In my case, if I need to dig into a fraud, everything is quite simple:
1. Map the timeline of the events and collect available evidence (mainly addresses!).
2. Inspect the addresses in wallet explorers (too many of them to mention just one) or multi-blockchain explorers (e.g. ORS CryptoHound).
3. Check from open sources to whom the original and related addresses belong; try to identify persons and fill in other gaps in the timeline.
Do you have another approach? Share it here if yes.
