Digital Asset Claims Digital Investigation and Evidence Intelligence

Digital Asset Claims is a research, digital investigation and evidence intelligence company. The subject of every engagement is the same: the movement, history and evidential trail of a digital asset, and the question of what the available record can and cannot support. We are not a law firm, a claims handler or an asset manager, and we do not hold, transfer or move any digital asset belonging to a client. What we produce is a structured evidence report, built from sources that a second reviewer can independently check.

A typical instruction involves a wallet, an exchange account, a set of transactions or a counterparty whose identity or intentions are in question. Clients bring us fragments — a transaction hash, a wallet address, a screenshot of a conversation, a set of dates — and ask what those fragments actually establish. Our job is to place each fragment in its proper evidential context: to say clearly where the record is strong, where it is thin, and where it says nothing at all.

A digital asset transaction does not sit in one place. A single transfer can touch a blockchain ledger, a centralised exchange's internal database, a bridge or swap protocol, a hosting provider's server logs and a messaging platform used to arrange the transfer — each governed by different retention rules, different access conditions and different levels of public visibility. Public blockchains record transactions permanently, but they do not record who controls a wallet. Exchanges hold identity information, but that information is private and access to it is not something an investigation firm can obtain by asking. Infrastructure logs — IP addresses, hosting records, session data — are often retained for only a limited period before they are deleted in the ordinary course of business.

The result is that no single source tells the whole story. A blockchain explorer shows a transaction happened; it does not show who initiated it. An exchange statement shows a deposit was received; it does not show why. A piece of open-source material shows a claim was made publicly; it does not show whether the claim is true. Digital asset investigation exists to take these separate, incomplete records and assemble them into a coherent, sourced account of what actually happened — without inventing the parts that no record supports.

Public blockchains are, by design, permanent and inspectable. Every transaction that has ever occurred on a given network remains on the ledger, timestamped and linked to the addresses involved. Blockchain reconstruction is the work of pulling that raw ledger data — often spanning thousands of individual transactions across one or more networks — into a structured timeline: which address sent funds to which address, when, in what amount, and through which intermediate hops. Where funds move between chains through a bridge, or are converted through a decentralised exchange, that path is traced hop by hop rather than assumed.

This reconstruction is a factual exercise before it is an interpretive one. The ledger itself is not in dispute — anyone can query it. What requires care is the next step: clustering addresses that plausibly belong to the same holder, identifying interactions with known exchange or service deposit addresses, and building a readable map of wallet relationships out of what would otherwise be an unmanageable volume of raw transaction data.

A case can involve tens of thousands of transactions, hundreds of associated addresses, and a corresponding volume of open-source and infrastructure material. We use AI-assisted analysis to manage that volume: to surface transaction patterns, cluster related addresses, flag anomalies for analyst attention, and cross-reference large datasets far faster than manual review alone would allow. This does not replace human judgement. Every pattern the tooling surfaces is reviewed by an analyst before it is treated as a finding, and nothing produced by an automated process is reported as fact without that review.

Open-source intelligence research draws on information that is lawfully and publicly available: corporate filings, domain registration history, social media activity, forum posts, public statements, news coverage and archived web pages. This work often supplies the connective material that a blockchain record alone cannot: a public statement linking a person to a project, a domain registration linking an entity to an address, a pattern of public activity that corroborates or contradicts a claim under investigation. OSINT findings are sourced and timestamped in the same way as any other evidence, and a single unverified post is never treated as sufficient on its own.

Where lawfully obtained, infrastructure and network indicators — hosting records, domain ownership history, IP-address associations and server metadata — can help establish whether separate online activity shares a common operator, or whether a platform used in a case is linked to other known infrastructure. This category of evidence is treated with particular caution: an IP address indicates a network connection at a point in time, not a person, and shared infrastructure can reflect nothing more than the use of the same hosting provider or the same public network.

No individual finding is reported on the strength of a single source. Each material finding is tested against at least one independent source for provenance, chronology and internal consistency before it is graded. Provenance means we can state where a piece of evidence came from and when it was collected. Chronology means the sequence of events is checked against timestamps rather than assumed from narrative order. Consistency means a finding is checked against adjacent evidence to see whether it holds up or whether it contradicts something else in the file. Where sources disagree, that disagreement is recorded as a documented conflict, not resolved by choosing the version that fits the expected outcome.

Two facts appearing near each other in time, or two addresses interacting on-chain, is a correlation — not, by itself, proof of a relationship, an identity or an intention. A wallet that received funds from an exchange does not necessarily belong to the person whose name is on that exchange account. Two wallets that transacted once do not necessarily share a controller. An IP address appearing in two unrelated contexts does not necessarily mean the same person was behind both. We treat every correlation as a lead to be tested, not a conclusion to be reported. A finding is only escalated from observed correlation to a documented conclusion once independent corroboration supports it, and even then the report states the strength of that support explicitly rather than implying certainty that the evidence does not carry.

Every engagement concludes with a structured evidence report, not a narrative summary. The report sets out the timeline of relevant transactions, the wallet and entity relationships identified, the specific source behind each finding, the method used to reach it, and a graded classification of how strongly the evidence supports it. It also records, in writing, what the investigation was unable to establish. A report that omits its own gaps is, in our view, an incomplete report — so unresolved questions are stated as plainly as confirmed ones.

A report that overstates what the evidence shows is more dangerous than one that under-claims, because it can send a client, an adviser or a court down a path the underlying record does not actually support. Evidential integrity — sourcing every finding, disclosing every method, grading every conclusion and recording every gap — is the discipline that keeps our work usable by people who were not in the room when the analysis was done: lawyers, insurers, courts, regulators and clients themselves. That is the standard every case is held to, from the first record collected to the final report delivered.