Define the question and preserve the starting evidence
Start with a bounded question: did a particular payment reach the stated destination, how did specified assets move afterwards, or what evidence connects a transaction to a disputed instruction? Record the blockchain network, transaction identifier, asset contract where applicable, amounts and relevant time period. A familiar token name or ticker is insufficient because different contracts and networks can use similar labels.
Preserve the original instructions, exchange statements, wallet records and communications through an agreed process. Keep screenshots as supporting material, while retaining machine-readable records where available. Do not put seed phrases or private keys in an investigation brief. Public transaction analysis normally starts with public identifiers; access to protected accounts or devices requires a separately defined and authorised scope.
Verify the transaction before drawing the graph
Check the transaction’s status, inclusion in a block and network context. On Ethereum, the transaction envelope, receipt and emitted events describe different aspects of execution. A failed transaction may still incur a fee; an apparent interaction with a token contract does not by itself establish the transfer of the asset being investigated. Account for decimals, token identity and the distinction between the base asset and tokens.
Record the data provider, retrieval time, block reference and interpretation method. Where the finding matters materially, compare independent representations or validated node data as appropriate. Explain confirmation or finality assumptions and any reorganisation risk relevant to the network and observation time. A diagram should make those source records easier to understand, not replace them.
Keep ownership claims separate from observable transfers
An on-chain address identifies an account in a network, not automatically a named person. A service label, clustering heuristic or pattern of transactions can guide enquiries, but its source, date and confidence must remain visible. Common funding, timing or transaction proximity may support a hypothesis without proving common control or criminal intent.
Distinguish observed transfers, analytical inferences and independently corroborated identity information in the report. For an exchange deposit, the available public record may identify a service boundary while leaving the customer attribution unresolved. Account records, contractual documentation or information obtained through an appropriate legal process may be needed. Technical analysis should state that gap rather than convert a probable label into a definitive accusation.
Explain swaps, bridges and points where continuity is uncertain
Assets can change representation through swaps, bridges, custodial systems or transfers across networks. For each transition, record the relevant chain, contracts, source and destination events, identifiers and matching assumptions. Similar amounts close in time do not by themselves prove that two transactions are the same economic movement. Fees, exchange rates and pooled liquidity can complicate matching.
Trace only as far as the evidence supports. A graph can show several plausible paths when a unique continuation is unavailable. Distinguish gross transaction flows from balances, and avoid counting the same value repeatedly as it moves between addresses. Record valuation time and method only when valuation is part of the agreed scope; a transaction history alone does not establish a recoverable loss.
Separate tracing from recovery decisions
Finding a destination does not grant authority to freeze assets, reverse a transfer or obtain an account holder’s information. The available response depends on the asset, service provider, jurisdiction, timing and evidence. Coordinate preservation and potential escalation with the relevant provider and advisers through verified channels. Keep communications and receipt references in the case record.
For a family office or private client, establish one authorised contact and a controlled decision process before engaging additional parties. Be cautious about anyone who promises guaranteed recovery or requests a seed phrase to investigate public transactions. A credible engagement defines technical deliverables, limitations and fees without presenting recovery as an assured outcome.
Ask for a report that another analyst can follow
Useful outputs include a source register, normalised transaction table, annotated flow diagram, stated attribution basis, unresolved hypotheses and a prioritised evidence request list. Every significant connection in the diagram should be traceable to a record or clearly marked inference. Include the extraction date, tools, network assumptions and limits of the investigation so later review can account for changing labels and data.
TRUST-IT can scope digital asset analysis as part of a wider investigation involving communications, devices or corporate records. An initial discussion should establish the question, networks, known transaction identifiers and available records. This creates a practical basis for deciding what can be established technically and what requires additional evidence or specialist legal action.
Further reading
Put the guidance to work
Transaction tracing, wallet activity analysis and technical evidence reports for digital asset fraud and incident investigations.
Blockchain & digital asset tracing