How an Investigation Ends
Some investigations close, some become monitoring, and some leave the chain entirely. Unsolved often means the answer sits in records only an institution or legal process can reach.
People often expect an investigation to end when the money is found.
That is not how serious work usually ends. A public record can reveal a route, establish a technical event, or identify a point where a further institution holds the answer. None of those outcomes automatically identifies a person, recovers funds, or produces a legal result.
The ending needs to be named honestly. It tells the client what has been established, what remains open, and who must act next.
Three useful endings
The first ending is delivered. The investigation has produced a package that another person or institution can use: a documented record, its evidence tiers, its boundaries, and the next question to put to the relevant party.
The second is monitoring. The public record may still be live, and a future event could become material. Monitoring is not an excuse to keep a case open forever. It is a defined decision that a specific public record remains relevant while the underlying question is unresolved.
The third is off-chain. The public trail reaches an institution, system, or event where the decisive record is not public. An exchange may know which account was credited. A platform may hold access records. A legal process may be needed to compel disclosure. The on-chain work has reached its boundary.
Off-chain is not failure
Calling an investigation unsolved can make it sound as though nothing useful happened. That is often wrong.
If the public record establishes the route to a private institution, names the evidence gap, and prepares the next lawful request, it has done exactly what public-record analysis can do. The handover is not a failure. It is the point at which a different authority or dataset becomes necessary.
When a Crypto Theft Is Bigger Than One Transaction makes this boundary clear at exchange infrastructure. The chain can show where funds arrived. It cannot reveal the internal account record that an exchange holds privately.
A clean handover is part of the result
A proper handover should state the observed record, the interpretations that remain bounded, the unresolved questions, and the record or authority needed next. It should not hide the gap behind a confident ending.
This is where Evidence Tiers becomes operational. The report tells the next reader what is proven, what is consistent with the public record, and what requires off-chain evidence. That makes it usable by the person who has the power to take the next step.
Closure is not the same as prosecution
An on-chain finding is not a prosecution outcome. A tracing result is not an arrest. A completed report is not recovered money. Those distinctions matter because they prevent clients from being promised something the evidence cannot deliver.
The valuable ending is one that leaves no ambiguity about the current position: this is what the record establishes, this is what it does not, and this is the next lawful route if more must be known.