Working with Law Enforcement: Capacity, Speed, and Cross-Sector Coalitions

Core idea

Getting stolen crypto frozen or seized almost always runs through law enforcement: only LE can make a freeze permanent and reach across borders. But LE is not a uniform, always-available resource. Agencies differ widely in bandwidth, capacity, and crypto expertise, and cases often move faster than any agency can act. Cross-sector coalitions that put law enforcement and the private sector in the same room shorten the path.

Components

• Why it runs through LE. A private investigator or victim can secure a temporary freeze and preserve records at internet speed, but permanence, cross-border reach (MLAT), and the KYC identity itself come through criminal process. For any recovery-oriented case, an LE handoff is usually unavoidable (see Compelling VASP Disclosure: The Legal-Process Ladder, PI Response Priority).
• The capacity problem. Agencies vary in bandwidth (open caseload), capacity (staff, tooling, budget), and expertise (whether anyone there can actually read a trace). A well-documented referral can still stall simply because the receiving agency has no one free or no crypto skill on hand. Choose the agency and the point of contact deliberately, not by default.
• The speed problem. Laundering can complete in minutes to hours; even a willing agency may not be able to act inside that window. This is why PI-speed freeze-and-preserve exists: it buys the time for LE process, criminal or civil, to catch up (see Time-Decay of Crypto Evidence, Freezing Funds with an Exchange Email).
• Cross-sector coalitions bridge the gap. Bodies where LE and private-sector investigators share intelligence, contacts, and technique reduce friction: warm introductions to an agency that can act, deconfliction, and trusted request rails. Examples (full detail in the tooling catalogue, Law Enforcement Liaison category): Operation Shamrock (a pig-butchering-focused coalition founded by former Santa Clara DDA Erin West), IAFCI (a professional association spanning public and private financial-crime investigators), and Kodex (a verified LE-to-institution request channel used by major exchanges).
• Practical implication. Build the LE relationship early, document to the standard the receiving agency needs (see Handover Reports Must Be Replicable), and lean on coalitions and referral networks rather than cold-calling a random department.

When to use

Whenever a case needs a freeze made permanent, a seizure, or a KYC identity, meaning essentially any recovery-oriented case, and you must route it to an agency that can actually act on it.

Example

A pig-butchering victim’s funds are traced to a US exchange. A PI secures a roughly two-week courtesy freeze plus a preservation letter, then uses a coalition contact (for example through Operation Shamrock) to reach a task force that has crypto capacity, rather than filing a cold report with a local department that has no crypto examiner. That gets LE to convert the freeze and pull KYC before the window closes.

Related

Compelling VASP Disclosure: The Legal-Process Ladder, PI Response Priority: Freeze, Monitor, Predict, OSINT, Freezing Funds with an Exchange Email, Time-Decay of Crypto Evidence, Handover Reports Must Be Replicable, Monitoring Addresses with Alerts, Identify the Predicate Typology First