Asset-Tracing Methodologies for Commingled Funds (PIFO, LIBR, LIFO, FIFO, Pari Passu, Rolling Charge)

framework

Core idea

Once stolen funds land in a wallet that also holds clean funds, the chain no longer tells you which outbound transfer is “the” illicit money. That answer comes from a tracing convention you choose and then defend, not from the ledger. Six conventions plus one deviation rule are in common use. None of them is novel: they come out of forensic accounting and equity’s treatment of mixed bank accounts, developed over two centuries of common-law litigation, and what is new is the growing body of case law applying them to cryptoassets. The methodology is forensic; how a court treats the result is a matter of law. Most analysts can produce a rigorous analysis under any of these models. Only the instructing lawyer can say which is legally defensible in the venue where the matter will be decided.

Components

Proceeds-In-First-Out (PIFO). Everything in the wallet before the illicit deposit is treated as legitimately the owner’s. From the moment the illicit funds arrive, every outbound transfer is ascribed to them until the full illicit amount has left, regardless of clean deposits arriving in the meantime. Rationale: a launderer wants dirty funds into the layering stage fast. This is the most efficient convention for following proceeds across many hops, and the source’s default.
Lowest Intermediate Balance Rule (LIBR). Assumes the holder has no legal authority to pass title to illicit assets. So long as the wallet balance never drops below the illicit deposit amount, the illicit funds are treated as still sitting in the original wallet no matter how much moved in and out. Useful for pinning value in place rather than chasing it, which suits a claim over a cold wallet. Derived from James Roscoe (Bolton) Ltd v Winder [1915]. Note the refinement: in litigation practice LIBR operates less as a primary tracing method than as a universal cap. A claimant’s traceable proprietary claim cannot exceed the lowest balance the mixed account reached between the misappropriation and the claim, and that ceiling applies alongside whichever primary convention you selected. It matters most where funds passed through a high-volume exchange wallet, since the intermediate low can be far below the deposit.
Last-In-First-Out (LIFO). The most recent deposits leave first, like dealing off the top of the deck. Borrowed from inventory accounting; it gets unwieldy in wallets with heavy two-way traffic. It has no principled doctrinal foundation in equity as a tracing rule, and surfaces instead as an inference of fact, for instance where misappropriated funds are followed almost immediately by an identifiable onward transfer. US federal practice diverges sharply here. LIFO is the working convention in DOJ crypto forfeiture matters, where it is defined operatively rather than doctrinally: “the first output back-traced was funded by the last input up to the amount of the original transaction.” It was applied at scale across a network of 144 exchange accounts and hundreds of thousands of transactions in United States v. Approximately 225,364,961 USDT (D.D.C. 25-cv-1907). Note the failure mode that matter records explicitly: a consolidation address pooling funds from many sources redirects the LIFO order, so the convention stops selecting the outflow you would expect once the path crosses a hub. Say so in the report rather than letting the arithmetic quietly change meaning. See Consolidation Addresses and Tiered Intermediary Groups.
First-In-First-Out (FIFO). The opposite: the earliest funds in must be fully accounted for as leaving before you reach the illicit deposit, like dealing off the bottom of the deck. Also awkward on busy crypto wallets. Rooted in the rule in Clayton’s Case (1816) in the UK.
Pari passu. Distributes the disputed proportion pro rata across all withdrawals, so each contributor bears a proportionate share of every outflow. This is the modern default in multi-claimant pooled fund cases, where preferring one victim’s claim over another’s on the accident of transaction order would be arbitrary. Applied in Barlow Clowes (UK), Cunningham v Brown (US), and Ruscoe v Cryptopia [2020] NZHC 728 (NZ). It is the natural fit for a rug pull or an exchange collapse with many victims in one pool.
Rolling charge. Recalculates the proportion of tainted value in the wallet after every single transaction, producing a continuously updated picture of the mixture. Conceptually endorsed as a fair method in Barlow Clowes and D’Aloia, and historically resisted only because of the computational burden. That objection is largely obsolete on a blockchain, where every transaction is timestamped and every input identifiable.
Matching Transactions (the deviation rule). When a distinctive amount goes in and the same distinctive amount goes out shortly after, treat that specific outflow as the illicit funds regardless of what convention you are otherwise running, and regardless of other traffic. Example given: 1,666.41 in, followed inside 24 hours by 1,666.41 out. Use sparingly and always state why you departed from your main convention.

Case-law anchors (citations as given by the sources, not independently verified here; check each before it goes near a filing): Clayton’s Case (1816) for FIFO; James Roscoe (Bolton) Ltd v Winder [1915] for LIBR; Barlow Clowes and Cunningham v Brown and Ruscoe v Cryptopia [2020] NZHC 728 for pari passu; Barlow Clowes and D’Aloia for rolling charge. Cryptoasset-specific application appears in D’Aloia v Persons Unknown [2024] EWHC 2342 (Ch) (UK), Ruscoe v Cryptopia Ltd [2020] NZHC 728 (NZ), Re Gatecoin Ltd [2023] HKCFI 914 (HK), and United States v Sterlingov (2024) (US federal).

When to use

The moment a traced flow enters an address holding funds from other sources and you have to justify which outflow you follow. Pick the convention before you trace onward, name it in the report, and apply it consistently so a reviewer can replicate the path.

Avoid when

Do not present a convention as a finding of fact. It is an analytical choice layered on top of the on-chain record, so it belongs on the inference side of the line (see Separate On-Chain Fact from Analytical Inference). Do not silently switch conventions mid-trace, and do not confuse these with tax cost-basis methods (see Crypto Cost-Basis Methods: FIFO vs HIFO vs LIFO), which share names but answer a different question.

Inconsistent application is worse than an unfavourable convention. This is the single most important discipline here, and it is the point on which a UK claim has already failed. Naming FIFO and then applying subjective judgement transaction by transaction produced evidence the court called “chaotic and, ultimately, contradictory”, and the claim collapsed even though the funds had been traced. The test is whether the court and an opposing expert can reproduce your arithmetic. See D’Aloia v Persons Unknown: When the Methodology Fails, Not the Trace.

Example

Stolen ETH lands in a wallet already holding a legitimate balance, then three outbound transfers follow over two days. Under PIFO, all three are ascribed to the theft until the stolen amount is exhausted, so you follow all three. Under LIBR, if the wallet balance never fell below the stolen amount, you argue the stolen value is still there and pursue a freeze on the wallet instead of chasing the hops. In a rug pull where forty victims funded one liquidity pool, pari passu is the model that gives each of them a share proportional to what they put in, and it is the model the source applied in exactly that case.

Taint Analysis (Taint Tracing) · D’Aloia v Persons Unknown: When the Methodology Fails, Not the Trace · A Liquidity Pool Deposit Ends Asset Identity · Crypto Cost-Basis Methods: FIFO vs HIFO vs LIFO · Know When to Stop Tracing · Separate On-Chain Fact from Analytical Inference · Forensic Method Selection Decision Tree · Transaction Graph Analysis (TGA) · Handover Reports Must Be Replicable · Calibrate Your Testimony Language · Six Characteristics of a Court-Credible Forensic Report · Reviewing an Opposing Forensic Report · Recovery Jurisdictions and Crypto Case Law · Consolidation Addresses and Tiered Intermediary Groups · The Forfeiture-Complaint Tracing Narrative (DOJ Civil Forfeiture Structure) · Describe Laundering in Phases When the Transactions Cannot Be Counted · Articulating No Legitimate Economic Purpose