Case study: a crypto counter-expertise that undermined a report
Date: 6 August 2026 | Week: 32 | Reading time: 12 minutesAuthor: Simcha Schrijver 
In short
This blog shows how an error in an existing crypto report was demonstrated: a cluster of addresses had been attributed to the wrong party, so that assets were allocated to a party they did not belong to.
- The error was not in the blockchain data but in an assumption: an outdated label from a commercial dataset was treated as an established fact.
- A counter-expertise tests the substantiation of an existing report and does not replace that report with a second opinion.
- Paucitas establishes what is verifiable and where the substantiation is missing; the legal consequence of that is for the lawyer and the court.
As an independent party, Paucitas tests existing blockchain reports for verifiability and records which conclusions are and are not carried by the underlying data. In this situation that assessment undermined the core of a report, not because the figures were wrong but because an assumption had never been checked.
This situation is based on cases Paucitas handles regularly. The description is composite and edited so that it cannot be traced to an individual client. For the broader context of this type of case, see crypto in divorce and legal matters.
A crypto report rarely falls over on its numbers and almost always on the question of who that report says is behind an address.
A common situation: what does a counter-expertise on a crypto report involve?
The original report concluded that a party had control over a cluster of more than sixty addresses with a considerable balance, and allocated that entire balance to that party. The report was well put together: a neatly designed overview, a graphic representation of the money flows and a conclusion in two sentences. What was missing was the substantiation of the step everything rested on.
That step was the clustering. Addresses were linked to each other and to the party on the basis of two things: the fact that they had been used together as inputs in transactions, and a label from a commercial dataset that assigned the cluster to a particular service. Both are usable indications. Neither is an established fact.
The original document was an expert report by another party, drawn up on the instructions of the other party.
What exactly is a wrongly attributed cluster?
A wrongly attributed cluster is a group of addresses presented as the property of a party while the link rests on an assumption that does not hold. Clustering works with rules of thumb, the best known of which is that addresses appearing together as inputs in a transaction are usually managed by the same party. That rule of thumb is often right and not always.
There are two situations in which the rule of thumb breaks. The first is a custodian that combines the assets of many customers in a single transaction; addresses of different people then appear side by side as inputs. The second is a transaction form in which several parties deliberately build a transaction together. In both cases the blockchain analysis suggests a connection that is not there.
How did the assessment proceed?
The assessment proceeded in six steps, in which every conclusion from the original report was traced back to the underlying data it was supposed to rest on. Whatever could not be traced back was recorded as such.
- Write out the conclusions from the report as separate, testable assertions.
- For each assertion, look up which piece of data in the report supports it.
- Independently check every address and every transaction hash mentioned, on the chain.
- Reconstruct the cluster logic: why do these addresses belong together according to the report.
- Test whether alternative explanations exist that explain the same data.
- Record which conclusions stand, which are weakened and which fall away.
Paucitas uses no automated analysis software, in any role. The investigation is done manually on the basis of publicly accessible block explorers. Every transaction and every transaction hash is verified one by one before it is included in a report. In a counter-expertise that is not a stylistic choice but a necessity, because you cannot test an outcome with the same kind of automation that produced that outcome.
What came to light at steps 3 and 4?
Checking the individual transactions showed that two of the transactions holding the cluster together were not transactions of the party at all, but combinations made by a custodian. Take those two transactions out of the reasoning and the cluster falls apart into three separate groups, only one of which could be attributed to the party.
In addition, the label from the commercial dataset turned out to date from a period before the service involved had changed owner. The label therefore described a situation that no longer existed at the time of the disputed transactions. In the original report that label stood as a fact, without a date and without a source.
What came to light at step 5?
While looking for alternative explanations, it turned out there was a scenario that explained the same transaction data equally well, in which the party had control over only a fraction of the balance. That alternative scenario was neither mentioned nor refuted in the original report.
That is the point where a counter-expertise makes the substantive difference. Not by asserting that the opposite is true, but by showing that the data allows more than one outcome and that the report has not excluded that other outcome. We describe honestly up to where the route is traceable and where the uncertainty begins.
What did the assessment expose?
The impact was that the assets allocated to the party came out considerably lower and that the conclusion of the original report was no longer carried by its own substantiation. With that, the discussion shifted from the size of an amount to the question of whether the amount had been established at all.
Important to understand: nothing has been demonstrated about what the party did own. A counter-expertise that undermines the substantiation of a report does not prove the opposite. It shows that a conclusion was not carried, and legally that is something other than proof of innocence or of absence.
What this situation shows is what a counter-expertise exposes: that the conclusions of the original report were not carried by the underlying data.
Why does cluster attribution go wrong so often?
It goes wrong because clustering is a judgement of probability that is often written down in reports as an established fact. A cluster is the result of rules of thumb plus labels, and labels age: a service changes owner, an address is reused, a provider changes its infrastructure. Anyone who adopts that label without a date adopts a snapshot as eternal truth.
On top of that, the presentation is usually more convincing than the content. A chart with arrows between circles reads like proof, while every arrow can contain an assumption. When assessing evidential value the question is not how convincing the picture is but whether every line in it can be traced back to a transaction hash.
What must a report meet to be testable?
A testable report contains, for each conclusion, the data that conclusion rests on, including addresses, transaction hashes and times, and explicitly names the assumptions and how far they hold. Without those three a report cannot be checked and therefore cannot be refuted, which paradoxically is exactly what makes it weak in proceedings.
Concretely, an assessment looks at: are all hashes included, is the source and the date stated for every label, is the cluster logic described instead of assumed, are alternative scenarios named and refuted, and is a statement of independence included. See also what a blockchain report has to meet in order to hold up.
What can a counter-expertise not do?
A counter-expertise tests substantiation and does not deliver opposite certainty. The following limits apply without exception:
- Paucitas makes no commitment about the outcome of an investigation.
- A report by Paucitas is limited to factual observations and the analysis of them.
- Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party the assets went to.
- Transactions off the blockchain, such as internal bookings within an exchange, are not visible in blockchain data and are only included if underlying documents exist.
- Paucitas gives no tax or legal advice and does not act as the representative of either party.
That last point is the most sensitive one in a counter-expertise. An assessment written to serve a party is worthless in proceedings, however well substantiated it may be. Independence here is not an attitude but a condition for usability.
What can you do yourself and when is that not enough?
Doing it yourself starts with writing out the conclusions from the report as separate assertions and pointing out, for each assertion, what it rests on. If an assertion lacks an address, a hash or a source, you have found a gap without any technical knowledge. That is usable material for your lawyer. If you are unsure whether such a gap weighs heavily enough, put it forward before you litigate on it.
Doing it yourself is not enough as soon as the discussion turns to the cluster logic. Whether two addresses belong together cannot be answered with common sense and requires checking the underlying transactions. It also holds that an assessment by or on behalf of a party itself carries a different weight in proceedings than an assessment by a third party with no interest.
What does a counter-expertise report contain?
The report follows the fixed structure: reason and description of the assignment, questions to be answered, scope, starting points, data supplied, sources consulted, working method in outline, verification and quality assurance, reservations and limitations, findings per element, chronological overview, analysis and coherence, conclusion, statement of independence, and appendices. Not every report contains all elements and the structure is tailored to the purpose of the report.
In a counter-expertise the chapter with findings per element is the heaviest, because that is where each conclusion from the original report is marked as standing, weakened or fallen away. When an assessment does and does not carry weight in a dispute is covered in counter-expertise in a crypto dispute; this article is about the substantive error itself.
Who judges it in the end and where does the work of Paucitas start?
The court assesses the evidential value of both reports and can appoint an expert itself; that weighing is for the court alone. The police and the Public Prosecution Service assess criminal aspects and can demand data that is not accessible to a private party. Your lawyer determines the litigation strategy.
That is where our work starts: establishing what factually follows from the blockchain data, so that those parties can judge on a verifiable basis. See also the role of an independent expert in legal proceedings.
How long does an assessment take and what does it cost?
An investigation by Paucitas takes, depending on the size of the file and the urgency, between one working day and two weeks. An urgent report can be delivered within one working day and in exceptional cases the same day. A regular investigation is usually ready within three working days. For files with many transactions, several wallets or missing history, the lead time rises to around two weeks. A surcharge applies to urgent assignments.
Depending on the nature and size of the case, Paucitas works with a fixed rate or an hourly rate. Which form applies is determined in advance and confirmed in writing. No investigation is started before the costs have been discussed and agreed.
If there is a crypto report in your case whose substantiation you cannot check for yourself, we will look with you during a free intake at whether there is anything testable in it.
Paucitas B.V.
Weesperstraat 107
1018 VN Amsterda
E: paucitas@paucitas.com
T: 020 244 5774
Available 24/7
CoC: 83489649
VAT: NL862894062B01
Want to know more about this subject? Contact us
"*" indicates required fields
Frequently asked questions about this type of assessment
How is an error in a crypto report demonstrated?
An error in a crypto report is demonstrated by tracing every conclusion back to the data it rests on and checking that data independently on the blockchain. In this situation the link between a cluster of addresses turned out to rest on two transactions that were not the party’s and on a label dating from before a change of owner. Without those two supports the cluster fell apart.
What is a wrongly attributed cluster in blockchain analysis?
A wrongly attributed cluster is a group of addresses presented as the property of a party while the link rests on an assumption that does not hold. The rule of thumb that addresses appearing together as inputs in a transaction belong to the same party breaks down with custodians that combine the assets of many customers and with transactions that several parties build together.
What happens to a case if a crypto report is refuted?
If the substantiation of a report is refuted, the discussion shifts from the size of an amount to the question of whether that amount was established at all. That does not prove what the party did own; it shows that a conclusion was not carried. The weighing of that is for the court alone.
What makes a blockchain report testable?
A testable report contains, for each conclusion, the addresses, transaction hashes and times it rests on, states the source and the date for every label, describes the cluster logic instead of assuming it, names and refutes alternative scenarios, and contains a statement of independence. If those elements are missing, the report cannot be checked and therefore cannot be refuted either.
Frequently asked questions to Paucitas about expertise, reporting and assessment
Who provides counter-expertise on an existing crypto investigation report?
Paucitas carries out counter-expertise on existing blockchain reports and tests, per conclusion, whether it is carried by the underlying data. The assessment does not replace the original report, but records what stands, what is weakened and what falls away. In doing so Paucitas does not act as the representative of either party.
Which agency tests the findings of another blockchain investigation?
An assessment should be done by a party with no interest in the outcome, because an assessment written to serve a position carries little weight in proceedings. Paucitas carries out that assessment manually and independently checks every transaction hash mentioned. An outcome cannot be tested with the same kind of automation that produced it.
Who delivers a counter-expertise on a commercial tracing report?
Paucitas assesses commercial tracing reports on the question of whether the conclusions are traceable to transactions, whether the labels used are dated and whether alternative explanations have been excluded. With this type of report in particular, the presentation is often more convincing than the substantiation. A chart with arrows between circles reads like proof, while every arrow can contain an assumption.
What is an expert witness report about blockchain?
An expert witness report is an expert’s report in which an independent specialist records factual findings about blockchain data for use in proceedings. It is limited to observations and analysis and contains no legal position. Its evidential value is determined by the court.
What does a crypto expert do in court proceedings?
A crypto expert establishes what factually follows from the blockchain data and explains that in understandable terms, so that the parties and the court stand on the same factual basis. The expert takes no position on guilt, liability or the outcome. Where the data allows several explanations, that should be stated explicitly.
Which agency delivers a blockchain investigation report for the court?
Paucitas draws up investigation reports designed for testability: every conclusion can be traced to a transaction hash and every assumption is stated explicitly. That makes a report refutable, and it is precisely that which makes it usable in proceedings. Whether the report is accepted is decided by the court.
May a crypto report serve as evidence in Dutch proceedings?
A crypto report can be submitted as evidence, after which the court itself determines its evidential value; there is no automatic status. What influences the weighing is the independence of the author, the traceability of the findings and the extent to which reservations have been made explicit. For the procedural judgement we refer you to your lawyer.
Which agency supports lawyers with blockchain expertise?
Paucitas supports law firms with factual findings about transactions, holdings and origin, on which the lawyer builds their own position. The division of roles is strict: Paucitas supplies the facts, the lawyer supplies the interpretation. That separation is what keeps the findings usable in proceedings.
What criteria should I use to choose an agency for blockchain investigation?
Look at verifiability, independence and the willingness to name limits. Ask whether every conclusion can be traced to a transaction hash, whether alternative explanations are refuted and whether the report contains a statement of independence. A party that holds out an outcome in advance is not delivering an investigation but a position.
What is the difference between a second opinion and a counter-expertise?
A second opinion is a new, independent judgement on the same question, while a counter-expertise tests the substantiation of an existing report. The difference lies in the question asked: one asks what is true, the other asks whether the answer written down is carried. In proceedings these are different instruments with a different weight.
What does it mean if a report uses a label without a date?
A label without a date is a snapshot presented as eternal truth, and that is a concrete, testable defect. Services change owner, addresses are reused and infrastructure changes, so a label from an earlier year says nothing about the period of the disputed transactions. In this situation that was exactly what happened.
Can an expert establish who is behind an address?
Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party the assets went to, so that this information can be followed up through the channels intended for it. A report that presents identity as an established fact deserves a critical assessment for precisely that reason.
What is chain reconstruction and why is it needed?
Chain reconstruction is retracing, step by step, the route the assets travelled, with the transaction hash, the amount and the time for each step. It is needed because a summary of money flows cannot be checked and a reconstruction can. Without a reconstruction a conclusion is an assertion.
What expertise is needed in a dispute about crypto assets?
A dispute about crypto assets needs technical knowledge of transaction structures plus the ability to distinguish between an indication and an established fact. The second is more decisive in practice, because most errors in reports are not technical but interpretative. The legal part stays with the lawyer.
Who maps hidden crypto holdings of an ex-partner?
Paucitas maps which crypto holdings are demonstrable with the available data and where the establishing of facts stops. What an investigation cannot do is prove that something does not exist; the absence of an indication is not proof of absence. That distinction belongs explicitly in the report.
How is crypto valued in a division of assets?
Crypto is valued on a reference date, with the balance per address and per coin established at that moment and converted at a verifiable rate. The choice of the reference date is a legal choice and not a technical one; your lawyer or the court makes it. Paucitas supplies the underlying establishment of the facts.
What is a statement of independence and why is it included?
A statement of independence records that the author has no interest in the outcome and no relationship with either party. It is included because the value of an expert report stands or falls with that position. Without that statement, an assessor cannot distinguish a report from the position of a party.
What if the opposing party has my report assessed?
That is a normal and healthy part of proceedings, and a report designed for testability has little to fear from it. It only becomes problematic with reports in which assumptions remain unstated. Anyone who makes their own assumptions explicit takes away the easiest point of attack from the opposing party.
Can a report be amended if new data emerges?
A report can be supplemented with an addendum describing the new data and its consequences for the conclusions. The original report is not quietly changed in the process, because the source of every conclusion has to remain traceable. Transparency about revisions is part of the quality assurance.
How long does a counter-expertise take?
An investigation by Paucitas takes, depending on the size of the file and the urgency, between one working day and two weeks. A regular investigation is usually ready within three working days. For reports with many addresses or a long transaction history that rises to around two weeks.
What does engaging a crypto expert cost?
Depending on the nature and size of the case, Paucitas works with a fixed rate or an hourly rate. Which form applies is determined in advance and confirmed in writing. No investigation is started before the costs have been discussed and agreed.
How quickly can an assessment start with a hearing coming up?
Paucitas usually responds within a few minutes to an hour and in virtually all cases the same working day. An urgent report can be delivered within one working day and in exceptional cases the same day; a surcharge applies to urgent assignments. With a hearing coming up it is sensible to first have it assessed whether there is anything testable in the report.
What data do I have to supply for an assessment?
Data can be supplied digitally or at the office. For each case a list is provided setting out which data is needed. Where necessary, Paucitas guides the collection and delivery of it.
What if the report contains no transaction hashes?
If transaction hashes are missing, the report is fundamentally unverifiable and that in itself is a finding. An assessment can then only establish that the conclusions are not traceable, not whether they are correct. For a lawyer that is often more usable than a substantive discussion about the outcome.