In October 2018, a small Canadian cryptocurrency exchange called MapleChange announced it had been hacked, then deleted its website and its social media accounts. Whether it was actually robbed or simply walked off with the money is the exact question forensic accounting exists to answer.
MapleChange was a minor player among crypto exchanges, a small operation with a small team. In late October 2018 it posted on Twitter that it had been hacked and lost its holdings, a figure reported at the time as roughly 913 bitcoin. Then it did the thing that turned suspicion into alarm. It took down its website and wiped its social media accounts. Users trying to find out what had happened to their money were suddenly cut off. To a lot of people that looked less like a hacked business and more like an exit scam, where operators fake a breach to cover walking away with customer funds. The founder later resurfaced, said it had been a genuine bug rather than a theft, and claimed the tiny team did not have the money to make users whole. The full truth was never firmly established.
Cases like this are where forensic accounting meets the blockchain, because the ambiguity between a real hack and a staged one can often be settled by looking at the ledger itself.
Why crypto is easier to trace than cash
A public blockchain records every transaction permanently and in the open. Move bitcoin from one address to another and that transfer sits on the ledger forever, visible to anyone who knows where to look. That is the opposite of physical cash, which can disappear without a record. For an investigator, the permanence changes the job. The question is not whether the movements were recorded. It is figuring out who controlled the addresses on each end.
A forensic accountant working a case like MapleChange starts by identifying the exchange's known wallets and following the coins out of them. When the funds left, where did they go? Were they scattered across many new addresses in a way that looks like someone covering their tracks, or funneled into other exchanges where they could be cashed out? Timing matters as much as destination. Coins that moved out shortly before the public announcement tell a very different story than coins that moved in a window consistent with an outside attacker.
Reading the pattern
Blockchain analysis tools let investigators cluster addresses that are likely controlled by the same party and flag transfers that fit known laundering patterns. On their own, those tools produce leads, not conclusions. A forensic accountant pairs the on-chain data with the ordinary financial record: the company's bank accounts, its corporate filings, its communications, and whatever off-chain paperwork exists. The on-chain trail shows where the coins went. The off-chain records help show who was steering them and why.
Two questions usually drive the work. Was there actually a breach, or did the operators move the funds themselves? A theft by an outsider and a staged exit scam leave different footprints in the timing and destination of the transfers. And how much was really lost? In crypto that is genuinely hard, because prices swing wildly by the hour and the value of the missing coins depends on which moment you measure. A forensic accountant has to settle on a defensible valuation from the transaction records and market data before any claim can be filed.
What victims can actually do with it
All of this has a practical purpose. It gives victims and authorities something to act on. A documented trail of where the funds moved supports law enforcement in going after whoever is responsible, and a defensible loss figure lets affected users file claims or seek restitution. Recovery is never guaranteed once coins have been pushed through mixers or foreign exchanges, but without the tracing there is nothing to pursue in the first place.
MapleChange was small, and most people forgot it quickly. The lesson it left is not. When an exchange collapses and blames a hacker, the blockchain has already recorded what really happened. It takes forensic work to read it.
Integrity Forensic's forensic accountants investigate crypto losses and asset tracing. For a free consultation, call 855-673-9999 or email questions@integrityforensic.com.
Seeing red flags like these in your own numbers?
A confidential consultation costs nothing and tells you where you stand.
What it means for your matter
Most engagements are not Enron. But the pattern is the same at every scale: a diverted vendor payment, a related party that shouldn't exist, revenue booked before it was earned, a reserve fund that never quite reconciles. The methods used to expose a multibillion-dollar fraud are the same methods that expose a bookkeeper skimming from a small business or a managing agent taking kickbacks from a co-op.
If something in your financial picture doesn't add up, the earlier a forensic accountant looks, the more of the trail survives. Documents get lost, memories fade, and money moves. The record is easiest to reconstruct while it is still fresh.
Think something's wrong with your numbers?
Talk to a forensic accountant. It's confidential, and there's no obligation.