The 5-Stage Investigation Process

Core idea

Professional crypto investigations follow a consistent structure from the first known address through to a court-ready evidence package. Each stage shapes the next, so poorly scoped early work generates noise and creates cross-examination vulnerabilities later.

Components

1. Scope & Seed, Start from a seed (known address, TXID, or block height tied to the incident). Define the objective before touching a tool (tracing stolen funds, building sanctions exposure, or establishing court attribution). Collect all identifiers, identify which blockchain(s) are involved, establish a precise timeline and block range, record a written starting hypothesis, and open case documentation from day one.
2. On-Chain Tracing, Follow the money: trace UTXO flows forward on Bitcoin, and account/token transfers (incl. ERC-20 and cross-contract interactions) on Ethereum. Distinguish direct hops from peeling chains; flag mixers, cross-chain bridges, and privacy-coin conversions immediately; track consolidation events (a shared-controller signal); note dormancy periods (a deliberate delay tactic); record exchange deposit addresses precisely. Tools: Blockchain.com Explorer, Etherscan, Blockchair (raw data); Spectra (visual graphs, entity tagging, multi-source querying).
3. Clustering, Group addresses controlled by one entity using the two legally tested heuristics: Common Input Ownership Heuristic (CIOH) and change address analysis. Check for address reuse. Identify and exclude CoinJoin transactions (they defeat CIOH). State explicit confidence levels (“probable” vs “certain”).
4. OSINT Attribution, On-chain data tells you what happened; OSINT tells you who did it. Bridge addresses to identity via self-disclosed addresses, username correlation, IP leaks, domain registrations, code-repo activity, and social footprints. The most legally sensitive stage: archive and cryptographically hash-timestamp everything at collection, since subjects delete content once aware.
5. Evidence Packaging, Present findings so a second investigator reproducing your documented steps reaches the same conclusion. State every tool, version, and data source; assign confidence levels to each claim; provide a full chain of custody; separate on-chain fact from analytical inference; and explicitly document what the evidence does NOT prove to preempt cross-examination.

When to use

Running any end-to-end crypto investigation intended for court, compliance, or journalism, from receiving a victim’s report through delivering the final report.

Avoid when

Do not jump straight into tracing without Stage 1. Poorly scoped work generates noise that obscures the real money flow and creates cross-examination vulnerabilities later.

Example

A victim provides a transfer screenshot -> extract the TXID as the seed (Stage 1) -> trace flows on a block explorer or Spectra to an exchange deposit address (Stage 2) -> cluster the subject’s ~80 addresses via CIOH (Stage 3) -> correlate a self-disclosed BitcoinTalk address to a username (Stage 4) -> package with confidence levels and chain of custody (Stage 5).

Related

Crypto Investigation Glossary, Wallet Clustering and Heuristics, Key OSINT Techniques for Crypto Investigators, Separate On-Chain Fact from Analytical Inference, Beginner Investigation Approach