bitcoin recovery investigation