Every Bitcoin payment is recorded permanently and publicly on the blockchain. We trace your payment through the stations it passed through and tell you, for every partial amount, where the trail ends — and whether anything can be done about it.
Anyone who offers, in connection with a fraud case, to recover funds for an upfront fee is very likely committing fraud themselves. This scam specifically targets people who have already been victimized. Legitimate organizations do not ask for money in exchange for a promise of recovery.
We don't recover funds either. We show you what the blockchain records — verifiably, with a disclosed method. What you do with that is your decision; the usual path leads through a police report.
What becomes possible from there: amounts that arrived at a named exchange, or that remain unmoved, can be frozen at the request of investigating authorities. Neither you nor we can decide that — but it requires knowing where the funds are, and that they are still there. This report establishes both.
Bitcoin forensics is the study of payment paths on the blockchain. Unlike a bank transfer, every Bitcoin payment is publicly visible — permanently, to anyone, without any request for information. What it does not reveal is who stands behind an address.
The work therefore consists of two parts. The first is computation: following the money through branches and mixing, and determining, for every partial amount, where it ended up. The second is attribution: recognizing which addresses belong to an exchange, a swap service, or a bridge — because that is where traceability on the chain ends and where only an authority can obtain further information.
Both carry uncertainty, and both can be done rigorously or sloppily. The difference lies in whether an analysis discloses what each statement is based on — or whether it blends assumption with fact. We disclose it: every statement carries a confidence level, and “confirmed” means exclusively what is directly recorded on the blockchain.
You don't get an opinion — you get an itemization: every partial amount, its path, its final state, and where each statement comes from.
Forward from your payment across up to 24 stations — and backward from received payments to their origin.
Addresses that spend together belong to the same entity. This produces a picture of scale — not of ownership.
”Confirmed” means exclusively what is directly recorded on the blockchain. Everything else carries a weaker level — visible, not hidden.
The entire case as a map: pan, zoom, isolate a strand, highlight a single submission.
Every deposit at that day's rate in euros and US dollars. For a police report, the value at the time counts — not today's.
Amounts that remain unmoved are checked daily. If something moves, you'll know — as long as the finding still holds.
Every traced partial amount lands in exactly one of these states — the report shows, for each one, how much arrived there. Three of them are actionable: there is a concrete next step. Actionable does not mean the money comes back.
| Final State | What Was Established | What Follows |
|---|---|---|
| Unmoved | The amount remains untouched to this day at the address where tracing ended. | The strongest finding: read directly from the blockchain, not inferred. But it only holds as long as nothing moves — which is why this address is then checked daily. |
| Custodial Service | The amount arrived at a named exchange that holds accounts under real names — such as a trading platform. | Someone there knows who owns the account. Exchanges provide this information exclusively to authorities, which is why filing a police report is the decisive step. |
| Swap or Bridge | The amount arrived at a service that exchanges into other currencies or moves it to another network without requiring a user account. | There is no account holder to ask about here, and the money has left the Bitcoin chain. The time and amount are nonetheless on record there and belong in the police report. |
| Mixing Transaction | The amount was absorbed into a transaction in which many participants received equal amounts. Which output belongs to which input can no longer be determined from the outside. | This is where traceability ends: any claim about where this amount subsequently flowed would be a guess, not a finding — we don't make one. This pattern is produced by CoinJoin procedures as well as by mixing services; which of the two occurred cannot be told from the transaction itself. Using such procedures does not, by itself, indicate a criminal offense — they also serve to protect privacy. |
| Continues | The path extends beyond the number of stations examined. | The trail does not break off here — we simply stopped looking. How deep the investigation went is stated in the report; a deeper analysis is possible. |
| Residual Amount | The branch was split repeatedly until it became too small for further tracing to be meaningful. | Typical of payout structures that deliberately fragment amounts. Here too, the trail isn't over, but the individual pieces are too small for an authority to pursue. |
Transaction IDs or Bitcoin addresses, a password of your choosing instead of your name. No email address required, no account.
Every entry is checked against the standard of the case. Uncertain entries are not used in the findings but are listed in full. Tracing then proceeds.
As a PDF, with an address graph, glossary, and a draft for filing a police report. With the software version and data date noted, so every figure can be independently verified.
Why free? Because every case file improves the address database that the next analysis draws on. We'd rather say that openly than claim a generosity that isn't one.
The blockchain doesn't reveal that. We attribute amounts to addresses, not to people.
We are not lawyers and do not advise on your individual case. The draft police report states facts and does not evaluate them.
Exchanges only provide account-holder information to authorities. That's why filing a police report is the decisive step — not this report.
With a CoinJoin or an accountless swap service, traceability stops. We state that plainly instead of glossing over it.
You don't need a name or an email address for this — a password of your own choosing is enough, and you can use it later to add information or have everything deleted. Only transaction IDs and Bitcoin addresses are stored; both are already public on the blockchain anyway.
Does your report concern a case that's already underway? Go to Case File CT3 · Background on CT3