FRN research report
A framework for reviewing crypto investment payment flows
How to preserve transaction identifiers and distinguish ledger movement from identity attribution.
Published 24 September 2026 · Prepared by Fraud Response Network
Scope: this publication is a research framework. It does not report a client investigation or make claims about a named firm or case.
This report explains a careful approach to reviewing digital-asset payments described in an investment-fraud allegation. It presents methods and limitations; it contains no case findings or estimates of recovery.
Preserve the source information
For each transfer, record the asset, network, transaction hash, sending and receiving addresses, amount, date and the service used. Keep exchange statements and communications that connect an account to a transaction. Check that a transaction hash is searched on the correct network.
Build a reproducible movement map
Record each analytical step and the source used to obtain it. A transaction map can help organise movement between addresses and identify points for further enquiry. It should be reproducible from public ledger records or provider material, with assumptions made explicit.
Keep attribution separate
Blockchain addresses are not automatically names. An address label supplied by a third party, a cluster produced by software or a transfer to a known service may offer a lead, but each needs provenance and corroboration. Similar transaction behaviour alone does not establish common ownership or intent.
State what the data cannot show
Ledger data does not necessarily show who controlled an address, why a transfer occurred, whether an asset remains available or whether an authority can act. Custodial services, mixers, bridges, incomplete records and chain-specific behaviour can complicate interpretation.
Findings should distinguish observations, interpretations and unresolved questions. Tracing does not freeze assets or guarantee that they can be returned.