Crypto investigations for companies and boards

Tracing answers a question about funds: what moved, when, and where it ended up. An investigation answers a question about people and conduct: what happened, who was involved, and what the evidence supports. Tracing is one input into an investigation, usually an important one, but rarely sufficient on its own. An investigation also draws on internal records, system logs, corporate structures, banking material, open-source research, and interviews, and it ends with findings about events rather than a map of transfers. If what you need is the map, start with transaction tracing and instruct an investigation only if the answer raises questions about people.

Whoever is engaging should sit outside the conduct under examination. In practice that means the board, the audit or risk committee, a non-executive director, or the organisation's external lawyers instructing on the client's behalf. Where management is within scope, management should not control the engagement, set the scope, or receive findings first. This is not a comment on anyone's integrity. It is what makes the findings usable later, because the first question anyone asks about an internal investigation is who was directing it.

We agree the questions in writing before work starts: what is being examined, which people, entities, accounts, and periods are in scope, what we are not being asked to look at, and who receives the output. Scope can change, and often does, because investigations surface things nobody expected. When that happens we come back to you with what we have found and a proposed variation rather than quietly widening the work. Nothing outside the agreed scope is examined without instruction.

We work on a need-to-know basis and agree the distribution list at the outset. Material is held in access-controlled storage, correspondence stays with the named recipients, and we do not confirm the existence of an engagement to anyone outside it. In an internal matter, confidentiality is also operational: if the subject learns of the work before evidence is preserved, records get deleted and funds get moved. Sequencing evidence preservation ahead of any interview is usually the single most important decision in the first week.

Privilege is a legal question, and it depends on the jurisdiction, the nature of the engagement, and how the work is instructed and documented. We are accountants and investigators, not your lawyers, and we do not advise on it. Many organisations choose to instruct through external counsel with privilege in mind, and we are used to working under that structure. Confirm the position with your own lawyers before the engagement starts, because the way instructions and reporting lines are set up at the beginning is difficult to correct afterwards.

No. We are a private firm, not law enforcement and not a regulator. We cannot compel anyone to answer questions, obtain records by order, search premises, seize devices, or freeze an account or a wallet. What we can do is work with the material the organisation lawfully holds or can lawfully obtain, analyse public blockchain records, and produce evidence in a form that supports whatever step you decide to take next, including a report to the authorities or an application made through your lawyers.

Then the report says so. Some investigations end without establishing what happened, because the records were incomplete, the trail ran into services that do not respond, or the available evidence supports more than one explanation. Reporting an inconclusive result plainly is more useful than reporting a conclusion that the evidence will not carry, and much safer for the organisation if the matter is later tested by a regulator, an insurer, or a court. We will also set out what further material would resolve the point, if anything would.

It can be both, and the order matters. In the first hours the priority is containment, evidence preservation, and following the funds while they are still moving, which is recovery and tracing work. The investigation follows: how the attacker got in, whether internal access or internal knowledge was involved, what controls failed, what the organisation is obliged to tell regulators, customers, and insurers, and whether anything similar happened previously and went unnoticed. If the incident is live, start with crypto asset recovery and treat the investigation as the second phase.

A written report setting out the instructions, the scope, the material examined, the methodology, the findings, the basis for each finding, and the limitations. Evidence schedules and flow-of-funds exhibits are annexed, with a chain of custody recorded from the point of collection. Many investigations stop there and are used internally. Where the matter goes further, the same work usually supports a formal expert report and testimony, which is a separate instruction with different duties attached. It is easier to write an investigation report that can carry that weight than to retrofit one that cannot.