How a debtor was linked to crypto-assets and payments on a 180,000 dollar debt were resumed
After investing in a crypto project, the partner deleted work chats and changed jurisdiction. The check combined the documentary basis of the debt, public digital traces and analysis of open blockchain data, after which the parties executed an acknowledgment of the obligation and a repayment schedule.
- 180 000 $ - the amount of the obligation
- 3 jurisdictions - Russia, Turkey, UAE
- 14 days - engagement duration
- on-chain + off-chain - two independent lines
A composite example based on typical matters; details altered. The material does not disclose the client, participants or circumstances of a specific project. Wallet addresses, platform names, transaction identifiers, sources and operational methods are not published in any form.
Проверено: 3 августа 2026Время чтения: 17 минутBLACKFILE Editorial & Investigations Team

The task was framed as combining the documentary basis of the obligation with observable digital traces. A private check cannot and did not undertake to prove that a wallet belongs to a specific person.
The range of jurisdictions in which business activity was traced and elements of the legal structure were located. Cities, addresses and platforms are not disclosed.
From agreeing the legal framework to delivering to the client and their legal counsel a summary conclusion and an assessment of the applicability of the materials.
The amount of the obligation according to the documents and correspondence provided by the client. The terms of participation in the project and the circumstances of the investment are not disclosed.
A dual evidentiary line was assembled and an acknowledgment of the obligation with a repayment schedule was executed. Ownership of the crypto-assets by the debtor was not established and is not asserted: a probabilistic connection is not the same as a right of ownership.
Reconstruction of the documentary basis from the client's materials, analysis of open blockchain data, and verification of observable signs of business activity outside the blockchain.
The material is built on typical matters in this area. Wallet addresses, platforms, transaction identifiers and verification methods are excluded entirely and deliberately.
Investment in the project and loss of contact
The investment was made in a project that the partner ran himself: with a clear idea, agreed terms of return, and no formal investment agreement. The relationship was business-based and had lasted for years; the documents were brief, and most of the arrangements remained in work chats.
In the first months there were reports and plans, then messages became less frequent and general. After the partner changed jurisdiction, the work chats were deleted and contacts stopped responding.
By the time of the enquiry, the client considered the situation hopeless for two reasons: there was no agreement, and the correspondence had been deleted. Both turned out to be overstated, but for different reasons, and each had to be addressed separately.
We reframed the task. A private check cannot prove that crypto-assets belong to a specific person: the blockchain shows movement of funds between addresses, not names. The task was set differently - to assemble a verifiable position from two independent lines: documentary and digital.
The limits were also stated at the outset. We do not establish place of residence, do not conduct surveillance, do not obtain access to other people's accounts, devices or exchange accounts, and do not work with data obtained from leaks. The last point matters especially in this area: material from a leak is not only legally unacceptable, it also devalues the rest of the work.
The blockchain shows movement of funds between addresses, not names. A private check cannot prove that a wallet belongs to a person.
What data remained after the chats were deleted
Deletion of chats by one party does not destroy the evidentiary base - it destroys convenience. Below is what remained with the client, and which of it matters.
- 01
Client's own copy of the correspondence
Deletion on one participant's side does not delete the history on the other's. A significant part of the chats was preserved by the client - and this turned out to be the foundation of the entire position. What has value is a continuous chronology, not isolated fragments.
- 02
Client's payment records
Confirmation that funds were in fact transferred: the client's own bank records and transfer confirmations. On its own this does not prove the nature of the relationship, but combined with the correspondence it forms a coherent picture.
- 03
Project documents
Short agreements, appendices, reports and presentations obtained by the client lawfully. Even an incomplete set shows the subject of the arrangement and the expected procedure for repayment.
- 04
Public traces of the project
Materials that the project itself made public: descriptions, announcements, professional profiles. Everything accessible to any person by lawful means.
- 05
What the basis did not and could not include
Data from leaks, content of other people's accounts, marketplace exports, information about documents and movements. Such materials were not requested, not accepted and would not have been used even if offered.
- 06
What reduces the value of preserved material
Forwarding, re-saving and screenshots of screenshots. Correspondence and documents should be kept in full and in their original form: part of the technical information is lost from the very first re-save.
How the blockchain hypothesis was built
Blockchain work was carried out using open data only. Public transaction registries are accessible to anyone, and that is both their strength and their weakness: every movement of funds is visible, and no name is visible.
The starting point was addresses that the client obtained lawfully - within the transfers themselves. From these the picture of subsequent movement was built: directions, clustering of connected addresses, the nature and frequency of transactions.
It is important to state the nature of this conclusion precisely. Clustering is a probabilistic method. It shows that a group of addresses is, with high probability, controlled by one person or service, but it does not establish who that person is. We formulated the result exactly on that basis, with a confidence level indicated for each element.
Separately recorded was the point where the line breaks off. Part of the directions led to services that anonymize the origin of funds, and at that point the analysis stopped: further reconstruction would have been speculation, not a conclusion. This limitation is stated directly, not softened by wording.
And the main point. Wallet addresses, transaction identifiers and platform names are not given in this material and will not be given. Such publication not only exposes the parties involved but also turns the material into a tool for anyone who wants to act more carefully next time.

The project did not use data from leaks, the content of other people's accounts, devices or exchange accounts, marketplace exports, or information about documents and movements. Wallet addresses, transaction identifiers, and the names of platforms and services are not published in any volume and are not subject to reproduction.
What was confirmed outside the blockchain
The second line was built independently of the first, and this was a fundamental condition. A conclusion resting solely on blockchain analysis is almost always vulnerable in a legal proceeding: it shows the movement of funds but does not link it to a person.
Outside the blockchain, observable indicators were checked: whether professional activity is continuing, whether there is participation in legal entities, what has been published publicly about the project and its participants, and what business connections can be traced in open data.
The value of this line lies in the fact that it can be verified by ordinary means. Registration information can be re-checked, public materials can be compared, participation in companies can be documented. Blockchain analysis is less amenable to such verification and requires specialized knowledge from whoever assesses it.
The convergence of the two lines in timing and character was itself the substantive result: periods of activity observed outside the blockchain corresponded to periods of transactions visible in open data. This correspondence is presented as an analytical assessment of medium confidence, not as an established fact.
A reservation we state directly. Correspondence in timing does not prove a connection. It increases or decreases the plausibility of a hypothesis, and the report states it exactly that way - with an indication of which alternative explanations remain possible.
A conclusion resting solely on blockchain analysis is almost always vulnerable in a proceeding: it shows the movement of funds but does not link it to a person.
Two lines converging in the acknowledgment of an obligation
Five stages of the work. The point that changed the client's decision is marked in red. A schematic representation: addresses, transactions, platforms, sources and methods are not disclosed and are not to be reproduced.
Факт. Funds were invested in a partner's project under short-form documents, with the main arrangements recorded in working chats.
Решение. The starting point was the materials retained by the client, not the absence of a contract.
Факт. After the change of jurisdiction, the working chats were deleted and the contacts stopped responding.
Решение. The task was reframed: to assemble a verifiable position, rather than to prove ownership of a wallet.
Факт. Two lines were built independently: open blockchain data and observed indicators of activity.
Решение. The documentary line was treated as the basis of the position; the digital line as supporting, not substituting, it.
Факт. The applicability of the materials was assessed by a local lawyer: it differs by jurisdiction and procedure.
Решение. The connection between the cluster and the individual was left as a hypothesis; establishing the owner was referred to the legal procedure.
Факт. The obligation was acknowledged in writing; the initial payment, dates and confirmation procedure were agreed.
Решение. For settlement in cryptocurrency, the currency, rate, network and moment of execution were separately recorded.
Факт. Funds were invested in a partner's project under short-form documents, with the main arrangements recorded in working chats.
Решение. The starting point was the materials retained by the client, not the absence of a contract.
A five-stage diagram: investment, disappearance, parallel on-chain and off-chain checks, legal assessment, timeline. The turning point that changed the client's decision is marked at the third stage.
How the connection between the person and the assets was assessed
This is the most sensitive node of the entire work, and the place where such materials most often allow for a substitution. A probabilistic connection between an address and a person is presented as established ownership - and a conclusion built on such a substitution collapses at the first qualified review.
We divided the conclusions into three levels. First: observed transactions - factual data from a public register, verifiable by anyone. Second: address clustering - a probabilistic conclusion with a stated confidence level. Third: connecting a cluster to a specific person - a **hypothesis**, which cannot be established by a private check.
The third level remained a hypothesis, and the report labels it with that exact word. Identifying the owner of an address is possible in formal proceedings, through official requests to services with a client identification obligation - and that is the competence of authorized bodies and the court, not ours.
The practical point of this separation is not caution for its own sake. A report where a hypothesis is presented as a conclusion cannot be shown to an opposing party or to counsel in another jurisdiction: the first check devalues it, along with all the other materials attached to it.
And the limitation, repeated in the evidence panel: we have not claimed and do not claim that any crypto assets belong to the debtor. We described the observed transactions, assessed the probability of a connection between the addresses, and stated that the question of ownership is resolved in legal proceedings.

Preparing the position in the UAE
The materials were provided to the client's legal counsel in a form intended for use in a specific jurisdiction: the documentary basis of the obligation, a chronology, the results of both lines of work with levels separated, and a separate list of what could not be established.
Here we make a reservation that is usually avoided in such materials. The admissibility of blockchain analysis as evidence differs by jurisdiction and by type of proceeding. We do not promise that such materials will be accepted: that is determined by local law and assessed by local counsel, not by us.
Hence the order of work: the position was based on the documentary line - agreements, payment records, correspondence - and the digital line supported it rather than replacing it. The reverse order would make the position dependent on how blockchain analysis is treated in a given proceeding.
The available mechanisms were assessed separately: what procedures are in principle available to a creditor, what is required to initiate them, and what the realistic timelines and costs are. This is a description of conditions, not a forecast of outcome: we do not assess the prospects of a specific matter and do not provide legal advice.
The approach to the debtor was prepared and sent by the lawyer. We did not contact him or his circle, did not conduct negotiations, and did not act on the client's behalf. The wording was neutral: a statement of the circumstances, a list of evidence, and a proposal to settle the matter without proceedings.
What is confirmed, what is assessed, and what remains a limitation
Confirmed
documentary or technical basis- scope of the obligation: USD 180,000 under the client's documents and correspondence
- duration of work: 14 days
- jurisdictions involved: Russia, Turkey, UAE
- a written list of excluded actions
- the fact of the transfer of funds according to the client's payment documents
- observed operations in open blockchain data: actual entries in the public ledger
Assessed
analytical conclusion with an indication of confidence level- clustering of related addresses - a probabilistic conclusion, medium confidence
- correlation between periods of off-chain activity and operations in open data - medium confidence
- indicators of continuing professional activity - medium confidence
- consistency of the documentary basis of the obligation across correspondence and payments - high confidence
- sufficiency of the materials for the procedure - a matter for assessment by a local lawyer, not our conclusion
Limitation
what cannot be stated publicly- attribution of crypto-assets to the debtor was not established and is not asserted: a probabilistic connection is not equivalent to a title of ownership
- the connection between the address cluster and a specific individual remains a hypothesis: it can only be verified in a legal procedure
- the legal applicability of blockchain analysis differs by jurisdiction and is not promised without a local lawyer's opinion
- the analytical line breaks off when funds pass through anonymizing services: this is a property of the environment, not a shortcoming
- wallet addresses, transaction identifiers and platform names are not disclosed to any extent
- the amounts of the initial payment and the schedule parameters were not verified and are not published: only the client's statements serve as confirmation
The public version of the panel is anonymized. The client, participants, wallet addresses, transaction identifiers, platforms, sources and methods are not published; the wording given describes the structure of the work, not its content.

First payment and schedule monitoring
The structure of a settlement in matters involving crypto assets has one feature worth describing separately: the method of payment affects what later confirms that payment.
The general elements are the same as in any schedule. An initial payment within a short period after signing - as a test of intent. Specific dates and amounts instead of intent. Acknowledgment of the obligation in a procedurally usable form. Consequences of default described in advance, taking effect automatically.
The distinctive feature is in the order of confirmation. If the payment goes through the usual banking channel, the client's bank statement serves as confirmation. If the parties agree on settlement in cryptocurrency, it is necessary to fix separately: in what currency the obligation is denominated, at what rate and as of what moment it is converted, to what address and on what network the transfer is made, and what counts as the moment of performance.
Without these conditions, settlement in cryptocurrency creates a new dispute instead of closing the old one: the rate has changed, the network turned out to be different, the funds went to the wrong place. In the settlement this is described in advance, not discovered after the first payment.
We do not publish the amount of the initial payment or the parameters of the schedule. This information lies within the client's scope; we did not verify it and could not have verified it. The stated amounts are not given in this material, and performance of the schedule depends on the debtor and on circumstances that cannot be determined by a check.
And a general limitation. Fourteen days and the described procedure are the circumstances of this example, not a standard. Here the timeframe turned out to be moderate because the client had retained correspondence and payment records; in a situation where nothing has been retained, the result may be different.
Limitations of crypto tracing
First and most important. The blockchain contains no names. It shows addresses and transactions between them; everything that connects an address to a person lies outside the blockchain and is obtained either through legal proceedings, or not obtained at all.
Second. Clustering is probabilistic by nature. It provides grounds for a version and not grounds for an assertion. Any report where clustering is presented as proof of ownership should be read with caution - regardless of who prepared it.
Third. There exist services that obscure the origin of funds. When funds pass through them, the trace breaks off, and this is not a shortcoming of the investigator but a property of the environment. An honest report marks the break point directly.
Fourth. Legal applicability differs. In some jurisdictions and procedures, blockchain analysis is accepted as evidence provided requirements for its collection and documentation are met; in others it is not. Applicability cannot be promised without a local lawyer's opinion, and we do not do so.
Fifth. Verification does not provide access to funds. Even where an asset's attribution is established in a procedure, this does not mean it can be disposed of: that requires a court decision and cooperation from the service holding the funds. No private actions substitute for this.
And finally, the most practical point. Never disclose seed phrases, private keys or wallet access to anyone - not during a check, not during negotiations, not at anyone's request. No lawful engagement requires this, and any such request is a sign of fraud.
Does this apply to your situation
Indicators of a task that is resolved by assembling a dual evidentiary line, not by crypto-tracing alone. This is not a diagnosis and not a promise of result.
- funds were invested in a project under short-form documents or without a contract
- the working correspondence was deleted by the other side, but partially preserved on your end
- settlements ran partly or wholly in cryptocurrency
- the other side changed jurisdiction and stopped responding
- the materials will be required by a lawyer in another country, where the applicability of such data is not obvious
- it is necessary to determine whether a position exists before initiating a procedure
Never share seed phrases, private keys or wallet access with anyone - not during a check, and not during negotiations. No legitimate engagement requires this, and any such request is a sign of fraud.
Questions and answers
Not through private investigation. The blockchain contains addresses and transactions, but not names. Clustering shows that a group of addresses is likely controlled by one person or service, and this is a probabilistic conclusion, not an establishment of ownership. Identification is possible within a legal procedure, through official requests to services with client identification obligations.
Observable transactions in the public ledger: movement of funds between addresses, their direction, volume and frequency. These are factual records, verifiable by anyone. Everything else - clustering, ownership hypotheses, conclusions about control - belongs to the analytical layer and must be published with an indication of confidence, not as an established fact.
Materials from leaks, the contents of other people's accounts and devices, exchange data obtained outside a formal procedure, and any information from an unlawful source. Such data is not only inadmissible but devalues the rest of the work: its presence in a matter calls into question the origin of all other materials. We do not work with it.
Procedures exist, but their availability and requirements depend on the nature of the obligation, the documents available and the specific jurisdiction within the country. This is assessed by local counsel. We describe the available mechanisms, conditions for recourse, timeframes and costs, but we do not assess the prospects of a specific matter and do not provide legal advice.
Separately and in advance: the currency in which the obligation is denominated, at what rate and as of what moment it is recalculated, on which network and to which address the transfer is made, and what counts as the moment of performance. Without these conditions, settlement creates a new dispute instead of closing the old one. The confirmation is the recorded fact of receipt, not a message about sending.
Never, to anyone. Neither a check, nor negotiations, nor a legal procedure require this: the work is carried out using open blockchain data and documents you hold lawfully. Any request to hand over a seed phrase, private key or wallet access - regardless of who makes it - is a sign of fraud.
How to read this material
BLACKFILE works with documents and correspondence provided by the client on a lawful basis, and with publicly available data, including open blockchain registries. The company separates what is confirmed, what is assessed and what is unestablished, and states the limitations of the information obtained. BLACKFILE does not establish ownership of crypto assets, does not work with data from leaks, does not obtain access to other people's accounts, devices or exchange accounts, does not establish place of residence, does not contact the debtor, does not conduct negotiations on the client's behalf, and does not substitute for a lawyer, a court or authorized bodies.
A composite example based on typical tasks; details have been changed. The material does not disclose the client, participants or circumstances of a specific project. Wallet addresses, transaction identifiers, names of platforms and services, sources and operational methods have been fully and deliberately excluded.
The result depends on the documents retained, the jurisdiction and the actual circumstances. The timeframe and procedure given are not a standard. The legal applicability of blockchain analysis differs by jurisdiction and is assessed by local counsel. A honest outcome of such a check is often a conclusion that no verifiable position exists.
The material is informational in nature, does not constitute legal advice, and does not contain an assessment of the prospects of a specific matter. BLACKFILE does not guarantee recovery of funds, establishment of ownership of crypto assets, or the outcome of procedural actions.
Similar cases
What to read next if your situation is closer to another type of task.
BF-017Debt after the debtor relocatedif the question is not about crypto assets, but where the claim is enforceable120 000 $scope of the claim11 daysengagement duration4 jurisdictionsгеография
BF-015Asset tracing after corporate misconductif the investment was corporate and the structure is more complex7.2-8.1 million €asset valuation34 daysengagement duration5 jurisdictionsгеография
BF-016Private debt of 100,000 dollarsif the loan was personal and made without a contract100 000 $scope of the claim9 daysengagement duration4 jurisdictionsгеография
Invested in a project, and the partner disappeared along with the funds?
Describe the situation in general terms: the nature of the investment, whether you have retained correspondence, whether settlements were made in cryptocurrency, and in which country the other party is presumed to be located. Do not send wallet addresses, correspondence or personal data through the initial enquiry form, and never share seed phrases or private keys.
The work does not substitute for a lawyer and is not a promise of fund recovery. Never share seed phrases, private keys or wallet access with anyone.