The following cases span 2021–2026 and represent a cross-section of the recovery work Sleutheon has undertaken. Client identities are never disclosed without explicit consent.
2021
Forgotten Desktop Wallet Password — Q1 2021
A client located an old encrypted Bitcoin Core wallet.dat file from 2017 on a backup drive. They remembered approximate patterns and the rough length of the password but could not reconstruct the exact string. Controlled offline analysis in an air-gapped environment recovered the password after several days of processing. Funds were swept to a modern hardware wallet setup.
Hardware Wallet — Damaged Device — Q3 2021
A client's Ledger Nano became unresponsive after being dropped and exposed to moisture. The handwritten recovery sheet was intact. We guided a secure restoration onto a replacement device, verified receiving addresses on-screen before any transfer, and the full balance was confirmed under the client's sole control within one week.
Exchange 2FA Lockout — Q4 2021
After losing a phone containing an authenticator app, the client was locked out of a major exchange holding a significant portfolio. We assembled a complete identity and account-ownership package. Working exclusively through the exchange's official escalation channel, access was fully restored in approximately 12 days with no funds moved during the process.
2022
Partial Seed Phrase Reconstruction — Q1 2022
Only 18 of 24 words remained legible on a water-damaged recovery sheet, with uncertain ordering on two of them. Using BIP39 checksum validation cross-referenced against known address history on-chain, viable candidates were systematically identified and the correct phrase confirmed. The majority of the holdings were recovered without exposing the seed to any online environment.
Mobile Wallet After Phone Theft — Q2 2022
A client's phone was stolen with no cloud backup enabled. The client still possessed a handwritten seed phrase stored separately. Immediate guidance helped prevent further risk through address reuse, and all assets were moved to a new hardware wallet the same day under the client's direct supervision.
Unauthorized Bank Transfers to Crypto — Q4 2022
Multiple wire transfers were sent to an exchange after the client's banking credentials were compromised. Rapid documentation, on-chain tracing of the destination addresses, and coordinated communication with both the bank's fraud team and the exchange support resulted in a partial freeze and recovery of a substantial portion of the transferred value.
2023
Crypto Scam — Romance-to-Investment Scheme — Q1 2023
A client made large cryptocurrency transfers over several months following a sustained social-engineering relationship. Rapid on-chain analysis traced fund flows through multiple intermediate wallets. Reports submitted to two intermediate exchanges resulted in a temporary freeze on a portion of the remaining undisbursed balance, enabling a partial recovery.
Investment Scam — Fake Trading Platform — Q3 2023
A client deposited funds into what appeared to be a regulated broker offering unusually high returns. Withdrawals were blocked after several months and the platform became unresponsive. We packaged the evidence trail, coordinated with the payment processors involved, and supported a partial recovery of funds that had not yet been fully disbursed.
2024
DeFi Wallet Drained via Malicious Approval — Q2 2024
A client unknowingly signed a token approval transaction on a phishing site that granted an attacker unlimited spend on their wallet. Although the transferred tokens could not be retrieved from the attacker's wallet directly, on-chain tracing identified a centralised exchange deposit address. A law enforcement referral package was prepared and submitted, resulting in the exchange freezing the attacker's account pending investigation.
Inherited Crypto — Deceased Family Member — Q3 2024
Following a bereavement, a family located a hardware wallet and partial documentation belonging to the deceased. With no PIN and an incomplete seed phrase, we worked with the family's legal representative to attempt recovery through device analysis and phrase reconstruction. A substantial portion of the estate's digital assets was successfully identified and transferred to the estate wallet within three weeks.
2025
SIM-Swap Attack — Exchange Account Takeover — Q1 2025
A client's phone number was ported to an attacker via a SIM-swap, enabling bypass of SMS-based two-factor authentication on a major exchange. Immediate escalation to the exchange's security team, combined with forensic documentation of the SIM-swap event, resulted in the account being frozen before the attacker could complete a full withdrawal. Most of the balance was preserved and account access was restored to the client.
2026
Old Ethereum Wallet — Lost Keystore File Password — Q1 2026
A client recovered an old Ethereum keystore file from a backup but could not recall the password used in 2018. Offline brute-force analysis using known password patterns, combined with information the client provided about their password habits at the time, successfully recovered the passphrase. The Ethereum and ERC-20 tokens held in the wallet were transferred to a new secure setup.
These summaries are representative examples from our caseload between 2021 and 2026. Specific outcomes depend entirely on the facts of each case. Sleutheon does not guarantee results, and we do not publish client identities or case-specific figures without explicit written consent.