Follow the question / Blockchain Investigations

Blockchain Investigations

Bring a clear investigation question, a defined scope, and an evidence standard to your blockchain intelligence evaluation.

Request a Blockchain Investigations Demo Platform Overview
  • Interactive fund-flow tracing
  • Exportable evidence packages
  • Investigation software, not legal conclusions

Questions worth exploring

Keep the investigation question in view.

An investigation conversation can begin with a simple question: what needs to be explained? Describe the activity of interest, the information already available, and the boundaries of the inquiry. FinTrace Investigate follows fund flows across chains, layer-2 networks, bridges, and decentralized exchanges, with interactive graphs that bring transaction relationships into view.

1

Define the inquiry

State the question and what would count as a useful finding.

2

Add addresses and transactions

Bring the starting addresses, transactions and known context.

3

Trace relationships

Follow incoming and outgoing funds through the graph.

4

Examine entities and exposure

Review attributed entities, confidence and exposure.

5

Preserve evidence

Pin addresses, transactions and notes with sources and dates.

6

Prepare the review record

Assemble the findings and their limits for your reviewers.

  • Keep in view · 01

    A defined inquiry

    State the question in plain language and identify what would count as a useful finding. Separate existing information from assumptions that need examination.

  • Keep in view · 02

    Relationships to examine

    Describe the addresses, transactions, or connections relevant to the discussion. Ask how any available visual would distinguish observed information from interpretation.

  • Keep in view · 03

    A record for review

    Explain who will review the work and what context they need. Discuss the sources, notes, dates, and limitations you would want to accompany a finding.

Interactive graph demonstration

Trace funds through a graph you can question.

Expand connections, follow incoming or outgoing funds, filter by risk and amount, group related addresses, then pin what matters as evidence. Every node is a claim to examine, not a conclusion.

Related cluster: 3 addresses92.4 ETH18.1 ETH74.1 ETH11.0 ETH7.1 ETH60.0 ETH48.2 ETH58.7 ETH58.7 ETH31.0 ETH17.2 ETH58.0 ETH1.3 ETH0.7 ETH3.2 ETH0x8d2c..7e1fOrigin wallet1Exchange(example)1Wallet0x41a7..9ad21DeFi protocol(example)2Cluster A3 addresses2Wallet0x7c3e..e0b11Mixer(example)1Relay wallet0x4a8b..bf2c1Exchange(example)2Sanctionedentity (example)2Bridge(example)2DEX(example)2Exchange(example)2Cluster B2 addresses2Wallet0x5d18..e7f3 (Arbitrum)2Private wallet0x88f2..1c0a
NormalSuspiciousHigh-riskUnknownSelected
Select a node to inspect it. Ctrl + scroll to zoom, drag to pan.

Illustrative demo data. No investigation is performed on this website. Graph depth, filters and cross-chain coverage are confirmed during evaluation.

Address and entity inspection

Inspect the address behind the node.

Select any node to see its activity, its attributed entity, how confident the attribution is and where each piece of evidence came from.

61.0 ETH12.4 ETH40.2 ETH31.0 ETH1Exchange(example)1Wallet0x41a7..9ad2Relay wallet0x4a8b..bf2c1Mixer(example)1Bridge(example)
NormalSuspiciousHigh-riskSelected
Address details

Relay wallet

Suspicious
0x4a8bd31e7f09c2a5b16d80e3f94a72c1bf2c
Total received
73.4 ETH
Total sent
71.2 ETH
First activity
Oct 18, 09:14 UTC
Latest activity
Oct 24, 14:32 UTC
Connected networksEthereumArbitrum
Risk indicatorsMixer exposureIndirect watchlist link
Entity attribution

Possible intermediary service

Attribution confidenceMedium

Attribution is a hypothesis with sources, not a confirmed fact. Review the evidence before relying on it.

  • Address clusteringShares inputs with 6 addressesMedium
  • Public referenceListed by a third-party label setLow
  • Behavioural patternPass-through activity within minutesMedium

Software, not conclusions. FinTrace provides investigation software. Findings are evidence and context for your reviewers. They are not legal conclusions, and FinTrace does not provide investigation services.

Cross-chain investigation

Follow the question when funds change chains.

An investigation can continue from a source network, through a bridge or intermediary, to a destination network and an exchange or service endpoint. Each hop keeps its timestamp and the asset that moved.

  1. Source network

    Ethereum

    0x8d2c..7e1f
    Oct 18, 10:05 UTC70.0 ETH
    Bridged
  2. Bridge or intermediary

    Bridge (example)

    0xb2c6..7a94
    Oct 18, 10:07 UTCETH locked, wETH minted
    Moved
  3. Destination network

    Arbitrum

    0x5d18..e7f3
    Oct 18, 10:22 UTC69.9 wETH received
    Swapped
  4. Service endpoint

    Exchange (example)

    0x2ac9..04f6
    Oct 18, 11:40 UTCwETH swapped to USDC
  • Asset conversionETH → wETH → USDC
  • Elapsed, source to endpoint1 h 35 min
  • Networks touchedEthereum, Arbitrum

Confirm during evaluation: which networks, bridges and exchange endpoints can be followed, and how a bridge or exchange is identified. This sequence is an illustration of the concept.

Timeline and flow analysis

Move through time and watch the graph change.

Drag the timeline to see transactions appear in order, how quickly funds moved, where they split and merge, and when assets or networks changed. The graph and timeline stay in step.

40.0 ETH35.0 ETH39.8 ETH34.9 ETH0.6 ETH0.5 ETH70.0 ETHwETH4.7 ETHSourcewalletSplit A0x1f3a..Split B0x9c0e..Merge wallet0x4a8b..RepeatedcounterpartyBridge(example)Exchange(example)Arbitrumwallet
NormalSuspiciousUnknownOrigin
Step 4 of 6
  1. Oct 18, 09:14Source wallet splits funds into two transfers
  2. Oct 18, 09:31Both branches forward within 17 minutes
  3. Oct 18, 10:02Merge wallet receives both; repeated counterparty appears
  4. Oct 18, 10:05Large transfer of 70.0 ETH, 3 minutes after the merge
  5. Oct 18, 10:22Bridge to Arbitrum, asset changes from ETH to wETH
  6. Oct 18, 11:40Small transfer to an exchange endpoint
  • Transaction order6 stepsOrdered by block time
  • Movement speed11 minMedian hold time per hop
  • Split and merge1 split, 1 mergeBranches recombine at one wallet
  • Repeated counterparties1Appears at two points
  • Large value transfers1Above 50 ETH
  • Asset and network changes2ETH to wETH; Ethereum to Arbitrum

Illustrative demo data. Movement speed and other measures shown here are examples, not results.

Evidence workspace

Keep every finding traceable and reproducible.

Pinned transactions, graph snapshots, notes and sources are saved together with timestamps and reviewer activity, so the record can be checked, repeated and handed over.

Saved addresses

  • 0x8d2c..7e1fOrigin wallet
  • 0x4a8b..bf2cRelay wallet
  • 0xe19a..3b5dWatchlist reference
  • 0x5d18..e7f3Arbitrum wallet

Reviewer activity

  1. 15:10S. Kim reviewed the bridge hop
  2. 14:36A. Rahman pinned 0x9e21…c4d0
  3. 14:34Graph snapshot 3 saved
  4. 14:32Investigation opened, case CS-2041

Pinned transactions

  • 0x71c4…a9e260.0 ETH · Origin to Mixer (example)
    Oct 24 14:32
  • 0xb2c6…7a9431.0 ETH · Relay to Bridge (example)
    Oct 24 14:34
  • 0x9e21…c4d070.0 ETH · Merge wallet to Bridge
    Oct 24 14:36

Graph snapshots

Snapshot 1 · Full graph
Snapshot 2 · Mixer branch
Snapshot 3 · Cross-chain path

Analyst notes

  • AR
    A. Rahman Oct 24 14:36

    Funds split at the origin wallet. One branch reaches a mixer and then a watchlist reference. Attribution unconfirmed; verify against sources.

  • SK
    S. Kim Oct 24 15:10

    Second review of the bridge hop. Timestamps match the exchange endpoint activity. Limits noted in the record.

Source references

Source referenceUsed forRetrieved
Address clustering analysisCluster A grouping2024-10-24 14:31 UTC
Watchlist referenceEntity flag, hop 22024-10-24 14:32 UTC
Public label set (third party)Exchange attribution2024-10-24 14:33 UTC
Exportable evidence package

EV-2041 · Evidence package

  • Saved addresses (4) and pinned transactions (3)
  • Graph snapshots (3) with their filter settings
  • Analyst notes and reviewer activity log
  • Source references with retrieval timestamps

Every item carries its source and timestamp, so a reviewer can trace a finding back and reproduce it. Export formats are confirmed during evaluation.

Export evidence package

Illustrative demo data.

Prepare a focused conversation

Bring a scenario. Define what you want to learn.

Use a fictional path such as Sample A → Sample B to explain the type of relationship you want to examine. The homepage transaction map illustrates the review layout — request a demo to see live tracing across your networks.

  1. 1Frame the inquiry
  2. 2Examine the evidence requirements
  3. 3Define the review record

A simple way to structure your evaluation call.

Scope · 1 of 7

Frame the investigation question

Example question

Where did the funds received by the origin wallet go, and which entities were involved?

Scope · 2 of 7

Identify starting addresses

  • 0x8d2c..7e1fOrigin
  • 0x4a8b..bf2cRelated
+ Add address or transaction
Scope · 3 of 7

Choose relevant networks

Scope · 4 of 7

Set date and transaction boundaries

FromOct 1, 2024ToOct 24, 2024
Graph depth3 hops
Minimum amount≥ 5 ETH
Scope · 5 of 7

Define evidence requirements

Scope · 6 of 7

Choose reviewers

Scope · 7 of 7

Define the expected review record

Bring this scope to your demo.Use fictional or approved examples. Nothing you select here is submitted.
Request a Blockchain Investigations Demo

Product verification

What needs confirmation

Investigate traces fund flows across chains, bridges, and decentralized exchanges, with an interactive graph view and exportable evidence packages for case documentation. Use these questions to confirm the details that matter for your investigations.

  • Ask · 01

    Supported networks

    Which networks can be traced for your use case?

  • Ask · 02

    Cross-chain tracing

    How are funds followed across networks, and where does tracing stop?

  • Ask · 03

    Bridge identification

    How are bridges and intermediaries recognised, and how is that shown?

  • Ask · 04

    Exchange attribution

    Which exchanges and services can be attributed, and from which sources?

  • Ask · 05

    Graph depth and transaction limits

    How many hops and transactions can a graph hold before it is limited?

  • Ask · 06

    Historical data availability

    How far back can transactions be examined?

  • Ask · 07

    Attribution confidence

    How is confidence expressed and how are low-confidence links shown?

  • Ask · 08

    Evidence export formats

    Which formats can an evidence package be exported in?

  • Ask · 09

    Case-management integration

    How does an investigation hand over to your case-management process?

  • Ask · 10

    User roles and permissions

    How are investigators, reviewers and administrators separated?

These are evaluation questions, not guaranteed capabilities. Answers depend on your deployment and are agreed with the team during your evaluation.

Before your demo

Blockchain Investigations: questions and answers

Does FinTrace Intelligence offer investigation services?

FinTrace provides the investigation software — interactive tracing, graph visualization, and evidence export. Ask the team about managed-service options if your team needs additional support.

Can I trace across different blockchains?

Yes. Investigate traces fund flows across chains, bridges, and decentralized exchanges. Ask for the current network coverage for your evaluation.

Is the homepage map an actual investigation?

No. The homepage graph uses fictional addresses to illustrate the review layout. Request a demo to see a live investigation.

Related products

Continue your evaluation

Explore related product topics to build a broader evaluation. An investigation can flow from graph to attributed entities, a managed case and an audit-ready report.

  1. Starting point

    Investigation graph

    Trace funds, inspect nodes and pin the evidence that matters.

    This page
  2. Attributed entities

    Entity Intelligence

    See the sourced entity behind an address, with a confidence indicator and the context to assess an attribution.

    Graph → entitiesMove from a node to its sourced entity and confidence.
    Explore Entity Intelligence
  3. Managed case

    Case Management

    Assign, document, and hand over a review with role-based permissions and a full activity history.

    Entities → caseAttach findings to a case with an owner and history.
    Explore Case Management
  4. Audit-ready report

    Reports & Audit Trails

    Generate exportable reports that pair findings with evidence and a tamper-evident activity history.

    Case → reportExport the record with its evidence and timeline.
    Explore Reports & Audit Trails

Start a conversation

Bring your investigation questions

Describe the inquiry and the evidence context you want to explore in a demo.

Request Demo
Platform Overview