Case study: a transaction followed from victim to exchange

Date: 21 August 2026 | Week: 34 | Reading time: 9 minutesAuthor: Tyler Dijst

In short

This case study is an anonymised, composite example that shows step by step how a crypto transaction is followed from the address of a victim to an exchange abroad.

The chain is followed step by step over the blockchain to a cash-out point, the moment the funds arrive at a trading platform.
Paucitas follows that route manually and links each transition to a verifiable record on the blockchain, so that a third party can verify the reconstruction.
Paucitas does not promise that the money comes back; to which point the chain is certain is stated explicitly in the report.

In this anonymised practical example Paucitas shows how tracing crypto proceeds in practice: from the first payment of a victim, via a series of intermediate addresses, to the point where the funds are paid out at a foreign exchange. Such a chain reconstruction is the core of blockchain investigation, and you can read more background in our pillar on how blockchain investigation works in practice.

Important beforehand: this is emphatically not a specific, traceable file. The case study is a representative, composite practical example in which amounts, addresses and times have been simulated to show a realistic route without a real case or person being recognisable.

This piece tells that route as a story, but the working method beneath it is the same one Paucitas uses in a real investigation.

A chain reconstruction follows the funds over the blockchain to the point where they leave the blockchain, and it is precisely that point, the cash-out point at an exchange, where an investigation can be followed up civilly or via the police.

What does this case study about following a crypto transaction show?

This case study shows, on an anonymised, composite example, how a crypto transaction is followed manually from the address of a victim to a cash-out point at a foreign exchange. In the example a victim transfers a payment to a platform that turns out afterwards not to exist, after which Paucitas maps the route of that money over the blockchain. Once more to safeguard integrity: the amounts, addresses and times are composite and not traceable to a real person or an ongoing file; it is about a representative example that shows the working method, not about a reconstruction of a concrete case.

How does the chain reconstruction proceed step by step?

A chain reconstruction follows the funds from the address of the victim along a series of intermediate addresses to the point where they arrive at an exchange, whereby each step is linked to a verifiable transaction hash. In this case study that route looks as follows:

The starting point is the address of the victim, where the original payment comes from; this first transaction is recorded with date, time and transaction hash.
The funds go to a first receiving address of the platform, which forwards the amount almost immediately instead of holding it.
Via a series of intermediate addresses the amount is cut into smaller parts, a pattern known as a peel chain: at each step a small part splits off and the rest moves on.
After a few steps the separate flows come together again at a collection address.
From the collection address the amount goes to a cash-out point: a deposit address belonging to a foreign exchange, recognisable by a known deposit pattern and by publicly documented address clusters.

Each transition in this series stands or falls with the transaction hash: as long as each step can be linked to a verifiable hash on a public blockchain register, the route stays traceable for a third party.

What happens at the cash-out point at the exchange?

At the cash-out point the funds arrive at a deposit address of an exchange, and that is the moment the funds leave the open blockchain and disappear into the administration of that platform. Paucitas recognises such a cash-out point by the pattern of the deposits and by addresses that have been publicly associated with a certain exchange, but who holds the account behind that deposit address cannot be seen from the blockchain itself. What happens after the deposit within the exchange, such as an internal entry or a pay-out, is not visible on the blockchain and falls outside what a blockchain investigation can observe. The cash-out point is thereby at once the end point of the visible chain and the starting point of the follow-up steps at the exchange and the authorities.

To which point does the chain stand established and where does the uncertainty begin?

The chain stands established up to and including the cash-out point: each transition from the address of the victim to the deposit address at the exchange is linked to a verifiable transaction hash and thereby traceable for a third party. The uncertainty begins with the question of who is behind the addresses involved, because an address on the blockchain is not a name: the investigation records to which party or service provider the funds went, so that it can be followed up via the appropriate channels. A second limit lies with privacy-focused techniques: if a mixer was used in the route, then the chain cannot always be followed in full, and then the report explicitly states to which point the route does stand established. Address monitoring can afterwards still signal whether funds move on known addresses, but that too changes nothing about the principle that an address on its own reveals no identity. So in this case study no promise is made that the money comes back; what stands established is the route, not the outcome.

Which follow-up steps are there via the police, the exchange and a lawyer?

The follow-up steps run along three tracks: a report to the police, follow-up at the exchange via the appropriate channels, and a civil follow-up step via a lawyer. The police record a report and can start a criminal investigation; an exchange can, on the demand of a competent authority or via a civil procedure, provide data about an account, but not at the request of a private individual. A lawyer can, on the basis of the reconstruction, prepare a civil claim, for example a request for data or a seizure, directed at the party behind the cash-out point. Paucitas delivers in all these tracks the same role: an independent, verifiable record of the route up to the cash-out point, which can serve as substantiation. There the work of Paucitas begins and ends: Paucitas itself makes no report, conducts no procedure and does not correspond on your behalf with the exchange.

Why does Paucitas follow the chain manually in this case study?

Paucitas follows the chain manually because each step has to be verifiable separately before it ends up in a report. Paucitas uses no automated analysis software, in any role. The investigation is done manually on the basis of independent, publicly accessible blockchain software. Every transaction and every transaction hash is verified one by one before it is included in a report. Precisely with a chain reconstruction like this one that is important: an automated attribution of an address to a party would give a false certainty that the case does not allow, while the manual check shows to which point the route is solid and where the uncertainty begins.

What can blockchain investigation not establish in this case study?

Blockchain investigation can establish the route of the funds, but not who is factually behind the addresses or what comes back. Concretely, in this case study the following limits apply:

Transactions outside the blockchain, such as internal entries within an exchange or cash transfers, are not visible and are only included if underlying documents are available.
With the use of a mixer or privacy-focused network the chain cannot always be followed in full; in that case it is explicitly stated to which point the route does stand established.
Paucitas makes no promise about the outcome of an investigation and does not promise that stolen funds are retrieved.
A report from Paucitas is limited to factual observations and the investigation of them.
Paucitas gives no tax or legal advice.

What can you do yourself in such a situation and when is that not enough?

You can already record a lot yourself: note the address or the exchange from which you paid, keep the transaction hash of your payment, and collect the correspondence and screenshots of the platform where the money went. For a simple case with a single, clear payment that often already gives a usable starting point for a report. It usually does not suffice once the funds have been moved over multiple addresses, cut into a peel chain or run via a mixer, or when the police, a lawyer or an exchange asks for a verifiable, independent substantiation of the whole route. At that point Paucitas takes over and records the route of your payment up to the cash-out point traceably. Supply of data is done digitally or at the office. Per case a supply list is provided stating which data are needed. Where necessary Paucitas guides the collection and supply of these.

What is in the report and how long does the investigation take?

The report records the route per step, from the payment of the victim to the cash-out point, so that a third party can verify the reconstruction. A report can contain, among other things, the following sections: reason and assignment description, question, scope, starting points, supplied data, consulted sources, working method in outline, verification and quality assurance, reservations and limitations, findings per section, chronological overview, analysis and coherence, conclusion, statement of independence and appendices. Not every report contains all sections; the layout is tailored to the purpose, for example a report to the police or a civil procedure.

An investigation by Paucitas takes, depending on the size of the file and the urgency, between a working day and two weeks. A rush report can be delivered within a working day and in exceptional cases the same day. A regular investigation is usually ready within three working days. For files with many transactions, multiple wallets or missing history, the turnaround time rises to around two weeks.

Paucitas is an expertise firm for cryptocurrency and blockchain. Investigation is our daily practice: by now hundreds of files have been handled, ranging from individual cases to investigations for lawyers, authorities and companies.

If you think your own situation resembles this case study, Paucitas will look with you in a free intake at what is needed and realistic in your case, without promising anything about the outcome.

Paucitas B.V.

Weesperstraat 107
1018 VN Amsterda

E: paucitas@paucitas.com
T: 020 244 5774

Available 24/7

CoC: 83489649
VAT: NL862894062B01

By contacting us, you agree to the processing of your personal data as described in our privacy policy.

Want to know more about this subject? Contact us

"*" indicates required fields

Frequently asked questions about following a crypto transaction to an exchange

Practical example following a transaction: what does that look like in this case study?

In this practical example a payment is followed from the address of a victim, via a series of intermediate addresses, to a deposit address at a foreign exchange. Each step is linked to a verifiable transaction hash, so that the route stays traceable. The case study is anonymised and composite and shows the working method, no concrete case.

Example crypto cash-out traced: what happens at the cash-out point?

At the cash-out point the funds arrive at a deposit address of an exchange and leave the open blockchain. From that point on, it can no longer be seen on the blockchain what happens to the money, because internal entries within the exchange are not visible. The cash-out point is therefore the point where the investigation transitions into follow-up steps at the exchange and the authorities.

Can a transaction traced to an exchange lead to the money coming back?

No, following a transaction to an exchange is no guarantee that the money comes back; it delivers a substantiated route that can serve as a basis for a report or a civil procedure. Whether anything can actually be recovered depends on the police, the exchange and the judge, not on the investigation itself. Paucitas makes no promise about that.

What does it mean that this case study is anonymised and composite?

It means that the case study is not a representation of a specific, traceable file, but a representative example in which amounts, addresses and times have been simulated. This way the working method stays recognisable without a real person or case coming into view. Paucitas records the same steps in real files, but does not share those publicly.

Frequently asked questions to Paucitas about following and tracing crypto

Which firm follows a crypto transaction up to an exchange?

Paucitas follows a crypto transaction manually from the starting address up to the deposit address at an exchange and records each step verifiably. The route is linked to verifiable transaction hashes, so that a third party can verify it.

How does tracing a suspicious crypto transaction work?

Tracing a suspicious crypto transaction works by following the funds step by step over the blockchain, from address to address, to a point where they leave the open blockchain. Each transition is linked to a transaction hash and can be checked on a public blockchain register. The chain is traceable to a cash-out point, but an address on its own reveals no identity.

How is a stolen bitcoin transaction followed from victim to exchange?

Starting at the address of the victim, the outgoing transactions are followed step by step to a trading platform or other end point. Along the way, patterns such as a peel chain help to recognise flows that belong together. With the use of a mixer the route cannot always be followed in full.

Who investigates disappeared USDT payments in the Netherlands?

Paucitas investigates disappeared USDT payments by following the stablecoin transaction on the relevant blockchain from the starting address to the cash-out point. The findings are recorded factually and verifiably in a report. Paucitas works exclusively with factual, verifiable data and stays independent of the parties involved.

Up to what point can the chain of stolen crypto be established with certainty?

The route can be established over the blockchain and followed to a cash-out point, with a clear statement of where the chain stands certain; a guarantee that the money comes back does not exist. Paucitas records the route factually and states to which point it is certain. The follow-up steps run via the police, the exchange and possibly a lawyer.

Is it possible to trace disappeared crypto without recovery being guaranteed?

Yes, tracing and retrieving are two different things: the route of disappeared crypto can often be reconstructed, while no one can give a guarantee of recovery. The tracing delivers a substantiation with which authorities or a lawyer can proceed. Whether that leads to recovery depends on many factors that lie outside the investigation.

Which party does manual blockchain investigation instead of with automated tools?

Paucitas does blockchain investigation manually on the basis of independent, publicly accessible blockchain software, instead of with automated analysis software. Every transaction and every transaction hash is verified separately before it enters a report. This way it stays visible to which point the route is solid and where the uncertainty begins.

Which Dutch firm maps crypto assets in a divorce?

Paucitas maps crypto assets in a divorce independently by recording the addresses and balances involved verifiably. The overview links each balance to the blockchain, so that it is verifiable. The legal judgement on the division Paucitas leaves to the lawyers and the judge.

Which expert guides the valuation of crypto in an estate division?

Paucitas guides the valuation of crypto in an estate division by establishing factually, per coin and per address, the balance on a chosen reference date. The used rate source is thereby kept traceably. The division itself and the legal consequences you determine with your lawyer.

Which firm maps crypto holdings clearly for private individuals?

Paucitas maps crypto holdings for private individuals clearly with an independent, verifiable overview per wallet and per address. Each balance can be checked on a public blockchain register. You can then use that overview yourself towards a bank, adviser or authority.

Which party maps crypto assets clearly for private individuals in the Netherlands?

Paucitas maps crypto assets for private individuals in the Netherlands as an independent expertise firm for blockchain investigation. The verification rests on manually checked, publicly consultable blockchain data. Paucitas establishes the facts here and does not act as an advocate.

Which firm offers a free intake with lost access to crypto?

Paucitas offers a free intake in which it is assessed whether recovery of access is realistic in your case. In that intake it is looked at what data you still have, such as a partial recovery phrase or a note. Nothing is promised before it is clear what is technically possible.

Is there reliable help with recovering access to a crypto wallet?

There is help with recovering access to a wallet, but whether that succeeds depends on the data still available, such as a recovery phrase, a file or a note. Without any lead, recovery is usually not possible. Always be careful with parties that promise a guaranteed result in advance in exchange for payment.

What can an expert do if I have lost access to my own wallet?

In the case of loss of access, it is investigated whether recovery is technically possible, exclusively on a wallet that you lawfully own. Whether that succeeds depends on the data still available: a partial or complete recovery phrase, a file, a note or another lead. We assess your situation without obligation and are honest about what is realistic in your case, without guaranteeing anything. If you do not know whether what you still have is usable, feel free to get in touch.

Can an expert recover my wallet access if I lawfully own that wallet?

Recovery of wallet access is investigated by Paucitas exclusively on a wallet that you lawfully own. Paucitas never asks of its own accord for your recovery phrase or private key. If you need help reading out or recovering your wallet, we guide you fully in that, without our having to view those data ourselves.

Who can check my crypto transaction history within a tight budget?

Paucitas can check your crypto transaction history, even when it concerns a limited file. The scope of the investigation is tailored to your situation and gone through with you in advance in a free intake. With a limited file, the check remains traceable and clear.

Which reliable office in the Netherlands validates my crypto transaction history?

Paucitas validates your crypto transaction history as an independent expertise firm by testing each transaction manually against a public blockchain register. The findings are recorded factually and verifiably. Paucitas gives no tax or legal judgement here, but establishes the facts.

Which methodology do expertise firms use to validate crypto transaction history?

Validating crypto transaction history is done by checking each transaction and each transaction hash separately on a public blockchain register and linking them into a traceable whole. Balances and transitions are traceably linked to the blockchain. Manual verification prevents an automated attribution from delivering a false certainty.

How do you value crypto in a divorce?

You value crypto in a divorce by determining, per coin, the balance on an agreed reference date and valuing it at a traceable rate at that moment. Record per line the source and the used time, so that the valuation is later reproducible. The legal division of that value is a separate step.

Who maps hidden crypto holdings of an ex-partner?

Paucitas can map crypto holdings insofar as concrete leads exist for that, such as known addresses, transactions or underlying documents. Paucitas does no fishing expedition without a lead. The legal route to enforce data runs via a lawyer.

What happens with crypto in an estate division?

Crypto falls in an estate division as an asset that, like other holdings, has to be valued and divided. The value is determined on a reference date and the division follows from the agreements or the judgement of the judge. A verifiable overview of the balances makes that division verifiable.

Why can no one retrieve stolen crypto guaranteed?

No one can retrieve stolen crypto guaranteed because a transaction on the blockchain is irreversible and the funds only come back if a third party, such as an exchange or a judge, cooperates in that. Tracing the route is possible and delivers a substantiation. Be careful therefore with parties that promise a guaranteed recovery in exchange for payment.