Casework Method

52 notes

Running the investigation: intake, scoping, OPSEC, response priority, freezing, sanctions.

Jump to any note in this section:

Concepts

Note
Freezable vs Non-Freezable Crypto Assets
Impersonation Scams and the Crypto-Kiosk On-Ramp
Issuer Freeze Mechanisms: Blacklist, Wipe, and Protocol-Level Blocking
The Scope Triangle
Type A vs Type B: Where the Investigation Starts

Principles

Note
Case Tractability: When to Decline
Identify the Predicate Typology First
Manage Both Digital Footprints (OPSEC)
Scope the Engagement in Writing

Frameworks

Note
Escalation Decision Matrix and Triggers
Five Investigation Goal Types
Five Investigation Output Types
Five Steps to Obtain Control Over Crypto
Investigation Risk Categories & Mitigations
PI Response Priority: Freeze, Monitor, Predict, OSINT
Recovery Budget Tiers by Asset Value
Six Core Investigation Questions
The Integrated On-Chain and Off-Chain Forensic Framework
The Recovery Fusion Cell
The Six Operational Phases of the Cryptocurrency Investigation Methodology
The Six Principles of the Cryptocurrency Investigation Methodology
The Six-Step Crypto Recovery Framework
Types of Due Diligence
WF / SOP / WS / CHK / REF Document Architecture

Workflows

Note
Case Opening Procedure
The 5-Stage Investigation Process

Tactics

Note
Beginner Investigation Approach
Controlled Test Transactions as Ground Truth
Exchange Tiers and the Escalation Clock
Freezing Funds with an Exchange Email
Monitoring Addresses with Alerts
Obsidian Case-Management Workflow
Screening Addresses Against OFAC Sanctions
Translate Stakeholder Wants into Investigable Questions
Working a Crypto ATM as a Physical Pivot

Checklists

Note
Common Crypto Investigation Failure Modes
Crypto Crime Typology Catalogue
First Hour Case Control Checklist
Five Intake Red Flags
Freeze Circumvention Techniques and Countermeasures
Intake Triage Checklist
Investigator OPSEC Checklist
Post-Seizure Monitoring Periods by Asset Type
Pre-Incident Recovery Readiness
Pre-Investigation Readiness Checklist
Sanctions Screening a Bitcoin Cluster
Surface-Level Fast Wins
The First 24 Hours of a Crypto Theft
Victim Artifact Intake: Getting the Starting Point Right

Cautions

Note
Approaching a VASP Can Tip Off the Target
Five Recovery Pitfalls

Reference

Note
Enforcement Outcome Rates by Crypto Typology

Last updated on September 23, 2026

Recovery Jurisdictions and Crypto Case Law Freezable vs Non-Freezable Crypto Assets