1. Anchor the verified loss transaction
The submitted transaction hash, affected address, asset, amount and time are used to verify the actual loss edge. Ordinary wallet history is not automatically treated as the incident path.
2. Trace funds within defined boundaries
Downstream addresses are followed using asset, amount and timing relationships while detecting splits, consolidation, swaps, contract calls and bridges. The trace stops and records a reason when it reaches a query budget, evidence discontinuity or commingled funds requiring human review.
3. Identify investigation value points
An exchange, bridge, custodian or identifiable entity becomes a value point only when both the fund path and the address label are evidence-supported.
4. Evidence levels
Facts come from reproducible chain records; associations describe relationships between addresses and entity labels; inferences are professional judgments based on amount, timing and behavior; unconfirmed matters remain explicitly unknown.
5. Limitations
Public APIs, internal transactions, privacy tools, cross-chain protocols and entity labels may have incomplete coverage or delayed updates. Reports should be used with original evidence and the applicable legal process.