Skip to Content
Casework MethodThe Six Operational Phases of the Cryptocurrency Investigation Methodology

The Six Operational Phases of the Cryptocurrency Investigation Methodology

framework

Core idea

CIM splits a crypto investigation into six sequential phases, each with one objective and one primary deliverable, so that “where am I in this case” always has an answer. The ordering carries the discipline: evidence is preserved before it is analysed, on-chain activity is analysed before it is correlated with off-chain information, and nothing is communicated until it has been assessed against typology and confidence.

Components

  1. Initiate. Receive, evaluate, document, and formally open the investigation. Activities: case intake, initial assessment, jurisdiction review, case documentation, case assignment. Deliverable: an established investigative case file.
  2. Preserve. Collect, preserve, organise, and document evidence. Activities: evidence collection, evidence inventory, metadata documentation, preservation, chain of custody. Deliverable: a complete evidence inventory that later analysis can rest on.
  3. Analyze. Examine blockchain activity and record what is observable. Activities: wallet analysis, transaction analysis, fund tracing, explorer review, smart contract observations. Deliverable: documented blockchain findings supported by observable evidence.
  4. Correlate. Integrate the on-chain picture with everything off-chain. Activities: attribution analysis, OSINT collection, exchange and VASP review, cross-source corroboration. Deliverable: an evidence-supported analytical picture.
  5. Assess. Place the findings against recognised typologies and state how confident you actually are. Activities: typology assessment, attribution confidence evaluation, alternative hypothesis review, identification of investigative limitations. Deliverable: an evidence-based analytical assessment.
  6. Communicate. Write it up so somebody else can follow it. Activities: report planning, evidence organisation, analytical writing, quality assurance review, final documentation. Deliverable: a report fit for supervisory review or case presentation.

When to use

As the spine for any investigation that will be reviewed by someone other than you: a supervisor, a prosecutor, a compliance committee, or a court. It is also the fastest way to diagnose a stalled case, because a case that will not move is usually being worked two phases ahead of the phase it actually completed.

Avoid when

Investigations rarely run cleanly forward, and CIM does not pretend otherwise. Phase 6 output frequently sends you back to Phase 3. Treat the sequence as an ordering of dependencies, not a one-way gate, and do not delay preservation because you are “still in intake”: new evidence arrives at every phase and is preserved on arrival.

Example

A pig-butchering referral arrives by email. Initiate: open the case, record the referral channel and the reported loss, confirm jurisdiction. Preserve: save the original complaint, the victim’s screenshots, and both deposit addresses exactly as received, then start an evidence inventory. Analyze: review each address on the correct explorer and trace the two legs to a co-mingling hub. Correlate: pull OSINT on the platform domain and identify the exchange holding the hub’s downstream deposits. Assess: the indicator set matches investment fraud rather than money laundering as the predicate, and hub attribution rates Moderate pending exchange records. Communicate: write the report, stating what the evidence does not establish.

The 5-Stage Investigation Process · The Six Principles of the Cryptocurrency Investigation Methodology · WF / SOP / WS / CHK / REF Document Architecture · Case Opening Procedure · Evidence Preservation Procedure · Attribution Procedure (Seven Steps) · The Six-Step Crypto Recovery Framework · Six Core Investigation Questions

Last updated on
The Recovery Fusion CellThe Six Principles of the Cryptocurrency Investigation Methodology