Case study: USDC fraud across three networks unravelled

What does this case study on USDC fraud across three networks show?

This case study shows that a route across several networks is not harder per step, but that the number of links between networks determines how much can be established with certainty. Within one network you follow a line, and at every crossing you have to demonstrate that an outgoing booking on one network belongs to an incoming booking on the other.

The starting point was complete: the affected person had three own addresses, the transaction hash per payment and an export from the platform where the USDC had been bought. That is a luxury, and it is the reason this file got far.

Where the reconstruction went wrong was not the technology but the expectation. The affected person had followed the first steps on a block explorer and thought the trail ran dead because the holdings simply disappeared on one network. They had not disappeared, they were on another network.

How did the USDC fraud across three networks run across Ethereum, Polygon and Arbitrum?

The route ran in three phases: on Ethereum the payments were merged, via a bridge the amount went to Polygon, and after a split there part of it ran via a second bridge to Arbitrum, where it arrived at a trading platform. In total it concerned nineteen bookings and two crossings.

• Phase one, on Ethereum: four payments from the affected person came together on one address, where bookings of other origin also arrived in the same time window.
• Phase two, on Polygon: the amount was split into six unequal parts, four of which were merged again within a day on a new address.
• Phase three, on Arbitrum: the merged amount went in two bookings to an address belonging to a trading platform.

The choice to also follow the two small parts that stayed behind on Polygon produced the most usable finding. One of those parts went without intermediate steps to a second platform, and that branch could be followed in full.

Why does a bridge make a USDC fraud across three networks harder to investigate?

A bridge makes the investigation harder because no single booking exists that records both networks at once: there is an outgoing booking on one network and an incoming booking on the other, and you have to substantiate the link between them yourself. That is called a cross chain crossing and in practice it is the most underestimated part of a file.

In this case every crossing was established with four items alongside each other: the exact amount including the smallest units, the time on both sides, the contract of the bridge on the receiving side, and the address that received the amount there. When those four line up and there is no second candidate in that time window, the link is traceable.

What is often underestimated: the amount alone is not enough. With round amounts several candidates occur in the same time window, and then the link cannot be established. The report therefore states for one of the six parts that the crossing cannot be linked with certainty, with the reason alongside it.

What role does the issuer of a stablecoin have in a USDC fraud across three networks?

With a centrally issued stablecoin the issuer technically has the option of freezing addresses, because that option is built into the contract itself. That is a property of the token and not a service carried out at the request of a private individual.

For your file that means two things. First: the question whether an address is frozen lies with the issuer and in practice follows a request from a competent authority, not a request from you or from an investigation firm. Second: that makes recording addresses quickly extra worthwhile, because a request from an authority has to rest on something.

For the rules that issuers and providers of crypto services in Europe fall under, the European Commission and the European Central Bank publish. Those obligations apply to those providers and not to an investigation firm, which holds no funds itself.

Which steps does an investigation into USDC fraud across three networks follow?

A cross chain investigation follows seven steps, working per network separately and laying the links last.

1. Establishing all own addresses and payments of the affected person, with amount, time and transaction hash.
2. Following the chain per network up to the point where the holdings leave the network or arrive at a service provider.
3. Establishing which bridge contract was used and which time delay belongs to it.
4. Searching on the receiving network for incoming bookings that match on amount and time window.
5. Ruling out that there is a second candidate in that time window, and if there is, the link is not established.
6. Following all branches, including the small ones, because those arrive at a service provider more often than the main flow.
7. Recording per step and per link what the finding rests on and where the uncertainty begins.

Step five is the part that makes a report hold up. A reconstruction that presents every crossing as certain is almost always too optimistic on a route with many round amounts.

Paucitas uses no automated analysis software, in any role whatsoever. The investigation is done manually on the basis of publicly accessible block explorers. Every transaction and every transaction hash is verified one by one before it is included in a report.

Why that difference matters is set out in our comparison of manual blockchain investigation and automated tools. For a route within one network, the case in which a transaction was followed to the exchange is the simpler counterpart of this file.

What can an investigation into USDC fraud across three networks not establish?

A cross chain investigation establishes which route the holdings took and at which crossings the link is certain, and not who was on the other side. That boundary belongs explicitly in the report, per link.

• Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party holdings went to, so that this information can be followed up through the channels intended for it.
• Where mixers or privacy oriented networks are used, the chain cannot always be followed in full. In that case it is stated explicitly up to which point the route can be established.
• Transactions outside the blockchain, such as cash payments or internal bookings within an exchange, are not visible in blockchain data. They are only included if underlying documents are available.
• Paucitas holds no funds itself and carries out no transactions on behalf of clients.
• Paucitas makes no commitment about the outcome of an investigation.
• A report by Paucitas is limited to factual observations and the investigation of those observations.
• Paucitas gives no tax or legal advice.

What plays an extra role in this type of file: bookings inside a trading platform are not visible on chain. As soon as holdings arrive at an exchange, the chain stops and the data of that party begins.

What can you do yourself and when is that not enough?

With a USDC fraud across three networks you can do the first phase yourself: record your own addresses and payments and follow the chain within one network on a public block explorer. That costs an evening and often already produces a collection point.

It is no longer enough as soon as the holdings leave the network. If you think the trail runs dead because the amount disappears, first check whether a bridge is involved, because in this case that was exactly the point where the affected person had stopped. Linking two networks requires an exclusion analysis and that is work that has to be accounted for.

Data is supplied digitally or at the office. Per case a delivery list is provided which states what data is needed. Where necessary Paucitas guides the collection and delivery of that data.

Paucitas never asks of its own accord for your recovery phrase or private key. If you need help reading out or restoring your wallet, we guide you through that completely, without us having to see that data ourselves.

What is in the report and how long does an investigation take?

A report by Paucitas follows a fixed structure: reason and description of the assignment, the questions, the scope, the starting points, the data supplied, the sources consulted, the method in outline, verification and quality assurance, reservations and limitations, findings per part, a chronological overview, analysis and coherence, conclusion, statement of independence and appendices. Not every report contains all parts, and the structure is matched to the purpose.

In this USDC fraud across three networks the report contained, concretely: nineteen bookings with a transaction hash spread over three networks, two crossings of which one was linked with certainty and one with a reservation, two service providers where holdings arrived with the associated time, and a conclusion in which it is stated per part what is established. With that the recipient could file a targeted police report.

An investigation by Paucitas takes, depending on the size of the file and the urgency, between one working day and two weeks. An urgent report can be delivered within one working day and in exceptional cases on the same day. A regular investigation is usually ready within three working days. In files with many transactions, several wallets or missing history the lead time rises to around two weeks. A surcharge applies to urgent assignments.

Paucitas works with a fixed rate based on your situation. Sometimes we apply an hourly rate by agreement, but the hours are always fixed in advance, so that you never face surprises. No investigation is started before the costs have been discussed and agreed.

Paucitas usually responds within a few minutes to an hour and in virtually all cases on the same working day.

Where does the work of the police begin and where does that of Paucitas?

The police can take down a report and demand data from a service provider or an issuer through criminal procedure, which Paucitas cannot do, and instead Paucitas establishes the facts that substantiate such a request. On a route across several networks that difference is extra relevant, because a request has to land separately with each party involved.

If your own reconstruction gets stuck at the point where an amount seems to disappear, you can have that looked at calmly in a free intake. We say honestly when a link cannot be established. More about this service is on blockchain investigation and transaction tracing, and the wider approach on the situation page about tracing stolen crypto.

Date of last revision: 4 September 2026.