Former police detective Robert Eastick tells The Brief about the challenges of tracing stolen cryptocurrency and how lawyers can best work with investigators to locate their clients’ missing assets.

In 2024, the most recent year for which figures are available, Action Fraud received more than 17,000 reports of crypto investment fraud. If cryptocurrency itself is complicated, investigating and remedying its fraudulent misappropriation is orders of magnitude moreso, involving as it often does various addresses and exchanges, and multiple jurisdictions.

Robert Eastick, director and crypto lead at the Legal 500-listed asset tracing and recovery specialist iSanctuary, is a leading expert in this field. He is a former Detective Sergeant with the Metropolitan Police Service who, during his 26-year policing career, specialised in complex financial crime investigations, asset tracing, and confiscation proceedings under the Proceeds of Crime Act.

He was also instrumental in establishing the Met’s first dedicated Cryptocurrency Investigation Team and, in 2024, was the first UK police officer to obtain a Crypto Wallet Freezing Order, making a successful application the day the power to do so came into force.

Eastick joined iSanctuary in 2025, where he now focuses on the development of technologies and investigative methodologies to trace and recover stolen cryptocurrency. In this role he often works “hand-in-glove” with lawyers.

iSanctuary

Cambridge-based iSanctuary was founded in 2017 by Jonathan Benton, a retired police Chief Superintendent, whose previous career included working for the National Crime Agency, advising the Cabinet Office and Number 10 Downing Street, and leading the anti-corruption unit at the Metropolitan Police. He was also instrumental in reforming the Proceeds of Crime Act.

The graduates have a lot of bandwidth and are very academic, and they are guided by people like me who have decades of practical experience.

The firm’s non-executive chairman is Lord Bernard Hogan-Howe, the former Commissioner of the Metropolitan Police and, earlier, Chief Constable of Merseyside Police.

In total the firm now employs around 14 people. These include both former law enforcement and military intelligence professionals and graduates.

“We’ve got a nice blend,” Eastick says. “The graduates have a lot of bandwidth and are very academic, and they are guided by people like me who have decades of practical experience.”

High-stakes civil cases

The firm works with lawyers who have been instructed by victims of suspected crypto fraud to help recover their assets.

Eastick says, “The experience I previously had working with prosecutors in the criminal arena has helped immensely when working with lawyers now, in the private arena. But there is a big difference between criminal and civil law.

“Initially I thought it would be easier to work on civil cases because the standard of proof is balance of probability, not beyond reasonable doubt. However, the stakes are much higher in the civil arena compared to the criminal arena because if we get it wrong the client is liable, which really does focus your mind.

“Of course there are consequences if you get something wrong in criminal cases, especially for very important criminal matters like serious assaults and murders, but the evidence usually speaks for itself somewhere and it’s generally not fatal for a criminal matter if you make a mistake and put your hands up to it.”

If we get it wrong the client is liable, which really does focus your mind.

By contrast, he says, any errors can more easily be fatal for a civil case, leaving the client on the hook for costs. In the crypto field, litigation relating to which Eastick describes as “very much still pioneering”, this can be a particular problem.

Issues that can bedevil the tracing of crypto assets, and the subsequent enforcement of any judgments, include co-mingling of assets, the very different levels of transparency and cooperation practised by the different exchanges that process cryptocurrency transactions and host assets, and the involvement of multiple different national jurisdictions in many cases.

Co-mingling conundrum

A particular issue for those involved in cryptocurrency cases, Eastick says, is co-mingling. Understanding this requires a grasp of the different ways in which different currencies work. Bitcoin, for example, operates very differently from Ethereum.

A single bitcoin, Eastick explains, is divisible into 100 million units called satoshis. Tracing bitcoin is a little like following banknotes by their serial numbers, although the comparison is not exact.

Individual satoshis do not have serial numbers. Instead, bitcoin received in separate payments remains recorded as distinct amounts, rather than simply merging into a running account balance.

When those amounts are spent, the blockchain records the links to the earlier payments. This gives investigators a trail to follow, although combining and splitting funds can make it harder to establish which onward payments represent a particular victim’s money.

With crypto, speed is king, so the thing to do is to instruct people like us and get the tracing going.

By contrast, coins like Ethereum operate an “account-based” model, which is more like the electronic transfers that might be made from one bank account to another.

Investigators can see payments into and out of an account, but where funds from different sources have been combined, establishing which earlier receipt an onward payment represents is more complicated. Demonstrating that coins that transferred from wallet A to wallet B and on into wallet C originally belonged to wallet A is a key challenge.

Eastick says one of the most common conversations he has with lawyers involves explaining this distinction and its implications when tracing stolen assets.

Act fast

Whatever type of crypto asset has been misappropriated, he says speed is of the essence when it comes to tracing.

“If you have a live crypto case, where the assets have been handed over or lost relatively recently, we would generally say to lawyers that they need to get us in straight away, before they do all their client onboarding, which can often take a long time,” he says.

“With crypto, speed is king, so the thing to do is to instruct people like us and get the tracing going. A lot of law firms have their own tracers, but they may not start work until their clients have been onboarded, and doing it that way around doesn’t work.

“If it’s a live case or has happened in the previous week or so, as soon as we identify addresses that are being held we can put monitors on them and notify the exchanges as soon as they are off-ramped. Delays can mean you lose all that time and those opportunities, so the quicker you get the tracing going with a live case the more chance you’ve got of recovery.”

Structured for obfuscation

Another issue is the general opacity and “wild west” nature of the crypto sector. The exchanges through which transactions are processed are not all cooperative, and will not always comply with requests to freeze assets even when presented with irrefutable evidence.

There are also “nested exchanges”, where, effectively, one exchange sits within another main exchange, using the main exchange’s liquidity to process fraudulent transactions, with its identity only known to that main exchange. In these instances Eastick says the main exchanges are “effectively outsourcing their Know Your Customer obligations”.

I really wish we could get a successful case against an exchange relating to Know Your Customer.

“The whole thing is very murky and almost deliberately structured for obfuscation,” he continues. “I really wish we could get a successful case against an exchange relating to KYC, in the same way as was done previously with banks that were handling large transactions.”

Another major challenge, both for the tracing of crypto assets and enforcement of judgments in victims’ favour, is the multi-jurisdiction nature of many incidents.

While the UK and other developed markets are implementing cryptocurrency regulation, there is no unified global approach to regulation and, even if there were, getting rogue or failed states to implement it would always be a problem.

“It’s a very challenging space,” Eastick says. “Personally, I would say that if you don’t understand the technology underlying it then don’t go anywhere near it, as an investor.”

Service please

Although it might seem the criminals have the upper hand, there have also been encouraging developments, including one innovative case in which Eastick and iSanctuary were involved.

This was an investment fraud in which a quantity Ethereum which had been lost by a victim was being held on privately controlled addresses on the blockchain and had not yet been off-ramped by the criminals.

Service via NFT can be quite a powerful tool in terms of leads, but the main thing it solves is the problem of service when you have no other method.

The bogus investment company purported to be from Singapore, and the High Court in Singapore accepted jurisdiction. Because there was no physical address at which legal documents could be served, iSanctuary was able to persuade the court that service should be carried out by way of an NFT (non-fungible token).

Eastick says, “What was good about this was that when the fraudsters looked at the NFT we were able to collect their IP addresses, which were then passed on to the Spanish police who resolved them. One of them was resolved to an apartment in Paris, and the Spanish Police, along with the French police, raided that apartment, where they made arrests and also found a device that was linked to the fraud.

“So it showed that service via NFT can be quite a powerful tool in terms of leads, but the main thing it solves is the problem of service when you have no other method.”

Blockchain sauce for the goose is also, it seems, sauce for the gander.

Visit

iSanctuary

Connect with Robert Eastick via LinkedIn