Blockchain investigation is the practice of establishing, and recording in a traceable way, what has happened to digital assets, on the basis of data held on a public blockchain and the documents that go with it. It delivers no opinion and no legal conclusion, but a reconstruction an outsider can follow: which transactions, at which moment, between which addresses, and up to which point the route can be established. Paucitas carries out that work daily and records the outcome in a report used in Dutch civil and criminal proceedings.
On this page
- What is blockchain investigation?
- What can and cannot be seen on a public blockchain?
- How does a blockchain investigation proceed methodically?
- Why does Paucitas work without analysis software?
- How is a finding verified?
- What determines the evidential value of a blockchain report?
- When is a counter-expertise or second opinion called for?
- What makes a report usable in court?
- What does independence mean in a technical investigation?
- Which data is needed, and what if the wallet is inaccessible?
- What is in an investigation report, and how long does it take?
- How does an investigation proceed, step by step?
- In which situations is blockchain investigation used?
- What can blockchain investigation not do?
- Frequently asked questions
What is blockchain investigation?
A blockchain is a public ledger in which transactions are recorded in sequence and can no longer be altered. Blockchain investigation uses that ledger as its source: it follows the movements of digital assets between addresses and connects them to what is known outside the ledger, such as exchange exports, bank statements and correspondence. The outcome is a reconstruction with a reference to the underlying transaction at every step.
That is what sets it apart from a query in a tool. A tool shows that two addresses are connected; an investigation explains why that connection is relevant, which assumptions sit beneath it and where the certainty stops. For a judge or a tax inspector, that last question is often more important than the first.
Further reading: blockchain, blockchain analysis and on-chain.
What can and cannot be seen on a public blockchain?
Visible are: the sending and receiving address, the amount, the time, the token used and the transaction hash by which anyone can check the transaction. The full history of an address is visible too, including transactions from years back. That data does not disappear and cannot be altered after the fact.
Not visible is who controls an address. An address is a string of characters without a name. Also not visible are bookings that take place within an exchange’s own administration, and payments made off-chain, such as cash transfers. That does not mean those steps stay unknown: they can only be established with the documents of the parties involved alongside.
See also: transaction hash, wallet and exchange.
How does a blockchain investigation proceed methodically?
An investigation starts from a fixed point: a transaction, an address or an export whose provenance is certain. From there the work runs in both directions. Forwards to see where the assets went, backwards to see where they came from. Every step is recorded separately, so that later it can be checked, step by step, how the conclusion was built up.
Along the way, patterns appear that prove nothing in themselves but do determine the direction: an amount split across many addresses, conversion into a stablecoin to remove price movement, a hop to another blockchain, or consolidation at an address belonging to a service provider. The report states such patterns as observations, not as inferences.
Further reading: chain reconstruction, peel chain, cross-chain and mixer.
Why does Paucitas work without analysis software?
Paucitas uses no automated analysis software, in any role. Every transaction and every transaction hash is verified individually before it is included in a report.
That is a deliberate choice. A flag in analysis software is an assumption made by the vendor, and in proceedings that assumption cannot be tested if nobody can explain it. Our findings can be: they rest on publicly accessible sources and can therefore be checked and confirmed by anyone, without access to our working environment and without a software licence.
See also the blog manual blockchain investigation versus automated tools.
How is a finding verified?
Verification means that a finding is established a second way before it goes into the report. A transaction is checked in more than one source, a time is placed alongside the client’s own records, and an amount is traced back to the original unit rather than to a converted value.
The report contains a separate part for this, verification and quality assurance, setting out which checks were carried out. Alongside it is a part on reservations and limitations, setting out what was not checked and why. Together those two parts determine how much weight a reader can give to the findings.
See also: evidential value and crypto investigation report.
What determines the evidential value of a blockchain report?
Evidential value does not come from the conclusion but from traceability. A report that gives the transaction hash at every step can be checked by the opposing party. A report containing only a final figure and a screenshot cannot, and in proceedings it loses its value for that reason.
Three things weigh heavily here: whether the investigator is independent of the parties, whether the data used can be traced back to a source the reader can consult, and whether the report states explicitly where the certainty stops. A report that is open on all three points holds up better than a report that sounds stronger.
Further reading: the blog a blockchain report that holds up in court.
When is a counter-expertise or second opinion called for?
Where a report already exists and its findings are disputed, a counter-expertise is the appropriate route. It does not aim to formulate an opposing conclusion, but to answer whether the existing report supports its own conclusion: are the steps traceable, are the assumptions stated, and does the conclusion follow from the facts established?
A second opinion is lighter in scope and is more often requested before proceedings begin, to determine whether a case file is strong enough. Both forms are set out on the underlying page counter-expertise and second opinion.
See also: counter-expertise, second opinion and the blog counter-expertise in a crypto dispute.
What makes a report usable in court?
A court does not ask for a technical write-up but for a document that reads on its own: what was the question, which data was available, how was the work done, what was established, and what could not be established. The technical detail belongs in the appendices; the readable line comes first.
Part of that is that the investigator is willing and able to explain the findings orally, and answers a question about the limitations of the investigation directly. How that works in practice is set out on the underlying page expert report for court.
See also: expert report, expert witness and the blog what a crypto expert does in a court case.
What does independence mean in a technical investigation?
Independence means something concrete here: no instructions from an exchange, a software vendor or a platform, no fee that depends on the outcome, and no interest in the conclusion. Paucitas never works for a percentage of an amount recovered, because that creates exactly the interest that makes a report worthless.
The report therefore contains a separate part in which that position is recorded. That part is not a formality: for a bank, a tax inspector or a judge it is the first thing checked. Paucitas is also non-custodial, holds no client funds and carries out no transactions on their behalf, and therefore does not fall under the licensing requirement for crypto-asset service providers.
See also: independent expert and the blog acting as an independent expert.
Which data is needed, and what if the wallet is inaccessible?
Usable are: addresses and transaction hashes, exports from the wallet software or from the exchange, bank statements for the period concerned, and the correspondence showing what was agreed. The more complete that package, the fewer assumptions are needed. Paucitas never asks of its own accord for your recovery phrase or private key. If you need help reading out or restoring your wallet, we will guide you through it completely, without needing to see that data ourselves.
If the wallet is no longer accessible, that changes the scope but not the possibility. What was sent from that wallet and what was received remains visible on the blockchain. The report states expressly to what extent access still exists, because that determines which next steps are realistic.
Further reading: private key, seed phrase and hardware wallet.
What is in an investigation report, and how long does it take?
A Paucitas report follows a fixed structure. Not every report contains every part, the scope varies with the case file, and the layout is tailored to the purpose of the report.
- Background and description of the assignment
- Questions to be answered
- Scope of the investigation
- Assumptions
- Data supplied
- Sources consulted
- Method in outline
- Verification and quality assurance
- Reservations and limitations
- Findings per element
- Chronological overview
- Analysis and coherence
- Conclusion
- Declaration of independence
- Appendices
Part fourteen, the declaration of independence, is the part a report is tested against first in proceedings. Paucitas does not work on the instructions of an exchange, a software vendor or a platform, and has no interest in the outcome of the investigation. Part seven, the method in outline, is deliberately kept in outline: the method followed is accounted for without the report becoming a manual.
Turnaround time. Depending on the size of the case file and the urgency, a Paucitas investigation takes between one working day and two weeks. An urgent report can be delivered within one working day and, in exceptional cases, the same day. A standard investigation is usually ready within three working days. For case files with many transactions, several wallets or missing history, the turnaround time rises to around two weeks. A surcharge applies to urgent assignments.
Costs. Paucitas works on a fixed fee based on your situation. Sometimes an hourly rate is agreed instead, but the hours are always fixed in advance, so you are never faced with surprises. No investigation is started before the costs have been discussed and agreed.
How does an investigation proceed, step by step?
Data can be supplied digitally or at our office. For each case you receive a list setting out which data is needed. Where necessary, Paucitas guides you through collecting and supplying it.
- Intake. The question is sharpened and it is established which outcome is realistic.
- List of data required. You receive an overview of the data needed for your situation.
- Scope. It is determined which addresses, which period and which blockchains fall within the investigation, and which do not.
- Reconstruction. The transactions are followed step by step and recorded with hash, time and amount.
- Reconciliation with the documents. On-chain data is placed alongside exports, statements and correspondence.
- Verification. Findings are checked against a second source or method before they go into the report.
- Report. Delivery according to the fixed structure, with the limitations stated explicitly.
- Explanation and follow-up. Where the case calls for it, the report is explained to your lawyer, accountant, civil-law notary, the court or the authority handling the matter. If new data becomes available later, the report can be supplemented. What is appropriate here depends on the type of investigation and the arrangements made.
Further reading: the blog how a blockchain transaction is investigated and frequently asked questions about blockchain investigation and aftercare.
In which situations is blockchain investigation used?
The method is the same; the question differs. Where fraud is suspected, it is about the route the money took. Where a substantiation is needed for a bank or the tax authority, it is about the origin of a holding. In a division of assets or an insolvency, it is about which assets existed on a reference date. In a dispute about an existing report, it is about whether that report holds up.
Each of those four entry points has its own page, because the data needed and the party who ultimately reads the report differ per situation. What stays the same is the requirement that every step is traceable.
See also: crypto fraud investigation, proving the origin of assets and crypto in divorce and legal matters.
What can blockchain investigation not do?
This section is deliberately complete. What an investigation cannot do determines the value of what it can.
- Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party the funds went to, so that the information can be followed up through the proper channels.
- Paucitas holds no funds itself and carries out no transactions on behalf of clients. In every case it is first established whether the platform holding the funds exists and whether access credentials are available.
- The emphasis is on investigation and substantiation. The report states explicitly to what extent access to the wallet concerned still exists, because that determines what can factually be established.
- Paucitas makes no commitment about the outcome of an investigation.
- A Paucitas report confines itself to factual observations and the investigation of them.
- Transactions that took place off-chain, such as cash payments or internal bookings within an exchange, are not visible in blockchain data. They are only included where underlying documents are available.
- Where mixers or privacy-focused networks are used, the chain cannot always be followed in full. In that case the report states explicitly up to which point the route can be established.
- Paucitas gives no tax or legal advice.
Frequently asked questions
Can every crypto trail be followed?
No. On a public blockchain the chain can in principle be followed, but where mixers or privacy-focused networks are used the certainty stops at a certain point. The report then states explicitly up to where the route can be established.
Does blockchain investigation reveal who the perpetrator is?
No. Paucitas does not independently establish who controls an address. What is recorded is which service provider the funds went to, so that the information can be requested through the proper channels.
Does Paucitas need my private key or seed phrase?
Paucitas never asks of its own accord for your recovery phrase or private key. If you need help reading out or restoring your wallet, we will guide you through it completely, without needing to see that data ourselves. For the investigation, addresses, transactions and exports are sufficient. Paucitas holds no funds and carries out no transactions on behalf of clients.
What is the difference between blockchain analysis and blockchain investigation?
Analysis is the ordering of transaction data; in the market that is usually done with analysis software. Investigation adds accountability to it: which source, which assumption, which check and which limitation. Paucitas works without that software; every transaction is verified individually. Only the second is usable in proceedings.
Does Paucitas work with software from a vendor?
No. Paucitas uses no automated analysis software, in any role. Every transaction and every transaction hash is verified individually before a finding is included in a report. A vendor’s flag is an assumption, not a determination.
Can an old case file still be investigated?
Yes. Transactions remain visible, even years later. What changes is the likelihood that funds are still held somewhere and that a service provider still holds data.
How long does a blockchain investigation take?
Between one working day and around two weeks, depending on the size of the case file and the urgency. A standard investigation is usually ready within three working days. A surcharge applies to urgent assignments.
How quickly does Paucitas respond to a question?
Paucitas usually responds within a few minutes to an hour, and in almost all cases the same working day.
Which pages belong to this topic?
Terms
- Blockchain — the ledger the investigation is based on.
- Blockchain analysis — the ordering of transaction data.
- On-chain — what is and is not in the ledger.
- Chain reconstruction — recording the route step by step.
- Mixer — where certainty in the chain decreases.
- Evidential value — why traceability weighs more heavily than the conclusion.
- Independent expert — what independence means in practice.
- Expert witness — the role at a hearing.
- The full glossary — including the transaction hash and the crypto investigation report.
Underlying topics
- Counter-expertise and second opinion — where a report already exists and is disputed.
- Expert report for court — where the case file goes to a hearing.
Related topics
- Crypto fraud investigation — where fraud is suspected.
- Proving the origin of assets — for a substantiation to a bank, the tax authority or an accountant.
- Crypto in divorce and legal matters — in a division of assets or an estate.
What can you do yourself right now?
Start by establishing what you still have: which addresses, which exports, over which period and per exchange. If an export or a period is missing, you know exactly where the investigation has to begin and which assumptions would otherwise be needed.
What you can supply
An investigation starts from a single starting point. That can be a transaction, an address, a photo or screenshot of a wallet, or the communication you had with a party. Even without a complete administration, more can usually be established than people expect.
What also helps, depending on your situation:
- statements and exports from the exchanges where you hold an account
- addresses of your own wallets
- bank statements for the period concerned
- correspondence, messages and screenshots
Which data your case file requires differs from case to case. After a first conversation you receive a list tailored to your situation.
Data can be supplied at our office or digitally by various methods.
Paucitas usually responds within a few minutes to an hour, and in almost all cases the same working day. Paucitas can be reached by telephone 24/7 on +31 20 244 5774.
About the author
R.T. (Tyler) Dijst is director and co-founder of Paucitas and runs the operation. He safeguards the quality and consistency of case handling and is involved in the expert stage of complex matters. His work focuses on complex blockchain investigation: tracing intricate transaction flows, analysing wallets and mapping how funds are routed across the chain. He also assesses the authenticity of physical crypto coins and identifies counterfeit or imitation specimens.
Paucitas is a specialist firm for cryptocurrency and blockchain. Investigation is our daily practice: hundreds of case files have been handled to date, ranging from individual matters to investigations for lawyers, public authorities and companies.