Sphere State Group’s CEO Björn Wahlström recently sat down with ACFE Hong Kong Chapter President Barry Tong, to discuss forensic investigations in the new landscape of crypto and traditional finance in Hong Kong. Here’s a recap of the conversation, key learnings and more. Thank you to the Association of Blockchain Compliance Professionals and Association of Certified Fraud Examiners, Hong Kong Chapter for organising.
Setting the Tone
Tong opened by framing the collaboration as overdue. ACFE, he noted, is the world’s largest anti-fraud and forensic organisation, with more than 95,000 members globally and over 900 in Hong Kong alone. But the tools of the trade are changing fast: where fraud examiners once built cases from books and records, Tong argued, they now need to be comfortable reading smart contracts and digital ledgers. Pairing ACFE’s investigative pedigree with ABCP’s blockchain expertise, he said, was simply a matter of staying ahead of a fast-moving threat.
Noting that what counted as “fringe” concepts – Bitcoin, blockchain, “burning” tokens – barely a decade ago, is now embedded in mainstream finance, with major banks quietly building around stablecoins and smart contracts.
Why Crypto Changes the Rules
A recurring theme was how fundamentally crypto disrupts the old investigative playbook.
Traditional finance runs on centuries-old infrastructure with banks, ledgers, courts, lawyers all built around the assumption that someone holds the records you need. Crypto breaks that assumption. Depending upon the asset, the information an investigator needs might sit with an unregulated offshore entity, a licensed exchange, or nowhere retrievable at all.
One consequence is a role reversal for lawyers: instead of leading an investigation, they increasingly have to wait for forensic tracing to establish what actually happened on-chain before any legal claim can be built.
The Insolvency Case Study
In a traditional insolvency, reconstructing a company’s finances from bank statements and ledgers can take weeks or months. With crypto, the equivalent tracing can happen in hours, giving investigators a real shot at understanding what happened in the critical 48 hours before a company files for bankruptcy. This is often when assets are being moved out the door fastest.
The catch: transparency doesn’t guarantee recoverability.
Wahlström described cases, some in Hong Kong, where tens of millions of dollars sit untouched for years, several transaction “hops” from their origin, in wallets with no attributable owner. Investigators can make educated guesses about who controls the funds, but guessing isn’t enough to force a recovery.
Who Can Afford to Wait a Decade?
That observation led to a pointed question: who has the patience and resources to sit on tens of millions of dollars for ten years without touching it?
Wahlström answer? Primarily large, state-linked actors, citing patterns of behavior associated with groups linked to Iran, North Korea, and Russia. He suggested some of these groups may deliberately wait until insolvency proceedings formally close before moving funds, since the funding and legal standing to reopen a closed case evaporates once proceedings end.
The Investigator’s Toolkit
Modern crypto investigations, Wahlström explained, layer traditional financial-fraud tools with blockchain-specific ones. The era of manually tracing transactions with a basic block explorer is over, the sheer scale and complexity of major blockchains, combined with the deliberate obfuscation tactics used by bad actors (mixers, wallet-hopping, dormancy periods), demands specialized commercial and proprietary tooling.
The biggest advance in recent years, he said, is attribution. The ability to map blockchain addresses to real-world identities and to each other. It’s an ongoing cat-and-mouse game: crypto’s transparency is a double-edged sword, offering investigators a rich trail to follow but also handing sophisticated actors ample opportunity to break that trail deliberately.
A Surprising Silver Lining for Fraud Victims
Perhaps the most counterintuitive point of the night: crypto fraud may now be easier to pursue than traditional fiat fraud. A few years ago, the assumption was that funds disappearing into crypto were gone for good. That’s changed. The speed of tracing has improved dramatically. Notably, victims are no longer forced to front a large legal retainer before any tracing work begins; legal costs increasingly come after the tracing has established whether pursuit is worthwhile. Given identical cases of fraud, Wahlström said he would now rather chase the crypto trail than the fiat one, purely because of how fast and cost-effective that pursuit has become. It’s a gap he expects to keep narrowing as attribution tools mature.
What Keeps Investigators Up at Night
Two concerns stood out:
- Scale and speed of adaptation. Illicit actors, particularly well-resourced, state-linked groups, are investing heavily in this space and operate free of the regulatory, judicial, and licensing constraints that bind legitimate institutions and law enforcement. Wahlström noted fraud losses in the U.S. climbing by triple-digit percentages year over year, while law enforcement agencies openly acknowledge they lack the manpower to pursue anything below a high-value threshold. This leaves many Hong Kong victims of mid-size fraud (in the HK$10–20 million range) without a realistic path to a police-led investigation.
- The return of old-world crime. Physical threats against crypto holders, from home invasions, coerced wallet handovers, even kidnapping tactics reminiscent of Hong Kong’s triad-era crime in the 1980s–90s, are resurfacing. They’re all driven by the concentration of value in digital wallets. He cited a recent North American case involving a crypto executive with no public profile whose family was targeted at home until he surrendered his wallet keys.
Regulation Is Catching Up
On the regulatory front, the tone was cautiously optimistic.
Wahlström welcomed Hong Kong’s move toward licensing virtual asset service providers (VASPs) and its emerging stablecoin regime, arguing that outright bans or “stonewalling” were never a workable long-term strategy. The technology and its users weren’t going away. He drew a parallel to a broader shift in the U.S. from open hostility toward crypto to more constructive engagement, putting Hong Kong and Singapore in similar company as jurisdictions now trying to get the regulatory framework right rather than avoid the issue.
Final and Key Takeaways on Forensic Investigations
Asked what compliance professionals, accountants, and investigators should do to keep pace, Wahlström’s answer was refreshingly modest: aim for basic literacy, not expertise.
Nobody needs to master forensic blockchain tracing personally, but everyone in an organisation should be able to field a client’s basic questions about how crypto moves, how wallets work, and how exchanges operate.
About Sphere State Group
Sphere State Group (SSG) is a global boutique risk management firm founded on a simple premise: in an increasingly volatile world, businesses need more than advice, they need confidence. Founded in Shanghai in 2007, and later headquartered in Hong Kong (2010), with offices and operations spanning Singapore, North Asia, Europe, the US, and the Middle East, the firm combines deep investigative expertise with cutting-edge approaches, delivering business intelligence, crypto risk advisory, and operational resilience.
Led by a team of certified fraud examiners, crypto forensics specialists, and former law enforcement professionals, Sphere State Group turns complex, high-stakes problems, including fraud, digital asset crime, ransomware, and reputational threats into resolved outcomes. Sphere State Group’s work is organised around three integrated pillars; Business Intelligence, Crypto Risk Advisory and Resilience Consulting.
Sphere State Group has a track record of high-profile global recoveries and investigative resolutions. It has serviced over 1,000 clients, with over 6,000 cases successfully resolved.
