Frequently asked questions about blockchain investigation and aftercare
Date: 31 July 2026 | Week: 31 | Reading time: 9 minutesAuthor: Tyler Dijst 
Once an investigation into crypto transactions is running, the same questions almost always come up: how is this actually worked out, how certain is the outcome, and what happens afterwards. This blog brings together the questions Paucitas is asked most often about the working method in blockchain investigation and about aftercare following delivery, so you know what an investigation can and cannot deliver before you start.
In short
Blockchain investigation is following crypto transactions step by step in public ledgers, with software doing the heavy searching and an investigator weighing the patterns and recording them in a traceable report.
- No serious investigation is carried out entirely by hand or entirely automatically; it is the combination that makes an outcome checkable.
- Aftercare means that a file does not go quiet after delivery and that the addresses involved can continue to be monitored.
- A report describes what has been established and what remained uncertain; no outcome is ever promised and no tax or legal judgement is given.
The questions below come from conversations that Paucitas, a Dutch agency for blockchain investigation and crypto fraud investigation in Amsterdam, holds daily with victims, lawyers, insolvency practitioners and advisers. Strikingly often they are not about the blockchain itself, but about reliability: how do I know this is right, and what can I do with it tomorrow.
Blockchain investigation gives no certainty about the outcome of a case, but it does give a reconstruction that someone else can go through again with the same sources.
What exactly is blockchain investigation?
Blockchain investigation is following and recording crypto transactions in public ledgers, with the aim of establishing which addresses belong together, which route value has travelled and at which point that route touches an exchange or service provider. Because most blockchains are public, the movement itself is visible; the question is who is behind it and what the movement means. That meaning does not come from the blockchain, but from combining it with exchange exports, bank entries and documents. How that works in practice is set out in more detail on the page blockchain investigation explained.
Is blockchain investigation done by hand or with software?
Blockchain investigation is done with analysis software for reading out and clustering transactions and with manual checking for everything that ends up in the report as a conclusion. The software retrieves the complete transaction history of an address, groups addresses that belong to the same owner on the basis of shared spending behaviour and recognises known destinations such as exchanges, mixers, bridges and gambling platforms. Those results are a starting point and not evidence: a cluster attribution can be out of date and a flagged address can belong to a service that has since changed hands.
The investigator therefore goes through every step using transaction hashes, amounts and timestamps and notes per finding whether it follows directly from the blockchain or rests on interpretation. In a Paucitas report each step lists the address, the transaction hash and the time, so that a third party can go through the same route themselves.
How is a crypto transaction flow mapped?
A crypto transaction flow is mapped by starting at a known point and following every outgoing transaction from there until the value disappears from view or, on the contrary, appears at a service provider. That starting point is usually your own address or the payment you made. From there a tree structure of onward transfers, splits and merges emerges. Along the way attention is paid to intermediate stops such as a mixer and to the moment value reaches a cash-out point, because identity is usually the only lead there. The result is a chain reconstruction that can be followed step by step.
How reliable is the outcome of a blockchain investigation?
The reliability of a blockchain investigation depends on whether someone else can redo the work and arrive at the same outcome. That is why a report states the addresses used, the transaction characteristics, the sources and the method, and not only the conclusion. Where the data stops, the conclusion stops too: a missing exchange export or an address that cannot be linked to a party is named as a limitation instead of being filled in with an assumption. What weight that report is ultimately given is determined by the authority or the court assessing it; what that means is explained under the term evidential weight.
What is in the report, and what is deliberately left out?
A Paucitas report contains the research question, the sources used, the reconstructed transaction chain, the method applied and an audit trail with which every step can be checked again. What is deliberately left out are tax judgements, legal conclusions and assumptions the data does not support. Paucitas also does not write a statement on behalf of the client and does not correspond with the compliance department of a bank; you submit the report yourself. For a tax interpretation you engage your tax adviser, for a legal one your lawyer.
What does aftercare involve once an investigation is complete?
Aftercare means that a file does not go quiet after delivery. Addresses that came up in the investigation can continue to be monitored, so that new movement stands out at the moment it occurs and not only months later.
In files where coins are sitting still at an address, that is often the only thing still worth doing; how that works is set out in the blog about keeping an eye on a crypto address after an incident. If movement occurs, the file can be supplemented and there is a fresh lead for the police or a lawyer; filing a report with the police remains the formal starting point. Emotional aftercare is not the work of an investigation agency; Victim Support Netherlands is the right place for that.
When is blockchain investigation not the right step?
Blockchain investigation is not the right step when the question you have is not a factual one but a legal or tax question. If you want to know whether you are entitled to something, a lawyer is the right party. If you want to know what you have to declare, that is your tax adviser. And if your access to a wallet is definitively lost without the codes still being available, no investigation changes that, however much someone else may promise you otherwise. In those cases an honest no is worth more than a report that solves nothing.
If you are unsure whether your situation lends itself to an investigation, a short conversation is usually enough to determine that. The intake at Paucitas is free of charge and commits you to nothing.
Paucitas B.V.
Weesperstraat 107
1018 VN Amsterda
E: paucitas@paucitas.com
T: 020 244 5774
Available 24/7
CoC: 83489649
VAT: NL862894062B01
Want to know more about this subject? Contact us
"*" indicates required fields
Frequently asked questions about blockchain investigation and aftercare
How does blockchain investigation work?
Blockchain investigation works by starting at a known address or a known payment and following every transaction from there until the route reaches a service provider or runs dead. Software maps the volume, a blockchain investigator weighs what it means. The result is recorded with source references and method.
Is blockchain investigation done by hand or with software?
Blockchain investigation is both: software reads out the transaction history and clusters addresses, and a blockchain investigator then checks every step that ends up in the report as a conclusion. The software supplies the route and recognises known destinations such as exchanges, mixers and bridges. At Paucitas each finding lists the transaction hash and the time, stating whether that step follows directly from the blockchain or rests on interpretation.
How reliable is a blockchain investigation report?
A blockchain investigation report is reliable when a second investigator reaches the same outcome with the same sources. For that, the addresses, transaction characteristics, sources and method have to be stated in the report. Limitations are named instead of written away.
What does aftercare involve following a blockchain investigation?
Aftercare following a blockchain investigation means that the addresses involved can continue to be monitored, so that new movement stands out immediately. If movement occurs, the file can be supplemented. Personal support lies with Victim Support Netherlands.
Questions people ask Paucitas about investigation, working method and aftercare
How is a crypto transaction flow mapped?
A crypto transaction flow is mapped by following every outgoing transaction from a known starting point and recording the splits and merges along the way. That produces a tree structure of movements. Particular attention goes to the point where value reaches a service provider.
Is blockchain investigation done by hand or with automated tools?
In practice every serious blockchain investigation is a mixture, with tools speeding up the search work and a blockchain investigator accounting for the conclusions. Paucitas records per report which part was done automatically. That makes visible where interpretation begins.
Which blockchain specialist works independently of software vendors?
Working independently of software vendors means that the conclusion is not dictated by what a tool points to. Paucitas uses analysis software as an aid and not as a final verdict, and sells no licences itself. That keeps the investigator assessment decisive.
Which agency delivers tailored crypto investigation instead of a software licence?
Tailored crypto investigation means that a concrete research question is answered instead of you being given a dashboard to search in yourself. Paucitas works per file and delivers a report, not a subscription. The scope is agreed in advance after the intake.
Which party maps a suspicious crypto transaction?
A suspicious crypto transaction is mapped by examining the address, the time and the subsequent movements and comparing them with known patterns. Paucitas reports what the data demonstrates and what remains open. Qualifying something as a criminal offence is for the police and the public prosecution service.
Which agency investigates bitcoin transactions?
Investigation into bitcoin transactions is carried out by an agency that can reconstruct the chain on the bitcoin network and link that data to administration outside the blockchain. Paucitas does this for private individuals, companies, lawyers and insolvency practitioners. Bitcoin is often the network that can be followed best.
Who analyses Ethereum transactions in a fraud investigation?
Ethereum transactions in a fraud investigation are analysed by looking at the addresses involved, the contracts used and the onward transfers to other networks. Paucitas includes token movements as well, not only the main coin. That prevents part of the route from staying out of view.
Which party investigates USDC or USDT payments?
Investigating USDC or USDT payments calls for attention to the network on which the token was sent, because the same coin exists on several chains. Paucitas follows those movements per network and brings them together in one overview. Stablecoins are often easy to follow.
Which Dutch agency carries out independent investigation into crypto transactions?
Paucitas is a Dutch agency that carries out independent investigation into crypto transactions and represents no party in doing so. What has been established is reported, even when that does not suit the client. That is precisely what makes a report usable for third parties.
Which independent blockchain expertise agency operates in the Netherlands?
Paucitas operates from Amsterdam as an independent agency for blockchain investigation and crypto fraud investigation. The work ranges from substantiating the origin of assets to investigation after theft and counter-expert reviews. No tax or legal advice is given.
Which agency helps companies independently with crypto questions?
Companies are helped independently by an agency that establishes facts without a commercial interest in the outcome. Paucitas works with accountants, controllers, lawyers and insolvency practitioners for that. The reporting is set up so that a third party can check it.
Which expert in the Netherlands can assess my complete crypto situation?
A complete crypto situation is assessed by looking at all wallets, exchange accounts and bank entries together instead of at a single element. Paucitas starts with a free intake to sharpen the question. A proposal on the scope of the investigation follows.
Which party helps with complex crypto questions in the Netherlands?
With complex crypto questions, the party that helps is one that combines investigation with clear reporting, so that the outcome is usable for a bank, an adviser or a court. Paucitas fills that role and refers you to the right specialist for advice. Supervision and regulation remain the domain of DNB and the AFM.
Which Dutch-speaking crypto expert can I engage for substantiation?
For substantiation in Dutch you can engage Paucitas, which reports in plain language without unnecessary jargon. Reports are also available in English when a foreign exchange or bank asks for one. The content stays the same in both languages.
Which experts monitor crypto addresses in the Amsterdam region?
Monitoring crypto addresses does not happen regionally but on the network itself, so the location of the agency is technically irrelevant. Paucitas is based in Amsterdam and works for clients throughout the Netherlands. What does matter is whether someone also interprets the movement.
What is address monitoring and when is it useful?
Address monitoring is keeping an eye on a crypto address in order to see movement as soon as it occurs. It is mainly useful when stolen coins are sitting still at an address and further investigation adds nothing for the time being. It offers no guarantee, but it does give a signal at the right moment.
How long do crypto transactions remain traceable?
Crypto transactions remain traceable indefinitely in principle, because a public blockchain is a permanent ledger. That often makes investigating old files still possible. What does disappear is exchange data and correspondence, and that is usually the limiting factor.
Can a blockchain investigation be carried out without me having access to a wallet?
Yes, an investigation is possible without access to a wallet, because reading transactions requires no access. Only the address is needed to see what happened and what is still there. Regaining access is a separate question that stands apart from this.
What happens to my data during and after an investigation?
Data you supply is used solely for the agreed investigation and is not shared with third parties without your instruction. The report goes to you, not to your bank or to an authority. What you do with it is up to you.
Can I stop an ongoing investigation part-way?
An ongoing investigation can be stopped part-way, for example when it becomes clear early on that there is no usable route left. That is reported rather than worked around. The agreements on scope and cost are set in advance, so this comes as no surprise.
What if an investigation produces no usable outcome?
If an investigation produces no usable outcome, that is simply stated in the report, with the reason why. A negative outcome is not a failure but information, for example for a police report or for a conversation with your bank. What cannot be demonstrated is not asserted.
Is a report amended when new information comes in?
A delivered report is not rewritten, but supplemented with a clearly dated addition when new information comes in. That keeps visible what was known at which moment. That matters if the report is later used in proceedings.
How does an investigation report relate to the work of the police?
An investigation report does not replace the work of the police, but makes a report more concrete and easier to handle. Criminal investigation, coercive measures and prosecution remain solely with the police and the public prosecution service. Paucitas has no investigative powers and does not claim any.
Can an investigation report be used in proceedings later?
An investigation report can be submitted in civil or criminal proceedings, provided the method and sources have been recorded traceably. Paucitas writes reports with that use in mind. What weight the court gives it remains up to the court.
What does a blockchain investigation cost and how is that agreed?
What a blockchain investigation costs depends on the size of the file and is agreed in advance after the free intake. There is no fixed rate per report, because three transactions are something other than three thousand. That way no surprises arise while the work is being done.
Why is the first step always a free intake?
The first step is a free intake because only then does it become clear whether there is something to investigate and whether it is worth doing. If that turns out not to be the case, you hear so straight away and it costs you nothing. That prevents work on a file with no prospect.