Crypto investigation questions, answered

Yes, on public blockchains such as Bitcoin and Ethereum every transaction is permanently recorded and can be followed from address to address. What the ledger does not record is who controlled an address, so tracing tells you where value went, and separate attribution work tells you who moved it.

Through evidence outside the blockchain: exchange know your customer records, bank rails funding a deposit, device and cloud artefacts such as wallet applications, seed phrase backups, browser history and screenshots, and open source material like forum posts or reused usernames. A sound attribution case usually rests on several of these together, not one.

Not always. Mixing services and cross-chain bridges weaken the link and raise the evidential burden, but timing analysis, amount matching, change address behaviour and exchange records on either side of the mix often re-establish it. Monero and similar privacy coins are far harder, and honest advice about the limits matters more than optimism.

The keys and the devices that hold them. Seed phrases, hardware wallets, password managers, phones and laptops should be forensically imaged and secured before anyone logs in or moves funds, and exchange accounts should be notified so balances are frozen rather than withdrawn. Once value has moved, options narrow quickly.

The English courts have granted freezing and proprietary injunctions over crypto assets, and have been willing to treat them as property. Relief is usually paired with disclosure orders against exchanges, including Norwich Pharmacal and Bankers Trust orders, and in some cases service by non-fungible token or alternative means where the defendant is unidentified.

Regulated exchanges normally respond to a properly framed court order, though foreign exchanges may require relief in their own jurisdiction or a letter of request. Speed matters: preservation requests should be issued as soon as an account is identified, because account data and balances change.

Blockchain records, wallet files, exchange statements and analytics outputs are documents for the purposes of CPR Part 31 and PD 57AD. They should be listed in the Disclosure Review Document alongside conventional data, preserved under the same legal hold, and produced in a form that shows how each item was obtained.

Rarely. Commercial analytics tools apply heuristics and third-party attribution labels that a court may test. A report should state the tool, version and date, explain the clustering assumptions relied on, show the underlying transaction data so the trace can be reproduced, and distinguish fact from inference.

An expert who can explain the technology and the tracing method in terms a judge can test, and whose report complies with CPR Part 35. Practical experience of wallet forensics, exchange records and analytics tooling matters as much as blockchain theory, because most cross-examination targets the attribution step.

Tracing rules developed for bank accounts are being applied to on-chain movements, so mixed funds, lowest intermediate balance arguments and questions of bona fide purchase all arise. The forensic work must set out the flows precisely so the legal tracing argument can be built on it.

An initial trace and a view on recoverability usually takes days rather than weeks once the addresses and any exchange references are supplied. Attribution, third-party disclosure and asset recovery run on the pace of the orders obtained, so early instruction is usually the difference between a live and a cold trail.

Any wallet addresses, transaction hashes, exchange account details and correspondence you hold, plus access to the devices of the people involved. If nothing is known beyond a bank transfer to an exchange, that is still a workable starting point.