capabilities. Shipped items are live in the product.
Every stakeholder's evidence — victim intake, analyst trace, credentialed contributor upload — hash-chained into one tamper-evident file verifiable at /verify.
Bring your Chainalysis, TRM, or Elliptic report. PEGTrace confirms what's still on-chain, continues the trace to today's KYC wall, and surfaces divergence honestly.
IC3 support package, Court Exhibit (FRE 902(14)), SAR Attachment rider, Insurance Claim Packet, and Case Package v2 wrapper — every renderer registry-locked and hash-registered.
Aggregate pattern signal across cases sharing wallets, URLs, IPs, emails, phones, banks, or file hashes. Counts and categories only — never other tenants' case identities.
Auto-Expand traces to the current terminal wall (custodial exchange, licensed OTC, bridge) and names the legal-process target. You can lead a horse to water, but you can't make him drink.
Attorneys, LEO, prosecutors, and bank compliance officers upload primary evidence they produced — subpoena responses, forensic captures, sanctions hits — attested under their own credentials.
Public fingerprint verification for any PEGTrace package. Paste the printed SHA-256; get integrity confirmation plus a plain-language explanation of what verification does and does not prove.
Built for the people already working the case
PEGTrace is composition infrastructure. It does not replace investigators, attorneys, or prosecutors — it composes their work into one record.
Court-Exhibit and Insurance Claim packets with FRE 902(14) self-authentication and /verify chain of custody.
Attorney overview →SAR Attachment riders, custodian preservation notices, and audit-ready evidence ledgers for BSA/AML workflows.
IC3 support packages, subpoena-target lists, and credentialed-contribution intake that preserves chain of custody.
Structured intake that produces a filing-ready record for banks, exchanges, and IC3 — plus routing to attorneys and public LEO resources.
Report fraud →We compose, we don't compete.
PEGTrace is not a tracing vendor. Your Chainalysis, TRM, and Elliptic subscriptions stay yours. We change what shows up on your desk.
PEGTrace does not resell blockchain intelligence, sanctions data, or KYC lookups. Contributors bring their own vendor output as attested contributions.
Chainalysis Reactor, TRM, Elliptic — keep them. PEGTrace ingests their outputs, confirms on-chain, and continues from where they stopped.
PEGTrace is the layer where every stakeholder's intelligence composes into one tamper-evident record. Tracing vendors are complements, not competitors.
Talk to us about a design-partner pilot.
PEGTrace is bridging fraud investigation to institutional filing for financial institutions and litigation counsel. Request a conversation to discuss whether PEGTrace fits your workflow.
Prefers a form? We'll add one for your team on request during the pilot conversation.