Most guidance about crypto tracing explains how tracing works. That is useful once you are doing it yourself. It is not what you need at the moment you have a wallet address, a deadline and a decision about who to pay.
This is the other article. What to ask, what the answers mean, and where the money actually goes.
First, decide which of three things you are buying
The market sells three products under similar words, and picking the wrong one is the most common and most expensive mistake.
Software. A subscription to a tracing and screening platform. You operate it. Good when tracing is a recurring part of your work, when you have someone who can run it, and when the typical question is narrow: is this address risky, where did this deposit come from.
An engagement. You hand over a case and receive a report. Good when the question is one-off, when it has to stand up outside the company, or when nobody internally has the hours. Priced per case.
A retainer. Capacity reserved, usually for firms with recurring incidents.
The failure pattern is buying a platform licence to answer four questions a year, then discovering that operating it well is itself a skill. The reverse failure is commissioning an engagement for something a screening API answers in a second.
Before any demo, write down how many times last year you needed this and what the question was. That single sentence usually decides it.
The question that matters most: how do they attribute?
Everything in a tracing report rests on one claim: these addresses belong to this actor. Every conclusion downstream inherits that step's quality, and it is the step providers explain least willingly.
Ask for a specific grouping and the basis for it. You are listening for the difference between behavioural inference (spend patterns, change outputs, funding relationships, timing) and a proprietary label from a dataset nobody outside the vendor can inspect. Both are legitimate. They carry different weight, and a provider who cannot tell you which one they are relying on for a given cluster is one you should not be relying on either.
Two follow-ups are worth the time:
- What is your false positive posture? A provider who has never had one is not being straight with you.
- If I challenge a specific attribution, what happens? The good answer involves a person re-examining it. The bad answer involves a support ticket.
Judging the deliverable before you buy it
Ask for a redacted sample report. A provider who will not show one is telling you something.
What you want to see:
Claims tied to transactions. Every assertion should carry the hashes it rests on. A narrative with a diagram and no transaction references is not evidence, it is an opinion with good design.
Stated confidence. Serious tracing distinguishes what is certain from what is probable. Mixers are the test case. Nobody can tell you with certainty what came out of a mixer. A provider who says they can is selling you a problem you will meet later, in front of someone less forgiving than you.
Methodology, not just output. Enough that another competent analyst could follow the same path. This is what makes a report defensible rather than merely convincing.
A clear stopping point. Where the trail ended and why. Off-ramp reached, jurisdiction exhausted, budget spent. Reports that quietly trail off are hiding the answer to a question you will be asked.
Coverage, and the question behind the question
Everyone advertises a chain count. It is close to meaningless on its own. Funds rarely sit still on one chain, so what you actually need to know is what happens at the boundaries.
Ask: when value crosses a bridge, does your trail continue, and on what basis do you match the two sides? Bridges are where most traces quietly break, and where a provider's real depth shows. The same applies to swaps through protocols rather than venues, and to chains with privacy features, where the honest answer is a limitation rather than a capability.
The part people forget: jurisdiction and data handling
You are about to send a third party a set of addresses and often a set of names. That is a processing activity, and if you are in Europe it is a GDPR one.
Establish where the analysis happens, where the data rests, who subprocesses, and what happens to the case file afterwards. For regulated entities this is not a formality. It is the question your own supervisor will ask when they see the invoice, and it is a reasonable filter to apply early because it eliminates a surprising share of the market quickly.
The tools versus people question
Tooling has become genuinely good at breadth: screening an address, scoring exposure, mapping a first-order neighbourhood. If that is the question, buy software and stop reading.
People still matter for three things. Ambiguity, where the chain offers two readings and someone has to judge which is supportable. Off-chain correlation, where the answer is not on the ledger and has to come from records, filings and open sources. And accountability, where a named analyst stands behind a conclusion, which no tool provides.
Most real cases need both, which is why the useful question at a demo is not "do you have a tool or a team" but "who is accountable for the conclusion in the report".
A checklist you can take into a call
- How many times did we need this last year, and what was the question?
- Show me a redacted report. Are claims tied to hashes?
- How do you attribute, and can you walk me through one specific cluster?
- What do you do at bridges?
- How do you express uncertainty around mixers?
- Where does our data live, who processes it, what happens to it afterwards?
- Who is accountable for the conclusion, and will they defend it if challenged?
- What does the trail stopping look like, and do you say so plainly?
The providers worth your money answer all of these without friction. The ones who get uncomfortable around attribution and uncertainty are the ones whose reports tend to fall apart at exactly the moment you needed them to hold.
We run crypto investigations on this basis, which is not a neutral position, but the checklist stands on its own and works just as well against us as against anyone else.