I had months of contact before I realised it was fraud, what can still be reconstructed?

What can still be reconstructed after months?

After months it can still be established, per deposit, which amount went to which address on which date and up to which point that route can be followed; Paucitas records that transaction by transaction. Reconstructing means exactly that: no impression and no estimate, but a chronological overview in which every step refers to a transaction that someone else can check.

This is possible because blockchain data does not age. A transaction that was confirmed two years ago can be retrieved today in the same way as on the day itself. There is no retention period that expires and no archive that is cleaned up. What does change is the environment around it: a trading platform can go offline, a messaging app can delete an account and a mailbox can be emptied. The difference between a smooth and a laborious reconstruction almost always lies in that second part, not in the first.

That is why the first thing you can do yourself is also the simplest: keep what you still have. Export the conversation before the account disappears, take screenshots of the platform with the date in view, and ask your exchange for the full transaction history. Anyone who has been in such a contact for months usually has more material than they think: confirmation emails, customer service tickets, an invitation link, a referral to another user.

How this type of case proceeds and which authority does what is set out on the pillar page about crypto fraud investigation.

Why a series of deposits shows more than a single transfer

Multiple deposits over a long period often produce a sharper pattern than a single transfer, and Paucitas uses that repetition as the starting point of the investigation. With a single transfer you have one point of departure and one destination. With eleven transfers you have eleven points of departure, eleven moments and eleven destinations, and they relate to one another.

Repetition makes three things visible. First, whether the same receiving addresses recur, or whether a new address is created each time. Second, whether the amounts follow a recognisable build-up, for example a small first deposit followed by ever larger ones. Third, whether the funds move in the same direction after receipt, towards the same service provider or the same collection point. Those three observations together say more than each of the eleven transactions separately.

The passage of time is therefore not a side issue and not an aggravating circumstance in this kind of case. It is material. A period of seven months simply yields more measuring points than a period of a week.

The term itself and the course of this contact are explained in the glossary under pig butchering.

Which data from those months is still usable

Usable is any piece of data that records a transaction, a moment or a counterparty, and Paucitas works with a fixed delivery list per case so that you do not have to guess what is needed. In concrete terms this concerns bank statements of the transfers to your exchange, the transaction history or export from that exchange, the transaction hashes of your outgoing transactions, the addresses the funds went to, screenshots of the platform and the chat history with date and time.

Data is supplied digitally or at the office. Per case a delivery list is provided which states what data is needed. Where necessary Paucitas guides the collection and delivery of that data.

That cases from years ago still lead to a result is not a theoretical point. Europol reported on 30 June 2025 that the Spanish Guardia Civil, with support from Europol, arrested five suspects in an investigation into cryptocurrency investment fraud, in which EUR 460 million in proceeds had been laundered that originated from more than five thousand victims worldwide; Europol had supported that investigation since 2023 (Europol, 30 June 2025). A file that spans months or years is therefore an ordinary kind of file.

Which question you are actually asking and who does what is set out on the question page I am a victim of pig butchering, who investigates my case.

Case study, eleven deposits over seven months

A reconstruction over a long period runs in four steps, and Paucitas goes through them in the same order in every case: taking stock, verifying, ordering chronologically and describing coherence.

Case. A private individual deposited eleven times over seven months, from a first amount of a few hundred euros to a final transfer that was a multiple of that. For a long time he had not seen the contact as a suspicion; the platform showed a rising balance and the conversations were largely about other things. Only when a withdrawal was held back did the question come to the table.

In the investigation the first deposit said little on its own. The series did. Seven of the eleven deposits went to addresses that paid on to the same collection point within a few days, and the last four followed a route that ended up there again. It was precisely the repetition that made the route visible: the pattern lay spread over seven months instead of in a single transaction.

The report described per deposit the date, the amount, the transaction hash and the destination, alongside a chronological overview and a passage on the points where the chain could not be followed further.

If you are going through this as a private individual, the way of working is described on the page for private individuals.

The limit. Paucitas does not independently establish who is behind a crypto address; what is recorded is which service provider or party funds have gone to, so that this information can be followed up through the appropriate channels.

What the investigation delivers and what your next step is

The investigation delivers a report in which the series of deposits is described as a whole, and the order is always the same: first the investigation at Paucitas, then you can file a criminal complaint using that report.

A report by Paucitas follows a fixed structure: reason and description of the assignment, the questions, the scope, the starting points, the data supplied, the sources consulted, the method in outline, verification and quality assurance, reservations and limitations, findings per part, a chronological overview, analysis and coherence, conclusion, statement of independence and appendices. Not every report contains all parts, and the structure is matched to the purpose.

Paucitas uses no automated analysis software, in any role. The investigation is carried out by hand on the basis of publicly accessible block explorers. Every transaction and every transaction hash is verified one by one before it is included in a report.

A Paucitas investigation takes between one working day and two weeks, depending on the size of the file and the urgency. An urgent report can be delivered within one working day and in exceptional cases the same day. A regular investigation is usually ready within three working days. For files with many transactions, several wallets or missing history, the lead time rises to around two weeks. A surcharge applies to urgent assignments.

For the future there is a point that costs little effort. ESMA points out that firms in the European Union may only offer investment services if a supervisor has granted them a licence to do so, and advises checking the public register before investing to see whether the provider is listed there (ESMA, Investor Corner). If you record that check with a date and a screenshot, you will later have a piece of information that is difficult to produce retrospectively.

How this works out in a completed file can be read in the related blog case: a pig butchering victim and what the investigation delivered. If you want to know what can still be reconstructed in your situation, Paucitas will look with you at what you still have and what that yields: see blockchain research or contact Paucitas.