How to Read a Crypto Investigation Report: Three-Hop Flows and Evidence

Check the case reference, generation time, status, network, and starting transaction before the summary. A completed FlowTrace case means the tool finished that processing run, not that every fund movement was traced, an identity was established, or an investigation was solved.

The case page lists settings such as depth, time window, and minimum amount. Preserve these alongside the maximum depth reached. Keep preliminary or incomplete notices for unfinished or failed cases. This guide follows product report fields; it is not a prescribed legal reporting format.

Reports include a summary, methodology and data quality, risk and evidence intelligence, a flow graph, transaction records, and a full transaction-hash appendix. Content may vary by version and filtering scope. Mark missing information as unknown instead of filling it in.

Depth describes how far a path was expanded; an evidence tier describes the nature of information. A third-hop transfer does not automatically become identity evidence. Read the actual depth field rather than inferring it from graph layout; check how the tool counts the starting transaction.

A, B, C, D, and the amounts below are fictional teaching data, not a real case or an executed FlowTrace result. Event order is not a claim about product depth numbering. Assume A sends B 100 USDT, B sends C 80 USDT, and C sends D 60 USDT on one network.

A defensible description is: “Three successive transfers were observed; other activity at B and C has not been fully checked.” It is not sufficient to claim that the victim’s 60 USDT reached D. Existing balances and unrelated deposits can mix with funds; connected paths, similar amounts, and close timing alone do not establish provenance.

Use the full transaction-hash appendix to revisit records, not shortened strings in the graph. Match sender, recipient, and status. Distinguish token-transfer events from other events in the same transaction to avoid double counting.

Reported amounts are token units, not automatically a fiat loss estimate. Separate transaction time from report generation time and retain time zones. If you convert time or estimate value, record the method and reference date without overwriting original records.

Exchange candidates, first-seen depth, priority scores, and source versions help prioritize review. They are not customer identities or recovery probabilities. Check label source, role, and verification time; record missing fields as unknown. An unlabelled address is not proof of safety.

Public explorer labels are leads. A flow graph cannot reveal private exchange ledgers, customer records, or asset-control decisions. Preserve the last verifiable transfer and the stated limitation when a path encounters an exchange, bridge, mixer, or data gap.

Keep the original report and exported records; annotate a separate working copy. List the case reference, generation date, network, scope, filenames, and intended recipient. Preserve earlier versions when a query changes and explain additions or corrections.

If you separately calculate a file hash, record the algorithm and exact file. It helps compare whether a file changed, not whether the analysis is correct or legally valid. Do not assume an integrity field inside the report is a checksum of the entire PDF.

FBI IC3 warns that fraudulent recovery services may supply inaccurate tracing reports and demand further payment. A polished PDF or a located balance does not give its author control of funds. Do not pay unlocking fees, taxes, or recovery deposits because someone claims a report located assets.

FlowTrace organizes public on-chain evidence; it does not make decisions for exchanges or authorities. State the transactions and questions that need review without claiming a report can freeze assets, establish criminal conduct, or guarantee recovery.