I have just transferred money to a platform that turns out to be fake, can that transfer still be followed and for how long?

What happens to your funds in the first hours after the transfer?

When you follow a crypto transfer in the first hours, you see that your payment is usually moved on once or several times to a next address, after which the amount splits into smaller parts that each follow their own route. That is the pattern Paucitas sees most often in this type of file: not one jump to an end point, but a series of short steps that together give the impression that the trail runs dead.

Two things are fixed by that, and they are uncomfortable but clear. An entry on the blockchain cannot be reversed, and nobody can undo your payment because the keys lie on the receiving side. What is equally firm: every step in that series is visible, with amount, time and receiving address, and that visibility does not diminish.

On the international organisation behind this kind of payment chain and the speed at which funds are passed on, Europol publishes regularly.

How long can you follow a crypto transfer?

You can follow a crypto transfer for as long as the network exists, because an entry is not deleted, does not expire and is not overwritten. There is therefore no term after which your payment disappears from view; what disappears over time is not the entry but the overview.

When you start does make a difference in practice, and that difference can be named in three periods.

• The first 48 hours: the chain is still short, usually a few entries deep, and it is clearly visible whether the funds are standing still or moving on.
• The first weeks: the route has branched, addresses appear that have nothing to do with your case, and per branch it has to be established which part is your money.
• After that: the entries are still there in full, but the number of possible routes has grown so much that the reconstruction costs more time and more often ends in an established point rather than in a complete chain.

What is often underestimated when you follow a crypto transfer is that speed does not lie in the following itself, but in the recording. Paucitas therefore always starts at the point of departure, even if you only call weeks later: a file recorded on day one stays usable, a file reconstructed from memory after three months does not.

Whether the platform you paid holds a licence anywhere can be checked with ESMA, which publishes overviews and warnings about trading platforms without authorisation.

Which details do you record now, before you do anything else?

Record five details before you do anything else: the transaction hash of every payment, the exact time with time zone, the receiving address, the network you paid on and the amount down to the smallest unit. That is the step most often skipped, because without those five details every investigation starts with searching instead of with following.

1. Copy the transaction hash per payment from your wallet or your account, not from a message sent by the platform.
2. Note the date, time and time zone as your wallet displays them.
3. Note the receiving address and the network; the same address format exists on several networks.
4. Note the amount down to the last decimal, including the fees you paid.
5. Take screenshots of the platform, the URL, your account page and the contact you had about it, before that page goes offline.

How those separate details then become a readable whole is set out on the question page about mapping a crypto transaction flow.

Data is supplied digitally or at the office. Per case a delivery list is provided which states what data is needed. Where necessary Paucitas guides the collection and delivery of that data.

In these days, also pay attention to who approaches you or who reports to you, because parties that offer a quick solution often ask for exactly what you never have to hand over.

Paucitas never asks of its own accord for your recovery phrase or private key. If you need help reading out or restoring your wallet, we guide you through that completely, without us having to see that data ourselves.

What can a reconstruction establish and what can it not?

A reconstruction establishes which route your funds travelled and at which service provider or party they were last visible; who is behind an address stays outside it.

• Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party funds went to, so that this information can be followed up through the channels intended for it.
• Paucitas holds no funds itself and carries out no transactions on behalf of clients.
• Paucitas makes no commitment about the outcome of an investigation.
• Transactions outside the blockchain, such as cash payments or internal entries within an exchange, are not visible in blockchain data. They are only included if underlying documents are available.
• Where mixers or privacy oriented networks are used, the chain cannot always be followed in full. In that case it is stated explicitly up to which point the route can be established.

That is where the limit of this work lies: Paucitas investigates and records, but does not retrieve funds, and the next step lies with you, with the service provider involved or with the competent authority.

What an investigation means for you in practice, from intake to report, is set out on the page for private individuals.

What does the investigation produce and how long does it take?

The investigation produces a report with a chronological overview of every entry, the route up to the point where it can be established, and the party where the funds arrived. A report by Paucitas follows a fixed structure: occasion and description of the assignment, question, scope, starting points, data supplied, sources consulted, method in outline, verification and quality assurance, reservations and limitations, findings per element, chronological overview, analysis and coherence, conclusion, statement of independence and appendices. Not every report contains all elements.

Paucitas uses no automated analysis software, in any role whatsoever. The investigation is done manually on the basis of publicly accessible block explorers. Every transaction and every transaction hash is verified one by one before it is included in a report.

An investigation by Paucitas takes, depending on the size of the file and the urgency, between one working day and two weeks. An urgent report can be delivered within one working day and in exceptional cases on the same day. A regular investigation is usually ready within three working days. In files with many transactions, several wallets or missing history the lead time rises to around two weeks. A surcharge applies to urgent assignments.

Paucitas works with a fixed price based on your situation. Sometimes we apply an hourly rate in consultation, but the hours are always fixed in advance, so that you never face surprises. No investigation is started before the costs have been discussed and agreed.

Paucitas usually responds within a few minutes to an hour and in almost all cases the same working day.

Which investigation belongs here exactly you can read under blockchain investigation. What such a chain looks like worked out is shown in the case study in which a transaction is followed to an exchange.

The order matters here: first the investigation, then you can file a police report with the report in hand, because the police then receive a file in which the entries are already named and can be verified.

Start small. To follow a crypto transfer, send Paucitas the transaction hash and the time of your payment, and you will know today whether a route can be reconstructed and how deep it currently runs.

Date of last revision: 7 September 2026.