Blockchain & digital asset investigations
Build a technical account of relevant digital asset transactions and their connection to a reported incident. We combine supported blockchain analysis with authorised off-chain evidence, explaining what can be traced and what remains uncertain.
Discuss your requirements
Define the transaction question
Start with the reported event, relevant networks and assets, transaction identifiers, addresses, dates and client-supplied records. Agree the question: where a transfer went, how events relate in time or which records could resolve an uncertainty. Create an evidence register and record the units, time references and authorised recipients. Private keys and recovery phrases are not needed for this initial scope.
Validate the asset movement
Check network and token identity, execution status, contract events, units and relevant confirmation assumptions. Compare independent sources for material findings where agreed. For a swap, bridge or custodial service, document the evidence connecting each step and any alternatives. Distinguish observed transfers from inferred continuation, and avoid counting the same value repeatedly.
Trace observable activity and record assumptions
Analyse the scoped transaction paths, addresses and service or contract interactions. Link significant findings to transaction references and research dates so another specialist can follow the analysis. Document clustering assumptions, coverage gaps and stopping points. A visual flow must not imply a stronger connection than the records support.
Separate attribution from observed transfers
An address is not a verified person. State the source, date and confidence of third-party labels; correlate authorised off-chain records and test alternative explanations. Provider records may be needed to establish ownership or control through an appropriate authorised process. Explain what remains unknown about identity, intent and responsibility. Technical tracing does not confer powers to freeze or seize assets, and does not guarantee recovery.
Deliver a reviewable evidence package
Provide a referenced chronology and flow diagram, validation record, analytical method, attribution assessment and unresolved questions. Distinguish observed movements from hypotheses and specify any additional provider records required. Agree a secure handover and restricted distribution to the client’s legal team, insurer or investigators, as appropriate.
Agree the next decision and authorised follow-up
Begin with a feasibility review when the available material or tracing coverage is uncertain. Agree the investigation scope, exclusions, format and authorised recipients before a larger workstream. The handover identifies what can be answered now, which further records may help and who is responsible for requesting them; recovery decisions remain with the appropriate providers, advisers and legal process.
What you receive
- Investigation scope and validated starting-record register
- Referenced transaction chronology, flow diagram and validation record
- Method, attribution assumptions, limitations and unresolved alternatives
- Prioritised provider-record questions and secure handover for authorised recipients
Common questions
Can you guarantee recovery of cryptocurrency?
No. We provide technical investigation. Tracing, freezing and recovery are different activities, and recovery depends on external parties and the applicable legal process.
Does an address identify its owner?
Not necessarily. Ownership or control requires corroborating evidence; a tool label or transaction connection is not automatically a verified identity.
Should we send private keys or recovery phrases?
No. An initial enquiry should contain a brief description only. Relevant records and any sensitive evidence are exchanged through an agreed secure process.
Can you analyse more than one blockchain in the same matter?
We first assess the relevant networks, services and available data. Cross-network movement can introduce gaps or ambiguity, which are reflected in the proposed scope and final findings.
Can a tracing report be given to a lawyer or law-enforcement contact?
A report can be prepared for agreed authorised recipients with source references and methodological limits. Decisions about formal submission or legal action remain with the commissioning party and its advisers.
What can we establish before commissioning a full investigation?
An initial scoping review can identify the networks, starting transactions, available evidence and likely analytical limits. We then propose bounded work and deliverables; it is not a promise that all onward movement or ownership can be resolved.
Connected expertise
All services
Corporate & insider investigations
Confidential technical investigations into suspected insider activity, IP loss, digital fraud and misuse of corporate information.
Explore service
Threat intelligence & brand protection
Open-source research, threat intelligence, social media monitoring, and assessment of impersonation and digital exposure.
Explore service
Computer & mobile forensics
Forensic examination of computers, phones, storage media and backups, with documented acquisition, timelines and evidence limitations.
Explore service