Table of Contents
When stolen stablecoins sit in an attacker's wallet, they can still be frozen by the issuer. Once they are swapped, bridged or cashed out, that option usually disappears.
That makes incident response a race against the next transaction. The forensic report that arrives a week later matters for court, but the call that reaches an issuer or exchange in the first hour is what gets money back.
So this compares six incident response and recovery providers on how fast they engage, who they are built for and how they push for a freeze.
Tracing tells you where the money went. Recovery depends on reaching someone who can stop it, an issuer, an exchange or a court, before it moves again.
Key Takeaways
- Stolen stablecoins are only recoverable while someone can still freeze them.
- SEAL 911 is free, volunteer-run and reachable around the clock.
- zeroShadow and Three Sigma sell retained response for protocols and firms.
- Kroll brings court-grade forensics and regulatory reporting to large incidents.
- Neither TRM nor Chainalysis still lists a standalone incident response page.
What Actually Differs
Every provider here traces funds onchain. The differences are in what happens around the tracing.
The first is speed, meaning whether someone answers in minutes or after a contract is signed. The second is reach, meaning whether the team has working relationships with issuer and exchange compliance desks that act on a freeze request.
The third is evidence, meaning whether the output stands up with law enforcement and in court. Our guide to the first hour after a theft sets out why containment beats investigation in that window.
What to note: sign an engagement before an incident, because negotiating scope during one costs the minutes that matter.
Best Crypto Incident Response and Asset Recovery Firms
1. SEAL 911
Does the job: free emergency triage from volunteer security researchers, at any hour.
SEAL 911 is the help channel of Security Alliance, a donation-funded non-profit, and the first number many protocols call when an exploit starts.
The platform supports:
- A Telegram bot, @seal_911_bot, staffed around the clock
- A real person reviewing every case, with an average response claimed under 30 minutes
- Containment advice, securing remaining assets and referrals to recovery resources
- War rooms for active protocol exploits, over 125 of them in 2025
- No charge, and no requests for seed phrases, keys or payment
SEAL claims over 3,300 emergencies handled and over 180 million dollars protected, but it cannot guarantee recovery. The Block reported about 28 volunteers and five full-time staff in late 2025, so it triages and connects rather than running a long investigation.
Best for any team in the first minutes of an exploit, before a paid responder is engaged.
2. zeroShadow
Does the job: retained response built by former Chainalysis investigators, with freezing as a stated goal.
Four former Chainalysis cybercrime investigators founded zeroShadow in spring 2024, and it sells response as part of a wider security programme.
The platform supports:
- A Prevent, Prepare, Respond and Recover model across the incident lifecycle
- Torch monitoring with a critical alert SLA under 15 minutes
- Real-time work with exchange security and compliance teams to flag illicit deposits
- Recovery support through law enforcement and jurisdiction guidance after a freeze
- GRC as a service for SOC 2, ISO 27001 and CCSS, plus a virtual CISO
The services page describes five packages but publishes no prices. The firm also points urgent cases to SEAL 911, which makes the two complementary rather than competing.
Best for protocols and crypto firms that want monitoring, response and recovery under one retainer.
3. Three Sigma
Does the job: an audit firm's engineers inside your war room during a live exploit.
Three Sigma is primarily an auditor, and its response service leans on that, fixing the contract while others chase the funds.
The platform supports:
- A secure war room with scope confirmation and communication lockdown
- Containment by pausing contracts, adjusting oracles and risk parameters, and rotating keys
- Patches and circuit breakers validated on mainnet-fork simulations
- White-hat coordination, safe-return programmes and law enforcement contact
- Communications support and a post-mortem with a hardening plan
The page commits to no response time beyond mobilising on short notice, and says start depends on access, multisig coordination and the engagement agreement. No pricing is published.
Best for protocols that need the exploit stopped and patched as well as traced.
4. Kroll
Does the job: enterprise incident response with regulatory reporting and court-ready evidence.
Kroll describes itself as the largest global incident response provider, and its crypto practice carries that into exchange and custodian breaches.
The platform supports:
- 24x7 incident response and a Cyber Incident Response Retainer
- Breach containment and forensic investigation of the attack vector
- Root cause analysis aligned with FCA, SEC, MiCA and FATF travel rule requirements
- Chain-of-custody preservation for compliance reporting
- Tracing through Tornado Cash, Monero and the Lightning Network
Kroll says it traced about 200 million dollars in the largest crypto fraud in Canadian history. Its page names no hotline response time and no pricing, and the retainer is clearly aimed at regulated institutions rather than small teams.
Best for exchanges, custodians and regulated issuers whose incident will end up in front of a regulator.
5. CipherBlade
Does the job: loss-scaled tracing and law enforcement liaison for victims and businesses.
CipherBlade scopes each case with a budget proportionate to what was lost and states the cost before any work begins.
The platform supports:
- Hop-by-hop tracing across chains, bridges and swap services
- Monitoring of flagged addresses and use of industry relationships to attempt freezes
- Attribution of the exchanges and custodians the funds reached
- Evidence reports and a bridge to the law enforcement agencies involved
- A separate expert witness practice for litigation
The firm states plainly that recovery cannot be guaranteed and warns against anyone who promises it. That freeze attempt still depends on issuer policy, which our analysis of issuer freeze control shows varies sharply by token.
Best for individuals and smaller businesses that need a scoped investigation rather than a retainer.
6. Chainalysis Global Services
Does the job: investigation support from the largest blockchain analytics team.
Chainalysis no longer lists a standalone incident response page, and instead offers investigation help through Global Services.
The platform supports:
- 120+ experts working in 15+ languages
- Expert coaching on asset tracing and complex cases
- Intelligence built on Chainalysis attribution data
- Training programmes with over 20,000 certifications issued
Chainalysis disclosed a security incident on 30 October 2026, and its Reactor, KYT and Address Screening products only came back online on 7 November. Global Services is also framed as capability building, so buyers should confirm whether it will run a live incident or coach their own team.
Best for institutions already on Chainalysis tools that want expert help on a complex trace.
Incident Response and Recovery Firms Compared
| Provider | Built for | Stated speed | Freeze or recovery route | Cost model |
|---|---|---|---|---|
| SEAL 911 | Anyone hit by an exploit or drain | Average under 30 minutes | Volunteer network and referrals | Free |
| zeroShadow | Protocols and crypto firms | Critical SLA under 15 minutes | Exchange compliance teams, law enforcement | Packages, not published |
| Three Sigma | Protocols with live exploits | Short notice, not quantified | White-hat and safe-return negotiation | Quote |
| Kroll | Regulated institutions | 24x7, not quantified | Law enforcement and legal teams | Retainer, not published |
| CipherBlade | Victims and businesses | Not stated | Freeze attempts, law enforcement liaison | Scaled to loss, quoted upfront |
| Chainalysis Global Services | Institutions on Chainalysis | Not stated | Investigation support | Not published |
Only two providers put a number on speed, and one of them is free. Everyone else asks you to trust that a retainer means a fast answer.
What to note: ask each provider to put its response time and its freeze contacts in the contract, not the sales deck.
Your Responder Has Dependencies Too
Incident response firms run on the same infrastructure as everyone else. Chainalysis spent a week restoring Reactor and KYT after its own October 2026 security incident, and many investigators rely on those tools.
A volunteer network has the opposite limit. SEAL 911 answers fast, but about 28 volunteers cannot run every long investigation, and they say so.
The practical answer is two layers: a free first call for the opening minutes and a retained firm for the days after. Write both into your runbook, with the Telegram handle and the retainer contact on the same page.
What to note: ask your provider which analytics tools it depends on and what it does if one goes down mid-incident.
How to Choose
1. Decide who you are
A protocol mid-exploit needs Three Sigma or zeroShadow, a regulated exchange needs Kroll, and an individual victim needs CipherBlade. SEAL 911 is the first call for all of them.
2. Ask for named freeze contacts
Ask which issuers and exchanges the provider has frozen funds with in the last year. Relationships matter more than tooling.
3. Sign before you need it
A retainer agreed in advance removes the negotiation from the worst hour. Store the contact details where the on-call team can reach them.
4. Check the evidence standard
If the incident may reach court or a regulator, chain of custody matters from the first minute. Kroll and CipherBlade state this explicitly.
5. Plan for the money you do not get back
Most stolen funds are never recovered, so pair a responder with cover, as set out in our guide to stablecoin business insurance.
What to note: run one tabletop exercise with your chosen responder before signing a long contract.
How This List Was Built
Inclusion required three things, so that the comparison means something.
- A first-party page describing an incident response, investigation or recovery service
- A service that can engage during an active crypto theft, not only afterwards
- A provider that does not promise guaranteed recovery
TRM Labs was left out because its incident response page now redirects to a homepage describing an investigations product, with no response service described. Providers who believe they meet the three criteria above are welcome to send documentation for consideration in the next update.
What to note: last reviewed against provider websites in November 2026.
Risks and Limitations
- No provider can guarantee recovery, and most stolen funds are never returned.
- Response times and recovery figures are self-reported and not independently verified.
- A freeze depends on the issuer or exchange agreeing to act, which no responder controls.
- Fake recovery services target theft victims, so verify any firm that contacts you first.
- No provider here publishes prices, so costs are unknown until a quote.
Conclusion
The best incident response provider is the one that answers in minutes and already knows the compliance desk that can freeze your funds. A thorough report a week later rarely changes the outcome.
SEAL 911 is the free first call, zeroShadow and Three Sigma cover protocols on retainer or in a war room, Kroll suits regulated institutions, CipherBlade scales to individual losses, and Chainalysis offers investigation depth on its own data.
Two habits matter more than the choice. Agree the engagement before the incident, and keep the first call and the long investigation as two separate plans.
Read Next:
- What to Do in the First Hour After a Theft
- What the Binance Hack Proved About Issuer Control
- Best Insurance for Stablecoin Businesses
FAQs:
1. Can stolen stablecoins be recovered?
Sometimes. Issuers such as Tether and Circle can freeze tokens at an address, so recovery is possible if the freeze happens before the funds are swapped or cashed out.
2. Is SEAL 911 really free?
Yes. SEAL 911 is run by volunteers through a non-profit and states that it never asks for payment, seed phrases or private keys.
3. What should I do first after a crypto hack?
Contain the incident, stop further outgoing transactions, record every transaction hash and contact a responder such as SEAL 911 within minutes.
4. How do I spot a fake recovery service?
Be wary of anyone who contacts you first, guarantees recovery or asks for upfront fees, seed phrases or keys. Legitimate providers state that recovery cannot be guaranteed.
5. Do I need an incident response retainer?
If you hold meaningful funds onchain, a retainer agreed in advance saves the time you would otherwise spend negotiating scope during an active theft.
Disclaimer:
This content is provided for informational and educational purposes only and does not constitute financial, investment, legal, or security advice; no material herein should be interpreted as a recommendation, endorsement, or solicitation, and readers should conduct their own independent research or consult a qualified professional. Services, response times and recovery figures are drawn from each provider's own website or news reports at the time of writing, are not independently verified here, and change frequently. No provider can guarantee the recovery of stolen funds. Confirm current scope, terms and pricing directly with each provider before engaging one.
