Skip to main content
Nodus Forensics

Blockchain Forensics & Expert Witness Services

Evidence-grade investigations and court-admissible technical reports for law firms, courts, and Web3 companies. From on-chain tracing to smart contract analysis — delivered by a team of blockchain and cybersecurity specialists.

Providing expert services since 2008 · Engagements across EU / LATAM · Certifications CISSP CCSP EH

Who we help

Law Firms & Courts

Party-appointed and court-admissible expert reports, testimony, and litigation support for crypto-related disputes, fraud investigations, and criminal matters. We work alongside your litigation team to translate complex on-chain evidence into findings a judge can understand and accept.

Web3 Companies

Incident response, post-exploit investigations, internal fraud, and regulatory inquiries for exchanges, protocols, DAOs, and custodians. When something goes wrong on-chain, you need investigators who understand the protocol as well as the people who built it.

Victims of Exploits & Scams

Asset tracing, evidence preservation, and coordination with exchanges and law enforcement to support recovery efforts. We are investigators, not a recovery service — our role is to produce the evidence your lawyers need to act.

Capabilities

Court-Admissible Expert Reports

Technical reports drafted to the evidentiary standards of the jurisdiction — structured, traceable, reproducible, and signed by a certified expert prepared to ratify findings in court.

Blockchain Forensic Analysis

Transaction reconstruction, wallet clustering, and fund-flow mapping across Bitcoin, Ethereum, Solana, and major L2s (Polygon, Arbitrum, Base, Optimism).

Cryptocurrency Asset Tracing

Tracking stolen or laundered funds across exchanges, bridges, mixers, and DEXs. Identification of off-ramps where assets interact with regulated entities subject to KYC.

Smart Contract Investigation

Post-exploit analysis of DeFi protocols, reentrancy and logic flaws, governance attacks, and admin-key compromises. Reconstruction of attack transactions at the opcode level when required.

Incident Response

On-call investigation of active exploits for exchanges, protocols, and custodians. Evidence preservation, attacker attribution, and coordination with threat intelligence and exchange compliance teams.

Expert Witness Testimony

Deposition, trial, and arbitration testimony. Translation of technical findings for non-technical judges, juries, and arbitrators.

Technical Due Diligence

Pre-transaction forensic review of counterparties, wallets, and on-chain histories for M&A, investment, and compliance purposes.

Digital Evidence Preservation

Court-grade capture and hashing of on-chain and off-chain evidence, including wallet state, transaction histories, communications, and off-chain artifacts — with documented chain of custody.

Why a blockchain-native team matters

Most digital forensics experts learned crypto as a vertical. We come from it.

Our investigators have built and secured Web3 infrastructure, audited smart contracts for DeFi protocols, triaged exploits at Immunefi, and operated validator networks. That background means we can trace funds across bridges, mixers, and DEXs that generalist experts cannot follow, and read smart contract exploits in the language they were written in.

When a case requires reconstructing a reentrancy attack, analyzing a cross-chain laundering path through Tornado Cash, or explaining why a DAO governance vote led to a protocol drain, generalist peritos rely on third-party analytics dashboards. We work from first principles.

Who we are

Engagement process

  1. 01

    Initial consultation

    A 30-minute confidential call to understand the matter, scope, and urgency. No cost, no obligation.

  2. 02

    Scope & engagement

    We send a written scope, timeline, and fixed-fee or hourly proposal. Once signed, we begin.

  3. 03

    Investigation

    On-chain tracing, evidence preservation, and technical analysis. Regular updates to counsel; no surprises.

  4. 04

    Report delivery

    Draft report reviewed with counsel, then finalized and signed. All findings documented with reproducible evidence and sources.

  5. 05

    Court ratification

    When required, our expert appears at hearing, deposition, or arbitration to ratify the report and answer questions.

Frequently asked

What does Nodus Forensics do?
Nodus Forensics is a blockchain forensics and expert witness practice. We produce court-admissible technical reports, trace stolen or laundered cryptocurrency, investigate smart contract exploits, and testify as experts in civil, criminal, and arbitration proceedings. We work with law firms, courts, Web3 companies, and victims of exploits and scams.
When should a law firm engage a blockchain forensics expert?
As early as possible. If a matter involves cryptocurrency transfers, smart contract behavior, on-chain provenance of funds, or any form of digital asset dispute, early forensic involvement preserves evidence that degrades quickly — wallet states change, exchanges rotate logs, and mixers obscure trails within days. Early engagement also allows us to shape the evidentiary strategy rather than reconstruct it later.
Are blockchain forensic reports admissible in court?
Yes, when properly prepared. In Spain, expert reports are governed by the Ley de Enjuiciamiento Civil (arts. 335 et seq.) and are admissible when signed by a qualified, certified expert and accompanied by a documented methodology. The same principles apply across EU jurisdictions. Blockchain-specific evidence requires particular care with chain-of-custody for on-chain data, hashing of captured states, and reproducibility of findings — all of which are standard in our methodology.
Can stolen cryptocurrency actually be traced?
In most cases, yes. Public blockchains like Bitcoin and Ethereum are pseudonymous, not anonymous. Transactions are permanently visible. With the right methodology, funds can be traced across wallets, exchanges, bridges, and even through many mixing services. Recovery is a separate question — tracing produces the evidence; recovery depends on whether the funds reach a regulated entity subject to KYC and law enforcement cooperation.
How much does a blockchain forensic investigation cost?
It depends on scope: number of transactions, chains involved, complexity of obfuscation, and urgency. Simple cases (a single scam, one or two transactions) can be scoped as fixed-fee engagements. Complex multi-chain investigations are billed hourly with a written cap. The initial consultation is always free; we provide a written proposal before any work begins.
What information do you need to start a case?
At minimum: a wallet address, a transaction hash, or an exchange deposit reference. The more context you can provide — suspected entities, timestamps, communications, screenshots — the faster we can assess viability and scope. In the initial consultation we will tell you honestly whether the case is worth pursuing.
Do you work for both parties in a dispute?
We accept engagements from either side — plaintiff or defense, claimant or respondent, prosecution or defense. We do not work for both sides of the same matter. Our reports stand or fall on their technical merits, not on which side commissioned them.
Can you testify as an expert witness?
Yes. Our reports are signed by a certified expert prepared to ratify findings in open court, deposition, or arbitration, in Spanish or English.
What jurisdictions do you cover?
We are based in Argentina and the Netherlands, and we accept engagements across the EU, UK, and selected Latin American jurisdictions. Expert witness work requires local legal coordination, which we manage with the instructing firm.
How long does a typical investigation take?
A focused tracing engagement typically takes 2–4 weeks. A complex multi-chain investigation with smart contract analysis and a full expert report can take 6–10 weeks. Urgent incident response is available with 24–48 hour turnarounds.
Do you handle cases involving mixers like Tornado Cash?
Yes. Mixers do not make tracing impossible — they make it harder and more technical. We routinely work through mixer inputs and outputs using timing analysis, amount correlation, and downstream heuristics. We are honest about the limits: some cases can be traced through a mixer, others cannot.
What's the difference between Nodus Forensics and a traditional perito informático?
A traditional perito informático is a generalist who investigates digital evidence across phones, computers, networks, and sometimes crypto. Nodus Forensics is specialized — we only do blockchain, Web3, and digital asset investigations, and our team's primary background is in building and securing the systems we investigate. For a matter that is entirely about digital assets, specialization matters.

Got a matter that touches crypto?

Tell us about it in a 30-minute confidential consultation. If we're not the right fit, we'll say so and point you to someone who is.

Request a consultation