AURELINEGROUP

firm_mandate / est.2017

Find the trail. Build the evidence. Act where assets remain reachable.

A private forensic organisation: payments, blockchain, cyber response. We work with private clients and organisations. Recovery is not guaranteed.

Report an incidentThe firm

01

Fact, not a promise

Source first: payment, hash, log, correspondence. Then an assessment of prospect.

02

A point of action

Hold, chargeback, compliance or counsel — only where leverage still exists.

03

A reproducible file

Every finding carries a source and a confidence level. A bank or lawyer can test the chain.

Matters closed

840

since 2017

Private clients

€124m

recovered / held

Organisations

$210m

recovered / held

Practice totals since 2017, indicative. Not a promise of outcome on a new matter.

Recovered / held by audienceIndicative practice totals

01_INDIVIDUALS

€124m

Private clients: cards, brokers, stolen crypto.

37% / share of private practice

02_ORGANISATIONS

$210m

Organisations: incidents, internal fraud, payment rails.

63% / share of corporate practice

01 / How we work

Four steps from source to action.

The protocol is the same for private clients and organisations. Only the pressure channel changes: bank, venue, regulator or counsel.

TRACE method

  1. 01

    Preserve

    Keep source material and chain of custody

    next →

  2. 02

    Connect

    Link payments, addresses and entities

    next →

  3. 03

    Verify

    Separate fact from hypothesis

    next →

  4. 04

    Act

    A file for bank, venue or counsel

    action

  1. L1

    Observed

    A payment, hash, email or log that can be shown by source.

  2. L2

    Inferred

    A link from heuristics or clustering, with an explicit confidence.

  3. L3

    Hypothesis

    A working version. Not presented as fact to a bank or a court.

02 / Fund flow

We look not for ‘the scammer’, but for the point where funds can still be held.

The typical chain is shorter than it feels: deposit, descriptor, acquirer or mixer, off-ramp. If custodial control remains, action still has a price.

Typical fund-flowA diagram, not a promised route

  1. 01

    Client

    Payment / deposit

  2. 02

    Pseudo-broker

    Platform and descriptor

  3. 03

    Acquirer / e-money

    Intermediate settlement

  4. 04

    Off-ramp

    Venue, OTC, bank

  5. 05

    Point of action

    Hold, dispute, counsel

Windows for actionThe trail does not cool evenly

  1. 48h

    First hours

    Keep the source: statement, hash, log, venue email.

  2. 7–120d

    Payment window

    Chargeback, recall, hold — while the scheme still accepts a dispute.

  3. Hot trail

    On-chain

    While funds sit at a custodial venue, leverage may remain.

  4. Counsel

    Action

    A file for a bank, venue or lawyer. Not a promise of recovery.

03 / Who we help

Private clients and organisations — where a trail still exists.

01_INDIVIDUALS

Private clients

Broker and investment fraud, stolen crypto, bank disputes, romance-investment files. We need the transfer facts, not a novel of chat.

  • ›Statement and payment descriptor
  • ›Address, txid, venue console
  • ›Dispute deadline if the card trail is live
Practices

02_ORGANISATIONS

Organisations

Incident response, internal investigations, payment-gateway defence, a quiet file for counsel and the board.

  • ›Log preservation and chain of custody
  • ›Containment without noise
  • ›Findings with a confidence layer
Practices

We take on

  • Private clients

    Broker and investment fraud, stolen crypto and bank disputes — where a payment or on-chain trail still exists.

  • Organisations

    Incident response, internal investigations, payment-gateway defence and evidence packs for banks and counsel.

  • Counsel and boards

    Quiet forensics, chain of custody and reproducible findings that survive challenge by another party.

We do not

  • Guaranteed recovery

    We do not accept a mandate whose only expectation is ‘we will get it all back’. Prospect is assessed on facts.

  • Seed phrases and passwords

    We do not ‘unlock wallets’ and do not accept secret keys. That is a risk to the client and the matter.

  • Retail crypto hype

    We do not sell trading signals, promise yield or support speculative products.

04 / Practice

Four disciplines in one file.

Names of practice leads. Not public biographies, and not a promise of who will run your matter.

EV

Elena Varga

Financial investigations

Payment-flow reconstruction, asset tracing and evidentiary timelines for private clients and organisations.

MH

Marcus Hale

Blockchain forensics

On-chain analysis, cross-chain hops, service attribution and custodial control points.

AS

Amira Soltani

Cyber response

Digital artefact preservation, attack containment and restoration of operational control.

JP

Julian Peck

Evidence coordination

Files for banks, venues and counsel: source, confidence and chain of custody.

Practice coverage

Not branch offices

  • EU

    European practice

  • UK

    United Kingdom practice

  • MENA

    Middle East

  • CIS

    CIS & Central Asia

Confidential

Set out the facts. We will assess the prospect.

The first assessment is free and confidential. Do not send seed phrases or passwords.

Open intake