Blockchain Forensics Investigator

About The Legal Chain The Legal Chain is a UK-based legal and regulatory advisory firm focused on blockchain, crypto, and Web3. We work with token issuers, exchanges, stablecoin operators, and infrastructure projects navigating FCA authorisation, MLR 2017, MiCA, and the wider UK and EU regulatory landscape. This role runs the firm's on-chain investigative practice — tracing stolen assets, supporting litigation, and producing evidence that survives a courtroom. About the Role You will own the firm's blockchain forensics function. Clients come to us after the worst has already happened: a protocol drained, a treasury compromised, a counterparty gone silent with funds on-chain. Your job is to reconstruct what happened, follow the assets across chains and mixers, identify the off-ramps, and produce a written output that a solicitor can file, a judge can read, and an exchange can act on. Day to day, you will run tracing investigations using Chainalysis, TRM Labs, Elliptic, and open-source tooling; draft expert reports in support of freezing orders, disclosure applications, and proprietary claims under English law; coordinate with instructing solicitors, law enforcement, and insolvency practitioners; and liaise with exchanges and custodians on asset freeze and recovery requests. You will also be the firm's technical voice in incident response when a client is still bleeding. On-chain forensics is not a desk exercise in this role. Your work ends up in witness statements and court bundles. The standard of care is accordingly high. Key Responsibilities - Conduct end-to-end tracing of stolen, misappropriated, or fraudulently transferred cryptoassets across EVM chains, Bitcoin, and major L2s. - Produce written investigation reports suitable for use as evidence in English court proceedings, including CPR Part 35 expert reports where appropriate. - Support applications for freezing orders, Bankers Trust orders, and Norwich Pharmacal relief against cryptoasset wallets and exchanges. - Liaise with centralised exchanges and custodians to secure freezes, preserve records, and coordinate recovery. - Work alongside instructing solicitors, barristers, and overseas counsel on cross-border recovery strategies. - Engage with UK law enforcement (NCA, City of London Police, Action Fraud) and overseas equivalents where investigations touch criminal proceedings. - Support AML and regulatory colleagues with on-chain analysis feeding into client risk assessments and SARs. - Maintain rigorous chain-of-custody and audit trails for all investigative output. What We're Looking For **Must have** - 5+ years in blockchain analytics, on-chain investigations, or cryptoasset financial crime work. - Deep hands-on fluency with at least two of Chainalysis Reactor, TRM Labs, Elliptic Investigator, or equivalent enterprise-grade platforms. - Demonstrated experience tracing across EVM chains, Bitcoin, and at least one major L2, including through bridges, mixers (Tornado Cash, Railgun), and privacy coins where relevant. - Track record of investigative output used externally — by law enforcement, courts, regulators, insolvency practitioners, or exchanges. - Working understanding of how English courts treat cryptoassets: freezing orders, proprietary claims, and the AA v Persons Unknown line of authority. - UK resident with the right to work in the UK without sponsorship. - Native or fully fluent English, with written drafting suitable for court-facing reports. **Personal qualities that matter to us** - Absolute discretion. You will see live incidents before the market does, and client reputations ride on what leaks. Nothing leaks. - Investigative patience. The thread that matters is usually the fifth one, not the first. - Evidentiary discipline. You document as you go, because a trace that can't be defended is a trace that didn't happen. - Long-term mindset. We are building a practice, not chasing one-off cases. The right person wants to be here in five years. **Nice to have** - Prior experience giving evidence or being cross-examined as an expert witness. - Background in law enforcement (NCA, FBI, Europol), a national FIU, or a Big Four forensics practice. - Familiarity with cross-chain bridge analytics and heuristic clustering at a technical level. - Reading fluency in Solidity sufficient to follow exploit transactions in contract code, not just in the trace. - Experience with asset recovery in offshore jurisdictions commonly used for crypto fraud (BVI, Cayman, Seychelles, UAE). - Published writing or conference contributions establishing a public investigative voice. What We Offer - Above-market base salary (~20% above industry benchmarks for this level). No variable compensation; we believe in paying well and predictably. - Fully remote role, based in the UK, with flexibility on working hours (European business hours overlap required). - Full budget for the analytics tool stack you need — we do not ask investigators to work with dulled instruments. - Work that reaches actual outcomes: funds frozen, assets recovered, perpetrators named. - A long-term, stable role with a company that values integrity and invests in the people who build it. How to Apply Send your CV. We review every application and will follow up with a short set of screening questions. Promising candidates are invited to a full interview where we discuss experience and fit in depth. - Welcome to The Legal Chain.