Case study: tracing fraud proceeds through Bermuda – crypto tracing

A payment leaves a corporate wallet on a Tuesday afternoon. By Thursday, the funds have cleared a centralised exchange registered in Bermuda, split into smaller parcels, and begun moving across three additional chains. The victim assumes the trail is cold. It is not – but the window to act is measured in days, not weeks.

On-chain tracing and targeted freezing relief, coordinated with local counsel in Bermuda, can intercept fraud proceeds even after they have crossed multiple jurisdictions. This case study explains how that process worked in one anonymised matter, what instruments made it possible, and what any practitioner or defrauded principal should take from the outcome.

The sections below cover the situation, the strategy, the process, and the transferable lessons – including why Bermuda's legal system offers genuine traction for crypto asset recovery when the right steps are taken early.

Situation: digital assets moved offshore within hours

The matter arose in the early months of 2025. A technology business in the Gulf region discovered that a trusted counterparty had induced a series of token transfers under a fictitious settlement agreement. The amounts involved were in the mid-seven figures. The fraud was sophisticated – layered across corporate identities and timed to coincide with a period when the victim's treasury team was unavailable.

Within hours of the initial transfers, blockchain-analytics tools showed the proceeds entering a centralised exchange that held a digital asset business licence in Bermuda. That regulatory footprint was the first choke point. Bermuda has developed a clear legal and regulatory system for digital asset service providers, which means licensed exchanges there are accessible to court process in ways that unlicensed offshore vehicles are not.

A secondary tranche of funds had already moved further – bridged to a different chain and fragmented into smaller wallets. That portion was harder to freeze but not impossible to trace. We regularly advise clients in precisely this pattern: one tranche reachable quickly, a second requiring parallel process in a different forum.

The victim's immediate instinct was to contact the exchange directly. That instinct is understandable. It is also, without legal process behind it, almost always ineffective. Exchanges will not freeze balances or disclose account details on the basis of a complaint email. They need an order.

Strategy: which instruments, which forum, which order of play?

Effective crypto asset recovery in Bermuda turns on selecting the right instruments in the right sequence. Three considerations drove the strategy here.

First, a freezing order over digital assets held at the licensed exchange had to be obtained without notice – applications of this kind are made without prior warning to the respondent, precisely because disclosure would accelerate dissipation. The Bermuda court is competent to grant freezing relief of this kind, and we coordinated proceedings with local counsel in Bermuda from the outset. Bermuda is a jurisdiction where we routinely coordinate proceedings of this kind; local counsel manages the filing and appearances.

Second, a disclosure order against the exchange was required to identify the beneficial account holder and any associated withdrawal addresses. This is the equivalent of a Bankers Trust order applied to a virtual-asset service provider – compelling production of account records, KYC documentation, and transaction histories. Without that data, attribution of the wallets to a real person remains probabilistic rather than evidential.

Third, the secondary tranche – already off the exchange – needed parallel on-chain tracing to map the destination wallets. That work ran concurrently, not sequentially, because waiting for Bermuda disclosure before beginning the chain-analytics work would have cost days the matter could not afford.

A proprietary injunction was also sought, asserting the victim's beneficial ownership over the specific tokens. This matters: a proprietary claim is stronger than a purely personal one when assets have passed through the hands of third parties, because it attaches to the property itself rather than just the original wrongdoer.

To assess the viability of tracing digital assets through a licensed exchange, it is worth reviewing our crypto asset recovery overview, which sets out the conditions under which freezing relief of this kind is realistic.

Process: from on-chain trace to court order in days

The work unfolded in three phases, each running partly in parallel.

Phase one was evidence assembly. Blockchain-analytics tools generated a transaction graph from the victim's originating wallets through to the exchange deposit addresses. That graph, combined with the victim's internal records of the fraudulent instruction, formed the evidential foundation for the without-notice application. The quality of this foundation matters enormously. Courts granting relief without hearing from the other side are relying on the applicant's candour and the precision of the supporting evidence.

Phase two was the Bermuda application itself. Local counsel filed the without-notice application and obtained both the freezing order over the digital assets and the disclosure order against the exchange. The interval between evidence assembly and the grant of relief was under 72 hours. That speed is achievable in Bermuda when the application is well-prepared; it is not guaranteed in every matter, and the specific facts of each case determine what is possible.

Phase three was attribution. The exchange's disclosure – produced within the timeframe specified in the court order – confirmed an account held under a name inconsistent with the counterparty's stated identity. The KYC records pointed to a nominee arrangement. That nominee layer was then the subject of further tracing, coordinating with local counsel in a second jurisdiction where the individual was known to have operating accounts.

In our experience, the nominee layer is where many recoveries stall. Practitioners who have not mapped the corporate and individual beneficiary layers before applying for disclosure often find that the first disclosure merely reveals a second shell. Planning for that second step at the outset saves weeks.

For a related example of how crypto proceeds are laundered through layered structures, see our analysis of crypto laundered through gaming and gift cards, which shows a comparable pattern in a different context.

Transferable lessons for crypto asset recovery in Bermuda

Three things made this matter recoverable. Each is worth stating plainly for any practitioner or victim assessing a similar situation.

Regulated presence creates legal traction. Because the exchange held a digital asset business licence in Bermuda, it was subject to court process there. An unlicensed exchange in an uncooperative jurisdiction would have required a different – and substantially harder – route. Victims and their advisers should always establish, as the first step, whether any exchange involved in the movement of funds is regulated and where.

Speed determines the range of options. The without-notice freezing order was effective because the funds had not yet been withdrawn from the exchange account. Had the victim delayed by even a few days – waiting for a bank's fraud team to respond, or seeking a second opinion before instructing specialists – the balance may well have been moved. Asset dissipation is not a theoretical risk. In crypto matters, it is the default outcome absent prompt action.

On-chain evidence is durable. Public blockchains are transparent: every transaction is recorded and retrievable. Even where immediate freezing is not possible – as with the secondary tranche that had already moved off the exchange – the trail does not disappear. Wallet clustering and attribution work can establish a roadmap to later recovery through enforcement, even if the initial freeze misses part of the funds.

The victim in this matter had initially concluded the money was gone for good. That assumption is one of the most costly myths in crypto fraud: that once assets leave a wallet they are untraceable and nothing can be done. The reality is that on-chain movements leave a permanent record and that regulated exchanges, where funds must pass on the way to cash-out, are points of genuine legal leverage.

For a full overview of Bermuda's legal environment for asset recovery proceedings, see our Bermuda jurisdiction guide.

If funds have already moved, time matters – request a confidential case review at info@axiomtracel.com.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In our experience, the matters that produce results are those where tracing and legal process begin within the first 48 to 72 hours of discovery. We have traced proceeds through regulated exchange choke points in multiple jurisdictions, coordinating without-notice applications where speed was the deciding factor. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace routinely coordinates proceedings with local counsel in Bermuda; local procedure governs the filing. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.