Only terms that appear in this report are explained here.
A Bitcoin address is not an account but a receiving instruction. A person can use any number of them, and the address alone does not reveal who owns it. Who stands behind an address only emerges from additional information — for example, information provided by the service that issued it.
A transaction transfers amounts from one or more inputs to one or more outputs. Its ID — a 64-character string — is globally unique and permanently retrievable in public. Every statement in this report can be verified using these IDs.
The smallest unit of Bitcoin: 100,000,000 satoshi make up 1 BTC. Only satoshi amounts are recorded on the blockchain; figures in euros or US dollars are always conversions at a specific exchange rate.
A transaction must always spend an input in full. If less is needed, the remainder flows back to an address of the payer as "change." This return flow looks like a payment on the blockchain, but it isn't one. Counting it as income significantly overstates the amounts involved.
In a CoinJoin, several people combine their payments into one shared transaction. The outputs are of equal size, so it can no longer be determined from the outside which output belongs to which input. For this investigation, that means: the trail ends there, and any continuation would be a guess. Using a CoinJoin is, by itself, no indication of a criminal offense — the procedure also serves to protect privacy and is used by many people with no connection to any offense whatsoever.
General term for services that hold Bitcoin on behalf of their customers — trading platforms (exchanges) such as HTX or Binance fall into this category. Once money arrives there, the trail on the blockchain ends: what happens after that is recorded only in the service's internal books. That is exactly why such an endpoint is valuable — the service keeps an account under a name and must provide information to authorities. Instant swap services are not included here; they hold nothing in custody and keep no accounts.
Services that convert an amount directly into another currency (swap service) or move it to another network (bridge) — both without a user account and without identity verification. They are not a custodial service: the money doesn't stay there but leaves the service in a different currency — often one that can no longer be traced further. A request to authorities therefore regularly leads to no account holder. Using such a service is, by itself, legal and widely practiced.
The amount still sits untouched at the address where tracing ended. This can be read directly from the blockchain and is therefore the most reliable finding in this report — but only for as long as it remains true. If the amount is moved, the finding is outdated.
The investigation follows the money across a limited number of stations, and only for as long as a branch carries a minimum share of the original amount. Both limits are stated under "Verifiability." If an amount ends at one of these limits, that does not mean the trail breaks off there — only that the search was not continued beyond it.
If several addresses spend together in the same transaction, the same party must have controlled all the corresponding keys. From this it can be inferred that they belong together. This is a well-established but not infallible assumption: it does not hold for joint transactions such as CoinJoins, which is why such cases are excluded here.
If traced money mixes with other funds, it is followed onward proportionally: if one input makes up half of a transaction, half of every output is considered traced. Other methods — such as "first in, first out" — would arrive at different figures. None of them is objectively correct; what matters is that the method used is disclosed.
"Confirmed" means exclusively what is directly recorded on the blockchain. Everything else — attributions of addresses to companies, derived names, information provided by contributors — carries a weaker level. This distinction matters: it shows which statements stand on their own and which still need to be substantiated.
Back to homepage · Active case files · Terms · Legal notice · Privacy notice