What do I as a lawyer have to supply so that a crypto investigation becomes usable in my case?

What has to be set out in the assignment for a crypto investigation?

Five elements belong in the wording of the assignment for a crypto investigation: the question, the scope, the starting points, the reference date and the form in which the report is delivered. Paucitas records those five in writing before the start, because together they determine what the report may later state as fact.

1. Question: formulate every question so that it can be answered with an established fact, for example whether an amount from address A arrived at party C on date B.
2. Scope: name the period and the addresses or accounts involved in the investigation, and name what stays outside it as well.
3. Starting points: state which data is taken as given, which sources are used and which assumptions apply.
4. Reference date: fix the date on which the position is determined, because balances and rates move.
5. Form: state whether the report has to serve as a document in proceedings, in which language it has to be and whether a statement of independence belongs with it.

The most common mistake in an assignment is a question that asks for a conclusion about persons instead of an established fact about entries. A question about who is behind an address produces no usable answer; a question about which provider the funds arrived at does.

On digital evidence in cross border civil cooperation the European Commission publishes; on the registration of crypto service providers ESMA publishes, which matters if you want to know which party your client is dealing with.

Which four documents does your client supply?

For an assignment for a crypto investigation your client supplies four documents: a complete address list, the transaction hashes of the payments that are the subject, the account details at the providers involved, and the documents that lie outside the blockchain. These are the four documents Paucitas has asked for as standard at intake since an earlier file.

• Address list: all wallets and accounts your client had or has control over, with the network per address, because the same address format exists on several networks.
• Transaction hashes: per payment the hash, the date, the time and the amount down to the smallest unit.
• Account details: registrations, confirmation emails, tickets and correspondence at the providers involved, including the dates on which those contacts took place.
• Documents outside the chain: agreements, invoices, bank entries and internal entries, because these are not visible in blockchain data.

Data is supplied digitally or at the office. Per case a delivery list is provided which states what data is needed. Where necessary Paucitas guides the collection and delivery of that data.

One point deserves separate attention in the communication with your client, because it regularly goes wrong as soon as someone thinks an investigator needs access to the wallet itself.

Paucitas never asks of its own accord for your recovery phrase or private key. If you need help reading out or restoring your wallet, we guide you through that completely, without us having to see that data ourselves.

How do you prevent the report from being unusable in the proceedings?

An assignment for a crypto investigation stays usable by arranging three things in advance: keeping the question testable, limiting the scope and including the verification of every entry explicitly in the assignment. A report is rarely contested on the outcome and often on the question whether the road towards it can be walked again.

Paucitas uses no automated analysis software, in any role whatsoever. The investigation is done manually on the basis of publicly accessible block explorers. Every transaction and every transaction hash is verified one by one before it is included in a report.

That manual character is an advantage in proceedings, because every step can be questioned separately and does not disappear into a model. Paucitas is an expertise firm for cryptocurrency and blockchain. Investigation is our daily practice: by now hundreds of files have been handled, ranging from individual cases to investigations for lawyers, authorities and companies.

For the background of the subject at the bar: Simcha Schrijver has given a course on cryptocurrency, blockchain and wallets for criminal defence lawyers, accredited by the Dutch Bar Association.

How a report on crypto is brought into legal proceedings is set out on the question page about a report on crypto for legal proceedings. What the cooperation means in practice is set out on the page for lawyers and insolvency practitioners.

What can an investigation not establish, and how do you write that into the assignment?

An investigation establishes the route and the end point of funds, not the identity behind an address, and that limitation belongs in the assignment rather than only in the report. Include the following points as starting points, so that the expectation of your client and the content of the report match each other.

• Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party funds went to, so that this information can be followed up through the channels intended for it.
• Paucitas makes no commitment about the outcome of an investigation.
• A report by Paucitas limits itself to factual observations and the investigation of those observations.
• Transactions outside the blockchain, such as cash payments or internal entries within an exchange, are not visible in blockchain data. They are only included if underlying documents are available.
• Where mixers or privacy oriented networks are used, the chain cannot always be followed in full. In that case it is stated explicitly up to which point the route can be established.
• Paucitas gives no tax or legal advice.
• The report states explicitly to what extent there is still access to the wallet concerned, because that determines what can in fact be established.

That is where the limit of this work lies: Paucitas reports what follows from the data and names up to which point the route can be established, but what an opposing party, a provider or a judge does with that finding falls outside the investigation.

What does it produce, how long does it take and what does it cost?

An assignment for a crypto investigation produces a report that can be used as a document in proceedings, with a statement of independence and with a chronological overview in which every entry can be checked separately. A report by Paucitas follows a fixed structure: occasion and description of the assignment, question, scope, starting points, data supplied, sources consulted, method in outline, verification and quality assurance, reservations and limitations, findings per element, chronological overview, analysis and coherence, conclusion, statement of independence and appendices. Not every report contains all elements.

An investigation by Paucitas takes, depending on the size of the file and the urgency, between one working day and two weeks. An urgent report can be delivered within one working day and in exceptional cases on the same day. A regular investigation is usually ready within three working days. In files with many transactions, several wallets or missing history the lead time rises to around two weeks. A surcharge applies to urgent assignments.

Paucitas works with a fixed price based on your situation. Sometimes we apply an hourly rate in consultation, but the hours are always fixed in advance, so that you never face surprises. No investigation is started before the costs have been discussed and agreed.

Paucitas usually responds within a few minutes to an hour and in almost all cases the same working day.

Which form of investigation belongs here you can read under expert report. More about the position of the investigator in proceedings is set out in the article about the independent expert in legal proceedings.

Send Paucitas the draft question and the documents you have now. In a short preliminary conversation it is named which of the four documents is still missing and how the question has to be put in order to get an answer you can use in your case.

Date of last revision: 9 September 2026.