A crypto fraud investigation establishes what factually happened to your money: which addresses it went to, through which intermediate steps, and at what point the route arrives at a service provider that is bound to identify its customers. Paucitas records that chain in a traceable way, in a report that a lawyer, insolvency practitioner, accountant or judge can use. The investigation makes no finding of guilt and promises no recovery of funds. It delivers the factual basis on which a next step can be built.
On this page
- What is a crypto fraud investigation, and when is it worthwhile?
- How is a suspicion of investment fraud investigated?
- How do you establish whether a platform exists and whether you still have access?
- What can you do in the first hours after a transfer?
- How is the route your money took reconstructed?
- What happens when the trail ends at an exchange?
- Why is a recovery scam the second risk?
- What can a report do for a criminal complaint or civil proceedings?
- Which signals point to fraud rather than to a bad investment?
- What is in a fraud investigation report, and how long does it take?
- How does a fraud investigation proceed, step by step?
- What role do the police, regulators and banks play?
- What can a fraud investigation not do?
- Frequently asked questions
What is a crypto fraud investigation, and when is it worthwhile?
Where fraud is suspected, someone has been persuaded to transfer crypto, or to transfer money that was then converted into crypto. An investigation does not start with the question of who is behind it, but with the question of what verifiably happened: which transactions were carried out, from which wallet or account, to which destination, and how much of that can be found back on the blockchain.
It is worthwhile as soon as there is a single starting point: a transaction hash, a receiving address, an exchange of messages or a bank statement. Even without a complete history, more can usually be established than people expect, because every transfer on a public blockchain leaves a trail that cannot be erased after the fact. If every starting point is missing, the first step is to put in order what does remain.
Further reading: the term crypto fraud and blockchain transaction.
How is a suspicion of investment fraud investigated?
With investment fraud, the money is often paid in over several steps and over a longer period, at the request of someone posing as an adviser or account manager. The investigation reconstructs the sequence: which deposits were made, on which dates, to which addresses, what returns were displayed, and whether anything on the blockchain corresponds to them.
A recurring picture is that the profit shown never had an on-chain equivalent. The figure on the dashboard was then a representation in the provider’s own database, not a balance held anywhere. That difference can be established with documents, and for a criminal complaint or civil claim it is a material fact, because it shifts the question from a fall in price to whether there was ever an investment at all.
Further reading: investment fraud, boiler room and the blog recognising crypto investment fraud.
How do you establish whether a platform exists and whether you still have access?
Before anything else happens, it is established whether the platform holding your funds actually exists and whether you still have access credentials. A provider that has stopped responding, a website that keeps changing name or an app that disappears from the store is not conclusive proof, but it is reason to answer that question first. The answer determines what remains possible afterwards.
Paucitas holds no funds itself and carries out no transactions on behalf of clients. What does happen is that everything traceable about the provider is recorded: the names and domains under which it has operated, the addresses it used to receive deposits, and whether any movement is visible on them. The extent to which you still have access to your own wallet is also stated in the report, because that determines which next steps are realistic.
See also: fake crypto platform and the blog recognising fake crypto platforms.
What can you do in the first hours after a transfer?
Record what you have and delete nothing, not even what seems unimportant in hindsight: the transaction hash, the receiving address, screenshots of the dashboard, the complete exchange of messages and the bank statements for the period concerned. Anyone who later wants a report drawn up will get further with that record than with a reconstruction from memory.
Speed matters: as long as funds are still held by a service provider, more is possible than afterwards. Reporting the matter to the exchange or bank involved and filing a criminal complaint with the Dutch police is the usual route, and that is exactly where a substantiated report helps: it makes concrete what happened, which transactions are involved and where the funds ended up. Paucitas supplies that substantiation and thinks along with you about the order in which to take those steps.
Further reading: the blog the first steps in tracing stolen crypto and the topic page tracing stolen crypto.
How is the route your money took reconstructed?
The reconstruction starts from the address or the transaction you supplied and follows the movements after it: splits across multiple addresses, conversions into a stablecoin, hops to another blockchain and consolidations at an address belonging to a service provider. Those steps are not summarised but recorded transaction by transaction.
Paucitas uses no automated analysis software, in any role. Every transaction and every transaction hash is verified individually before it is included in a report.
See also: chain reconstruction, peel chain, cross-chain and cash-out point.
What happens when the trail ends at an exchange?
A cash-out point is a service provider where crypto is converted into ordinary money or where a balance is held in someone’s name. Such parties are generally required to identify their customers. That does not mean a name becomes known: they do not release that data to an investigation firm, and rightly so.
What the report does is record which service provider the funds went to, at what moment and for what amount, so that your lawyer, the Dutch police or the Public Prosecution Service can request that information through the proper channels. Paucitas does not independently establish who is behind an address. The investigation takes the route up to that boundary, and states explicitly where the boundary lies.
Further reading: exchange, KYC and AML and the blog from address to exchange.
Why is a recovery scam the second risk?
Anyone who has lost money is often approached within days by someone offering to get it back, against payment in advance. That is a second suspicion on top of the first, and the pattern is by now well described: a success story, a deadline, and an amount that has to be transferred up front. Paucitas does not recover funds, promises no result and never works for a percentage of an amount recovered. What Paucitas does is investigate: establish what happened and record it in a traceable way.
How to recognise such an offer is described under the term recovery scam. The same applies to messages sent in the name of Paucitas; a separate warning about that is published on this site.
What can a report do for a criminal complaint or civil proceedings?
A report makes a complaint concrete. Instead of a statement that crypto has disappeared, it sets out which amounts went to which address at which moment, through which intermediate steps, and at which service provider the chain arrives. That shortens the work of whoever has to assess the complaint and makes the case assessable on documents rather than on a story.
In civil proceedings under Dutch law the report serves as the factual basis for the claim, and in a dispute about an earlier report it serves as counter-expertise. In both cases Paucitas confines itself to factual observations and the investigation of them.
See also: filing a criminal complaint, civil proceedings, evidential value and the topic expert report for court.
Which signals point to fraud rather than to a bad investment?
A loss on an investment is not fraud. The distinction lies in whether a balance ever existed and whether the figures presented have a counterpart on the blockchain. The following points recur in case files:
- a guaranteed return or a fixed monthly percentage, while the underlying market moves;
- pressure to deposit quickly or to top up, often with a closing deadline;
- a balance that exists only in the provider’s dashboard and cannot be pointed to as an address or a transaction;
- a payout that only becomes possible after tax, a fine or costs have first been paid;
- changing trading names behind the same domain, the same texts or the same receiving addresses;
- an adviser who is reachable only through a messaging app and avoids contact by telephone.
None of these points is conclusive on its own, and the conclusion that fraud has occurred is not for an investigation firm to draw. What the points do is determine where an investigation starts and which data should be requested first. The report therefore speaks of a suspicion and of a platform that turns out not to exist, not of perpetrators.
See also: honeypot token, price manipulation, pig butchering and romance scam.
What is in a fraud investigation report, and how long does it take?
A Paucitas report follows a fixed structure. Not every report contains every part, the scope varies with the case file, and the layout is tailored to the purpose of the report.
- Background and description of the assignment
- Questions to be answered
- Scope of the investigation
- Assumptions
- Data supplied
- Sources consulted
- Method in outline
- Verification and quality assurance
- Reservations and limitations
- Findings per element
- Chronological overview
- Analysis and coherence
- Conclusion
- Declaration of independence
- Appendices
Part fourteen, the declaration of independence, carries particular weight in a fraud case. Paucitas does not work on the instructions of an exchange, a software vendor or any party involved in the case, and has no interest in the outcome of the investigation. A lawyer, public prosecutor or judge wants to find that stated explicitly in the report, because it determines how much weight can be given to the findings.
Turnaround time. Depending on the size of the case file and the urgency, a Paucitas investigation takes between one working day and two weeks. An urgent report can be delivered within one working day and, in exceptional cases, the same day. A standard investigation is usually ready within three working days. For case files with many transactions, several wallets or missing history, the turnaround time rises to around two weeks. A surcharge applies to urgent assignments.
Costs. Paucitas works on a fixed fee based on your situation. Sometimes an hourly rate is agreed instead, but the hours are always fixed in advance, so you are never faced with surprises. No investigation is started before the costs have been discussed and agreed.
See also: crypto investigation report and the blog a blockchain report that holds up in court.
How does a fraud investigation proceed, step by step?
Data can be supplied digitally or at our office. For each case you receive a list setting out which data is needed. Where necessary, Paucitas guides you through collecting and supplying it.
- Intake. You describe what happened and which question you want answered. It is then established whether an investigation makes sense and which outcome is realistic.
- List of data required. You receive an overview of what is needed: transactions, addresses, exports, correspondence and bank statements.
- Establishing the starting point. Does the provider exist, and do you still have access to your wallet or account? That determines the scope.
- On-chain reconstruction. The transactions are followed step by step and recorded with hash, time and amount.
- Documentary investigation. Alongside the blockchain data, whatever is publicly traceable about the party or provider involved is recorded: registration details of the domain used, including the registration date and the registered particulars, entries in public commercial registers, earlier or parallel trading names behind the same domain, publications by regulators and publicly accessible case law. The documentation you supply yourself is assessed as well. Only publicly accessible sources and data you make available yourself are consulted.
- Verification. Findings are checked against a second source or a second method before they go into the report.
- Report. Delivery according to the fixed structure, with an explicit declaration of independence and a list of the limitations.
- Explanation and follow-up. Where the case calls for it, the report is explained to your lawyer, accountant, civil-law notary, the court or the authority handling the complaint. If new data becomes available later, the report can be supplemented. What is appropriate here depends on the type of investigation and the arrangements made.
Further reading: the blog how a blockchain transaction is investigated and manual investigation versus automated tools.
What role do the police, regulators and banks play?
You file the criminal complaint yourself; Paucitas does not do so on your behalf. What a report adds is that the complaint is substantiated with documents and that the chain is described in a traceable way. In cases where the trail ends at a service provider, that is the difference between a complaint that is left lying and a complaint that can be worked with.
Regulators maintain registers and warning lists. The fact that a provider is not in a register, or does appear on a warning list, can be recorded in the report as a fact, with source and date. It is an observation, not a legal conclusion. Where this matters for your situation, Paucitas can consult it on request and include it in the investigation. Paucitas is itself non-custodial, holds no funds and therefore does not fall under the licensing requirement for crypto-asset service providers.
See also: KYC and AML, money laundering and the blog what the authorities do not understand about crypto and investment fraud.
What can a fraud investigation not do?
This section is deliberately complete. What an investigation cannot do determines the value of what it can.
- Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party the funds went to, so that the information can be followed up through the proper channels.
- Paucitas holds no funds itself and carries out no transactions on behalf of clients. In every case it is first established whether the platform holding the funds exists and whether access credentials are available.
- The emphasis is on investigation and substantiation. The report states explicitly to what extent access to the wallet concerned still exists, because that determines what can factually be established.
- Paucitas makes no commitment about the outcome of an investigation.
- A Paucitas report confines itself to factual observations and the investigation of them.
- Transactions that took place off-chain, such as cash payments or internal bookings within an exchange, are not visible in blockchain data. They are only included where underlying documents are available.
- Where mixers or privacy-focused networks are used, the chain cannot always be followed in full. In that case the report states explicitly up to which point the route can be established.
- Paucitas gives no tax or legal advice.
Frequently asked questions
Can stolen crypto be recovered?
Paucitas makes no commitment about the outcome and never works for a percentage of an amount recovered. What the investigation does do is establish where the funds went and record that in a traceable way, up to the point where the route reaches a service provider. That is precisely the substantiation needed to be able to take a next step.
If it concerns a wallet you lawfully own and to which you have lost access, the question is a different one. It is then examined whether recovery is technically possible. Whether that succeeds depends on the data still available: a partial or complete recovery phrase, a file, a note or another starting point. If you are unsure whether what you still have is usable, do get in touch.
Is an investigation still worthwhile if it happened months ago?
Yes. A transaction on a public blockchain remains visible, even years later. What does change is the likelihood that funds are still held somewhere. Reconstructing the route is not bound by any time limit; the next steps are.
I only have a transaction hash. Is that enough to start?
Usually it is. One hash reveals the receiving address and with it the first step of the chain. More data makes the investigation more complete, but a single starting point is enough for an initial assessment.
Will it become clear who is behind the receiving address?
No. Paucitas does not independently establish who controls an address. What is recorded is which service provider the funds went to, so that the information can be requested through the proper channels.
Do I have to file a criminal complaint before having an investigation carried out?
That is not necessary, and it is not a condition. In practice it does help: a complaint substantiated with a report is more concrete for the person handling it than a complaint without documents.
What if the platform has disappeared and I can no longer log in?
It is then first established what can be traced about the provider and which addresses it used. Without access to your account part of the administration is gone, but the deposits you made yourself can still be followed.
How long does a fraud investigation take?
Between one working day and around two weeks, depending on the size of the case file and the urgency. A standard investigation is usually ready within three working days. A surcharge applies to urgent assignments.
How quickly does Paucitas respond to a question?
Paucitas usually responds within a few minutes to an hour, and in almost all cases the same working day.
Which pages belong to this topic?
Terms
- Crypto fraud — what the umbrella term covers and what it does not.
- Investment fraud — money paid in at the request of a supposed adviser.
- Boiler room — the sales method behind many case files.
- Pig butchering — building trust before the money goes in.
- Recovery scam — the offer to get money back against payment in advance.
- Fake crypto platform — a provider that turns out not to exist.
- Phishing — extracting access rather than money.
- Cash-out point — where the chain arrives at a service provider.
- Chain reconstruction — how the route is recorded step by step.
- The full glossary — every term in one overview.
Situations
- Tracing stolen crypto — for cases where funds were taken without your involvement.
- Wallet investigation after theft or a hack — for cases where the wallet itself is the starting point.
Related topics
- Blockchain investigation explained — the method behind this investigation.
- Expert report for court — when the case file goes to proceedings.
- Proving the origin of assets — when the question is not fraud but substantiation.
What can you do yourself right now?
Start by establishing what you still have: which transactions, over which period, per wallet, per exchange and per bank account. If an export or a period is missing, you know exactly where the investigation has to begin.
What you can supply
An investigation starts from a single starting point. That can be a transaction, an address, a photo or screenshot of a wallet, or the communication you had with a party. Even without a complete administration, more can usually be established than people expect.
What also helps, depending on your situation:
- statements and exports from the exchanges where you hold an account
- addresses of your own wallets
- bank statements for the period concerned
- correspondence, messages and screenshots
Which data your case file requires differs from case to case. After a first conversation you receive a list tailored to your situation.
Data can be supplied at our office or digitally by various methods.
Paucitas usually responds within a few minutes to an hour, and in almost all cases the same working day. Paucitas can be reached by telephone 24/7 on +31 20 244 5774.
About the author
S.E. (Simcha) Schrijver is director and co-founder of Paucitas. His work covers blockchain investigation, tracing crypto assets, fact-finding, investigating investment fraud and counter-expertise, and drawing up expert and appraisal reports for private individuals, companies, lawyers, courts and public authorities. Among other things, he taught a course accredited by the Netherlands Bar (NOvA) on cryptocurrency, blockchain and wallets for criminal defence lawyers and legal practitioners.
Paucitas is a specialist firm for cryptocurrency and blockchain. Investigation is our daily practice: hundreds of case files have been handled to date, ranging from individual matters to investigations for lawyers, public authorities and companies. Simcha Schrijver has appeared in proceedings on several occasions and has delivered reports that were used in court cases.