Case studies
Written as technical walkthroughs rather than testimonials. Each one sets out what the failure actually was, how it was approached, and - importantly - what would have made it unrecoverable.
Client details are omitted throughout. Values are approximate at the time of recovery.
$800K
Recovered · April 2025
A family's entire savings sat on a hardware wallet that was being drained while they watched.
How hardware wallet recovery worksThe failure
The device itself had not failed. The compromise was upstream of it - the transaction being presented for signing was not the transaction the owner believed they were approving. A hardware wallet will faithfully sign whatever it is asked to sign; its protection lies in showing you the details on its own screen, and that check had been bypassed in the way the owner was interacting with it.
The work
Speed mattered more than elegance. We identified the attack vector, established which keys were still uncompromised, and moved the remaining balance to a freshly generated wallet on clean hardware before the attacker could complete further withdrawals. Only once the funds were secure did we reconstruct how the compromise had happened, so the same mistake could not recur.
The limit
A few more hours. Active drains are a race, and the window closes. This is the one category of recovery where waiting to see if it resolves itself guarantees the worst outcome.
Their transparency and expertise were incredible. Thanks to them, all my Bitcoin was saved. I can't express how grateful I am for their help during one of the most stressful times of my life.
$400K
Recovered · August 2025
A wallet from the early era of Bitcoin, unopened for over a decade, with several compounding obstacles.
How seed phrase recovery worksThe failure
Not one problem but a stack of them. Material from that period predates the conventions everyone now takes for granted - the backup format, the address type and the software's assumptions were all from an earlier world, and each had to be resolved before the next became visible. Ten years of storage had also degraded what was written down.
The work
We worked the obstacles in order rather than attacking them at once, resolving the format question first so that the later steps had a fixed reference point. Each stage was verified against the on-chain history before proceeding, so we knew at every point that we were still tracking the correct wallet rather than a plausible-looking dead end. The work was done on-site, in person, on air-gapped equipment.
The limit
Losing the physical backup entirely. Degraded and partially illegible is workable; absent is not.
Nic did a fantastic job stepping us through the process, flying to help us in person. His calm, knowledgeable approach settled our nerves and we are very grateful to have regained full access to our assets.
1 BTC
Recovered · October 2025
An old wallet that had been compromised long ago - but not completely.
How wallet.dat recovery worksThe failure
The owner assumed the wallet was empty because it had been breached years before. It had, and a portion had gone at the time, but the attacker had not taken everything. The remaining balance had sat there since, in a wallet structure from an era whose layout modern software does not reproduce by default.
The work
We traced the on-chain history first to establish what had actually left the wallet and when, which told us precisely what should still be there. That figure then served as the verification target: we rebuilt the legacy structure, confirmed the reconstruction produced the address holding the expected remainder, and migrated it to a current wallet.
The limit
Nothing technical - but the owner nearly lost it to an assumption. A wallet you believe was emptied is worth checking on a block explorer before you write it off. That check is free and takes a minute.
$30K
Recovered · September 2025
TRX held at an address whose key existed, was correct, and could not be imported anywhere.
How derivation path recovery worksThe failure
The key was 128 characters long. Current wallet software expects a specific, much shorter representation, so every import attempt was rejected as malformed - which reads to an owner exactly like a lost wallet, even though nothing was lost at all. Early TronWatch exported raw key material in a form that has since fallen out of use, and the funds had been sitting untouched behind that mismatch.
The work
This was a format problem, not a cryptographic one. We established what the exported material actually represented, applied the reduction that maps it to the standard form, and verified that the resulting key derived the exact address holding the TRX before anything was imported. Confirming the address match first is what separates a conversion from a guess.
The limit
Nothing, in this case - which is the point. It looked unrecoverable and was purely a question of recognising the format. Cases dismissed by other services are often this shape.
These four are representative rather than exhaustive, and they are the ones where we have the client's consent to write about the work. We publish the technical detail because it is checkable: a reader who knows what a derivation path or a secure element is can tell whether we do. That is the point.
You'll hear back from Nic or Harry directly - not a call centre. Beware of scammers.
Tell us what happened and we'll call you back within 24 hours. The assessment is free, confidential, and carries no obligation - and if we don't think we can help, we'll say so on that call, not after taking a fee.
No fee unless we succeed
10% of what's recovered, agreed in writing beforehand. Nothing if we fail.
We can come to you
Anywhere in New Zealand, at our cost, for cases of significant value.
Nothing is retained
Keys and phrases are destroyed or returned at the end of the engagement. NDA signed before we start.
