The Forfeiture-Complaint Tracing Narrative (DOJ Civil Forfeiture Structure)

framework

Core idea

A civil forfeiture complaint is the most rigorously stress-tested tracing report in public circulation: it has to survive an adversarial challenge from claimants with counsel, so every hop is either stated as an on-chain fact or openly labelled as an inference with its supporting reasoning attached. Its ordering is the point. The narrative moves from property (what is being claimed) to scheme (what the money is) to trace (how the two connect), and it earns the right to make the largest claims last, after the smaller verifiable ones have been laid down. A tracing report built on this spine reads as evidence rather than as a tool export.

The structure below is the tracing skeleton with the litigation scaffolding stripped out. In an investigator’s report the jurisdiction, statutory-basis, virtual-currency-primer, count, and prayer-for-relief sections carry no analytical weight and are dropped.

Components

Ordered as they appear, with the load each section carries.

Property information. A bare table of the addresses or accounts at issue: identifier, amount, and a defined term assigned to each one (the complaints use “USDT Token Group A” through “G”, “Subject Account 1”, “Subject Account 2”). Naming the property up front is what lets 60 pages of narrative refer to it without ambiguity. Also records current custody.
Summary. Four or five paragraphs giving the whole scheme end to end before any detail: who reported it, how many victims, how much moved, the shape of the laundering path, and what was seized. A reader who stops here still has the case.
Origin of the investigation. Who referred it, when, and on what basis. This is provenance for the whole trace and it establishes that the investigation had a lawful, documented starting point rather than a fishing expedition.
Subject infrastructure. The characterisation of the accounts or addresses under common control, and the evidence for that control. In the 144-account complaint this is where the IP overlap, KYC photo forensics, email naming convention, and transaction-counterparty overlap all live. See Clustering Exchange Accounts From Subpoenaed Records.
Victim identification. How victims were found, how many were confirmed versus suspected, and by what method. Separates interviewed and confirmed from identified by back-tracing from matched to a complaint database record. The tiering matters: the confirmed set anchors the credibility of the inferred set.
Per-victim narratives. A handful of individual accounts, told in plain language, each ending at a named initial deposit address. These are the human anchor and they are explicitly presented as representative samples, not an exhaustive list.
Intermediary address analysis. The layering middle. Groups the intermediary addresses into tiers, gives the volume each tier received and forwarded, and explains what the tiering accomplished for the launderer. The 225M complaint runs two tiers, Intermediary Group 1 (53 addresses) feeding Intermediary Group 2 (12 addresses), which then feed the subject addresses.
Per-account or per-address blocks. One short block per subject account, each following an identical template: back-traced from account X, N intermediary addresses identified between the initial deposit addresses and X’s deposit address, M victim reports referencing K of those addresses, total reported loss, cumulative volume through those addresses, and a pointer to the exhibit illustrating it. Repetition is deliberate. A reviewer can check any one block without reading the others.
Gas-fee analysis. A separate section back-tracing the native-asset funding that paid for the token movements, used to bind the address groups to the same controller. See Gas-Funding Analysis to Cluster Controlled Addresses.
End-to-end worked example. One victim’s funds followed all the way from their initial deposit to the seized address, stating openly what makes it hard (volume, consolidation redirecting the tracing order, intermediary count) and conceding that only some victim funds can be traced that far. This is the section that proves the method rather than asserting it.
The subject addresses. What arrived at each seized address, from which upstream group, and the total.

When to use

Writing any tracing report intended for law enforcement, a prosecutor, a regulator, or a court, and any report where the volume of transactions exceeds what can be enumerated. Also use it as a review lens: read an existing report against this order and the missing sections are usually the ones a challenger would attack first.

Avoid when

Victim-facing or client-facing recovery reports, where the reader needs orientation and next steps rather than an evidentiary chain. The IOC six-section structure serves that reader better. See investigations/docs/reporting-standards.md for which structure to pick.

Example

The 225M complaint’s per-account block for OKX UID 382863414143418999 runs to two paragraphs: deposits totalling approximately 361,000 USDT arrived at deposit address 0x7f2de657ab21f269ea8e37eea1a9245af6d2e669 across 18 and 19 March 2023; an equal number of withdrawals left within minutes, all to 0x517adbbe7ebd0a2096f11fbaa5ed2988844a8d73; LIFO carries those funds to a named consolidation address; back-tracing the original deposits reached six individuals believed to be scam victims, four of them confirmed by interview, who sent approximately $632,332.67 in total. Every number is sourced, the confirmed set is separated from the believed set, and the block stands alone.

Six Characteristics of a Court-Credible Forensic Report · Separate On-Chain Fact from Analytical Inference · Handover Reports Must Be Replicable · Articulating No Legitimate Economic Purpose · Describe Laundering in Phases When the Transactions Cannot Be Counted · Clustering Exchange Accounts From Subpoenaed Records · Gas-Funding Analysis to Cluster Controlled Addresses · Initial Deposit Addresses and the Sole-Purpose Inference · Exchange Pass-Through Detection by One-to-One Deposit and Withdrawal Matching · Asset-Tracing Methodologies for Commingled Funds (PIFO, LIBR, LIFO, FIFO, Pari Passu, Rolling Charge) · The Analysis Standard: Four-Block Write-Up · Attribution Confidence Levels · Calibrate Your Testimony Language