Documentation built for review.
A ChainwatchCrypto report separates fact from analytical interpretation from unverified information, states its method, states its limitations, and carries the metadata needed to verify it later.
What does a blockchain investigation report contain?
A blockchain investigation report sets out the traced transaction path, the services identified along it, the attribution confidence behind each finding, and the methodology used to reach them. It documents what the chain shows. It cannot prove who controlled an address, and a competent report states that limit explicitly.
Fourteen sections, in this order.
| Section | Contents |
|---|---|
| 1. Executive summary | What was asked, what was found, and what the findings do not establish. |
| 2. Case information | Identifier, version, dates, investigator, scope. |
| 3. Incident description | The account given to us, labelled as supplied information. |
| 4. Blockchain information | Networks, assets, block ranges and data provenance. |
| 5. Transaction analysis | The transactions examined, each referenced. |
| 6. Fund flow | The traced path, with hop-by-hop references. |
| 7. Wallet analysis | Address-level findings, including clustering and its confidence. |
| 8. Entity attribution | Attributions asserted, each with source, evidence and confidence. |
| 9. Risk indicators | Signals observed and the model version applied. |
| 10. Evidence | The artefact index with checksums. |
| 11. Methodology | How each finding was produced, in enough detail to be repeated. |
| 12. Limitations | What this analysis could not establish, and why. |
| 13. Findings | Typed: fact, analytical interpretation, unverified information. |
| 14. Recommended next steps | Options supported by the findings — never a promise of outcome. |
What travels with every document.
Prepared for investigative and evidentiary use, subject to applicable jurisdictional requirements. Whether a document is admitted is a matter for the court or authority receiving it, and no vendor can promise otherwise.
If a finding changes, a new version is issued and the previous one is retained. A report that quietly changes underneath a reader is not evidence, it is a liability.
Where the artefacts live.
Customers see their own evidence, their generated reports and the documents an investigator has shared — with versions, authorship and integrity metadata on every item.
| Item type | Origin | Notes |
|---|---|---|
| Uploaded evidence | Customer | What you gave us, retained exactly as supplied. |
| Generated reports | Platform | Versioned, checksummed, downloadable under access control. |
| Investigator documents | Investigator | Shared deliberately, never by accident — sharing is an explicit action. |
| Transaction exports | Platform | CSV and JSON exports of the traced path, with the query that produced them. |
| Case summaries | Platform | Point-in-time snapshots of case state. |
Before you pay anyone, report the theft.
Reporting is free, it takes minutes, and it is the step most likely to matter. Do it before you engage us or any other investigator. A tracing report is far more useful to an exchange or a prosecutor when a formal complaint already exists to attach it to.
FBI IC3
The FBI Internet Crime Complaint Center. The primary US route for crypto theft and fraud. File here even if the amount feels small — IC3 aggregates reports, and clusters get investigated.
FTC ReportFraud
The Federal Trade Commission’s fraud reporting service. Covers scams, impersonation and investment fraud, and feeds a database used by law enforcement across the US.
CFTC
The Commodity Futures Trading Commission. The right route where the loss involves crypto derivatives, leveraged trading or a fraudulent trading platform.
SEC
The Securities and Exchange Commission. Use this where the asset or scheme was presented as an investment, a token sale or a fund.
Your local police
File a report in your own jurisdiction and keep the reference number. Banks, exchanges and insurers frequently require it, and it is often the precondition for any formal request to a service.
Report to your national fraud or cybercrime body and to your local police. If a card or bank transfer was involved at any point, contact your bank immediately — that is the one channel where speed can still change the outcome.
Blockchain analysis establishes where funds went and whether an intervention point exists. Whether anything is recovered depends on where the funds landed, how quickly you acted, and whether a cooperating exchange or authority sits at the end of the path. Read exactly what we can and cannot do, and how to spot a recovery scam before you pay anybody.