Blockchain & digital asset investigations

Define the transaction question

The starting material may include transaction identifiers, wallet addresses, exchange statements and communications supplied by the client. We verify the relevant network and asset, clarify the reported event and establish an evidence register. The scope identifies the questions to answer: where a transfer went, how events relate in time, or which records could support a further enquiry through an authorised process.

Trace observable activity and explain the method

We analyse available transaction paths, relevant addresses, token movements and interactions with services or contracts. Each significant finding is linked to a reproducible reference where possible. Attribution labels from analytical tools are treated as claims with a stated source and confidence. Clustering assumptions, incomplete coverage and changes between networks are documented so the visual transaction map does not imply more certainty than the underlying data supports.

Connect on-chain records to the incident

A blockchain address is not, by itself, a verified person. We correlate the observed activity with client-provided records, account information, messages and lawful public-source research. Exchange or service-provider records may be needed to resolve ownership or control and are obtained through the appropriate authorised channel. We distinguish evidence of a transfer from evidence about intent, beneficiary identity or responsibility.

Assess limits before setting expectations

Some paths become difficult to follow through custodial platforms, cross-chain activity, privacy mechanisms or incomplete data. The report identifies the stopping point and explains what additional information would be needed. Technical tracing does not create the authority to freeze, seize or return assets. Recovery depends on the facts, relevant service providers and applicable legal processes; a tracing engagement does not guarantee a financial outcome.

Prepare a usable investigation package

The deliverable includes the evidence references, transaction chronology, flow diagrams and an explanation of analytical assumptions. We can prepare a technical briefing for the client’s legal team, insurer or investigators and identify specific preservation questions for relevant providers. Secure handling and restricted distribution are agreed because the package may contain sensitive financial and personal information.

Start with transaction identifiers and the reported event

A useful initial scope identifies the network, relevant transaction references, dates and the event the client needs to understand. We compare observable transfers with the supplied incident account and explain the units and time references used. The analysis should not require private keys or wallet recovery phrases; those secrets do not establish the research question and should remain protected.

Explain address labels and attribution confidence

A transaction graph shows relationships between addresses, not necessarily between identified people. Labels from tools or third parties need to be assessed for their source and reliability. We distinguish direct observations from attribution assumptions and identify where exchange records or other off-chain information would be needed. This helps legal and investigative recipients understand what the graph supports.

Deliver a package another specialist can follow

The report can include relevant transaction references, a scoped flow diagram, research dates and a narrative of the observed movement. Complex services or gaps are marked where they limit tracing. The recipient should be able to distinguish the visible flow from any unverified conclusion about ownership, intent or recovery prospects. Further requests to providers or authorities are coordinated by the appropriately authorised parties.

Common questions