Case #PR-2026-014 — 84% of a $186,000 loss recovered

The loss. Meredith K. had been in a relationship — mostly online, with one short in-person visit — for two years. Her "partner" gradually introduced a trading platform, then a "family fund" that needed a matching contribution. In total she moved $186,000: part as USDT to platform-linked wallets on TRON, part by wire to a bank account he controlled. When she tried to withdraw, the platform demanded a 12% "release tax," and the bank account went dark.

What we found in the first 48 hours

Meredith's evidence was strong: two years of chat logs, the platform's deposit and withdrawal pages (screenshotted before they were scrubbed), the wire's MT103 with UETR, and three TRON TXIDs. That combination gave us the two halves of the trail:

• The crypto leg — $112,000 in USDT. All three deposit TXIDs landed in a single "platform treasury" address. From there the funds peeled: 31 addresses in 90 minutes, consistent with automated splitting. Two branches terminated at Tier-1 exchange deposit addresses; one branch crossed a DEX bridge to BSC and re-arrived at a second exchange account.
• The wire leg — $74,000. The MT103 showed the beneficiary account at a US regional bank, credited at 9:40 AM on the transfer day and swept to two mule accounts the same afternoon — velocity and layering, the classic mule-ring signature.

The freeze that worked

The crypto leg turned on timing. The exchange accounts held the funds, but the withdrawal windows were closing. We sent the exchange legal desks a formatted freeze request the same week: deposit addresses, the full peeling-chain map, arrival timestamps, and an FBI IC3 report number. The first exchange froze 91% of the deposit address balance before the withdrawal executed. The second exchange account had already been partially withdrawn — 60% remained, and was frozen on arrival of our request.

The wire leg played out slower. The receiving bank honored a recall on $58,000 once the mule pattern and the IC3 report were attached; the remainder went to a civil demand against the mule accounts, coordinated with the case agent. Bank-side recovery continued for six weeks after the freeze.

The outcome

Funds were returned over six weeks as the exchange released the frozen balance and the bank completed the recall. The success fee was paid from the recovered amount — nothing was paid upfront.

What made the difference

• She acted in week one. The platform was still "online" and the exchange accounts still held funds. The freeze requests arrived inside the withdrawal windows — that's the only window that counts.
• The MT103 + UETR. Without the exact wire reference, the recall would have been a generic fraud claim, not a locate-and-freeze.
• One coordinated package, not five scattered asks. The exchange legal desks, the bank compliance team, and the IC3 report all told the same timeline, formatted for their audience. Credibility compounds.