Blockchain Forensics: Tracing Crypto Fraud Without the Sales Pitch

A stolen balance does not disappear from the blockchain. It moves, and every move is written into a public ledger that anyone can read and nobody can rewrite. That single property is what makes cryptocurrency fraud one of the few financial crimes with a permanent, timestamped, tamper-evident audit trail from the victim's wallet to the moment the funds were cashed out. It is also why so much of what is sold as recovery is theatre: the ledger was never the hard part. Attribution is the hard part, and attribution is what decides whether funds are frozen, seized or lost.

This guide is about forensic work rather than promises. It covers what on-chain analysis can actually establish, where the heuristics break, which legal instruments force a regulated intermediary to hand over identity data, what a report must contain to be worth anything in a courtroom, and how to decide when further tracing stops being worth the fee. If you are reading this because funds have already gone, the practical order of operations is in the section on the first seventy-two hours - start there. If you are reading it before an incident, the sections on evidence preservation and on how recovery fraud works will save you more money than any tracing engagement.

What blockchain forensics can and cannot establish

A public chain records four things about every transfer: the sending address, the receiving address, the amount, and the block in which the transaction was included. From those four facts an analyst can build a complete graph of value movement, and can prove the graph is complete for the addresses it covers, because the ledger is append-only and every node holds a copy. What the ledger does not record is who controls an address. There is no name field. Identity has to be inferred, and every inference is probabilistic.

So the honest description of the discipline is this: transaction flow is a matter of fact, address ownership is a matter of inference, and the strength of a case depends entirely on how much independent evidence supports the second inference. An analyst who tells you an address belongs to a specific person on the strength of a cluster label alone has told you what a vendor's heuristic guessed, not what a court will accept.

The two ledger models, and why the model changes the technique

Bitcoin and its forks use an unspent-transaction-output model. Value sits in discrete outputs, and a transaction consumes whole outputs and creates new ones, with change returning to the sender. That structure supports a powerful inference: if several outputs are consumed together as inputs to one transaction, one entity must have controlled all of them, because the private keys were needed. This is common-input-ownership, the oldest and most reliable clustering heuristic on UTXO chains.

Ethereum and other account-based chains work differently. Each address has a balance, contracts execute against shared state, and one transaction can touch dozens of addresses through internal calls that never appear as a top-level input. Common-input clustering has no equivalent, so attribution leans on deposit-address reuse at exchanges, gas funding patterns, and the behaviour of tokens and non-fungible assets. An analyst who applies UTXO reasoning to an EVM chain will produce plausible-looking clusters that mean nothing.

The practical consequence for a victim is that the same fraud produces very different evidence depending on the asset. A bitcoin payment through a single consolidation gives you a defensible ownership inference in a few hours. An equivalent stablecoin payment routed through a bridge and two swap contracts may take days and still end at an address nobody can name. Stablecoins now carry the overwhelming majority of illicit volume - 84% of it in Chainalysis's 2026 reading - and they are also the easiest to freeze, because the issuer can blacklist an address at the token contract level. That combination, easy to move and easy to freeze, is why the first request to make is almost never to a tracing firm.

The 2026 numbers, and what they do not say

Chainalysis's 2026 Crypto Crime Report estimates that illicit addresses received at least USD 154 billion in 2025, a 162% year-over-year increase, of which USD 104 billion went to sanctioned entities after a 694% jump in that category. Scams alone received at least USD 14 billion on-chain in 2025, against USD 9.9 billion first reported for 2024 and since recalculated to about USD 12 billion, with the 2025 figure projected to exceed USD 17 billion as more addresses are identified. The same report is careful to say that illicit activity remains under 1% of attributed transaction volume.

The FBI's 2025 Internet Crime Report gives the victim-side view: 1,008,597 complaints and USD 20.877 billion in reported losses, a 26% increase, of which complaints with a cryptocurrency nexus accounted for 181,565 complaints and USD 11.366 billion, an average reported loss of USD 62,604 and 18,589 complainants above USD 100,000. Cryptocurrency investment fraud specifically was reported 61,559 times for USD 7.228 billion, up 48% in complaint volume and 25% in losses.

Four caveats belong next to those figures, and a report that omits them is marketing. First, both organisations describe their totals as lower bounds tied to the addresses or complaints identified so far, not as a census. Second, the two figures are not the same quantity: one counts on-chain value received by addresses the vendor has classified, the other counts dollars that self-selected victims reported, and double counting across chains and intermediaries is unresolved. Third, a 162% increase driven by sanctions evasion says something about state actors and very little about the ordinary business that gets defrauded by an invoice-fraud email. Fourth, none of it tells you whether any particular case is traceable, because that depends on the path the money took, not on the size of the market.

The four questions a tracing engagement has to answer

Every useful piece of crypto forensic work reduces to four questions, and a proposal that does not address all four is a data subscription rather than an investigation.

Where did the value go? The transaction graph, with each hop timestamped, valued at the time of transfer, and annotated with the contract or protocol involved. This is the part software does well and the part that is almost always reproducible by anyone with the addresses.

Who controls the addresses at the end of the path? This is attribution, and it comes from three sources that must be triangulated: clustering, the counterparty's own records, and off-chain evidence such as messages, platform accounts and payment instructions. Two of three is an allegation, three of three is a case.

Which regulated intermediary can be compelled to identify a customer? The path only becomes a case at the point where it touches a regulated entity - an exchange, a custodian, a payment processor, a token issuer with a blacklist function. That is where identity exists, and where a court order or a subpoena has something to bite on.

What is the evidence worth? A report that cannot be reproduced by an opposing expert, or whose methodology is not disclosed, is worth less than nothing because it invites a challenge that discredits the rest of the file. Reproducibility is not a formality; it is the asset.

Clustering heuristics and their failure modes

Common-input ownership is strong on UTXO chains and has three well-known failure modes. CoinJoin and similar collaborative transactions deliberately consume inputs from unrelated parties, so the heuristic merges innocent wallets into one cluster. Exchange withdrawals that are batched into a single transaction produce the same false merge. And a custodian that sweeps thousands of customer deposits into one transaction makes every depositor look like one entity. Any vendor cluster that contains a known exchange hot wallet should be read as infrastructure, not as a person.

Change-address detection is the second workhorse: after spending an output, one of the new outputs is usually change returning to the sender. Analysts infer which one from script type, address reuse, round-number payment amounts, and the position of outputs in the transaction. It works often and fails reliably against wallets that use fresh addresses, randomize output order, or deliberately construct decoy change. A single wrong change guess moves the entire downstream path onto a different branch, which is why good reports show the alternative branch and say why it was rejected.

Address reuse and deposit-address clustering matter more than either, because they connect the chain to a business. A service that shows every customer the same deposit address has published a link between all of its customers. An exchange that issues permanent deposit addresses for each user hands an analyst a mapping from address to account the moment one transaction is tied to a known customer. This is also why the EU travel rule, in force since 30 December 2024 under Regulation (EU) 2023/1113, changes the forensic picture: transfers between crypto-asset service providers must now carry originator and beneficiary data, so the regulated segment of a path is documented by the intermediary rather than inferred from the chain.

The laundering techniques that break tracing are not exotic. Peel chains - moving small amounts through a long series of addresses, each time forwarding the remainder - defeat naive path-following because there is no single destination. Bridges move value between chains and produce a legitimate-looking deposit on the other side, and the link between the two legs exists only in the bridge's own records. Instant exchangers and no-KYC swap services are the standard exit, because they convert to a different asset with no customer record at the boundary. Mixers and privacy pools remain available despite sanctions and prosecutions; the effect is not invisibility but a break in continuity that requires the receiving intermediary to cooperate.

The chain is never the whole case

On-chain data tells you where value went. It rarely tells you who did it, and it never explains the fraud itself. The cases that get solved are solved by combining the ledger with off-chain artefacts that the victim usually already holds or can still capture.

The most valuable items, in rough order of usefulness: the original contact channel with full headers or platform identifiers; the fake platform's domain registration and hosting history; the payment instructions, including any bank account or payment-processor reference that accompanied the crypto address; the messaging history that contains the social-engineering script; screenshots with visible timestamps rather than cropped images; and the victim's own account records showing the fiat-to-crypto on-ramp, which is where a regulated exchange collected identity documents on the victim's counterparty too if it was the same platform.

Two of those are routinely destroyed by well-meaning victims. Chat applications that offer end-to-end encryption and disappearing messages delete the script on a timer, and reinstalling an app or moving to a new phone loses it permanently. Domain records change hands quickly once a scam site is reported. The instruction that follows from this is unglamorous and important: preserve before you investigate. Export the conversation, photograph the screen with a second device if export is unavailable, note the exact time and timezone, and stop using the compromised device for anything connected to the case.

The first seventy-two hours: what to do before you hire anyone

Almost everything that decides the outcome of a crypto fraud happens before an analyst is involved. The window between the transfer and the moment the funds reach a custodian is measured in hours, and the victim is the only person who can act inside it. The order below is deliberate: preservation first, because evidence decays; containment second, because a compromised key keeps draining; notification third, because a freeze is only possible while the money is still somewhere it can be frozen.

Stop the bleeding. If the loss came from a compromised seed phrase, a malicious approval, or malware on a device, the thief still has access. Create a new wallet on a clean device, generate the seed phrase offline, and move whatever remains. Do not reuse the compromised seed phrase for the new wallet even if the balance is zero, and do not type the old phrase into any website that offers to check it. On EVM chains, revoke token approvals from a known revoke tool rather than trusting a link sent to you, because approval-phishing kits are the most common way a second drain happens after the first.

Preserve, do not tidy. Export the chat history from the platform where the contact started, and if the platform does not offer an export, photograph the screen with a second device so that the timestamps are in frame. Save the original emails with full headers rather than forwarding them. Screenshot the fraudulent dashboard, the deposit address it displayed, and the transaction on a public block explorer showing the transaction hash, block height, amount and counterparty address. Write down the exact local time and timezone of each payment, because a report that says around lunchtime cannot be reconciled with block timestamps.

Do not touch the fraudster. Victims frequently message the account after discovering the fraud, which alerts the operator to move the funds and gives them a chance to delete the conversation. If contact is needed, it should happen once a preservation copy exists, and preferably on the instruction of the lawyer or the police officer handling the case.

Report where the report can do something. In England and Wales that is Action Fraud plus the receiving bank; in the United States, the FBI's IC3 plus the local field office for losses above the local threshold; in Italy, the Polizia Postale or the Carabinieri unit for telematic crime, through a formal complaint that a prosecutor can act on. A police report is not paperwork in this field: a stablecoin issuer and an exchange compliance team will generally act only on a law-enforcement request, so the report is the instrument that unlocks the freeze, and the case number is what you quote in every subsequent letter.

Notify the intermediary, in writing. Send the transaction hash, the deposit address, the amount, the time and the police case number to the compliance or law-enforcement-request channel of the exchange or issuer that holds the funds. Not customer support. Do not expect a reply that confirms anything: anti-money-laundering rules limit what an intermediary may tell you about another person's account, so silence is normal and is not evidence that nothing happened.

Freezing at the issuer is the cheapest move available

Stablecoins carry the overwhelming majority of illicit volume, and they share a property that no other asset class in this field has: a known issuer with the technical ability to block an address at the token contract level. A centralized stablecoin is, in effect, a redeemable claim on a company, recorded in a contract that the company controls. When that company blacklists an address, the tokens in it can no longer move.

That one fact changes the order of operations. The first call is not to a tracing firm; it is to the police and then to the issuer's compliance channel, because a freeze preserves the asset while everything else is argued about. It also changes what a tracing engagement is for: not chasing funds that are already gone, but producing the evidence that identifies which address to freeze and whose order will release it.

Two limits matter. A freeze is not a recovery - the funds sit in a blocked address until a court or a prosecutor directs what happens to them, and that can take months. And the issuer will act on documented law-enforcement process, not on a persuasive email from a victim, so the practical work of the first week is assembling a package a police officer can forward without rewriting it. A one-page chronology, the transaction hashes, the wallet addresses, the platform screenshots and the bank records of the on-ramp are enough to start; a forty-page narrative is not more persuasive, it is slower to read.

The same logic applies one layer down at exchanges. A deposit into a regulated exchange creates a customer record, and the exchange can hold the deposit while it verifies. The operational reality is that the window is short: illicit funds are typically moved off a first deposit address within minutes to hours, and a compliance team that receives a request three weeks later may find the account emptied, closed, or never opened in the name of anyone the exchange can identify.

What the law actually lets you compel

No amount of analytics forces a regulated intermediary to disclose a customer's identity. Only legal process does, and the shape of that process depends on where the intermediary is, where the victim is, and whether the case is criminal or civil.

England and Wales. The route that has worked since 2019 is a civil claim against persons unknown for a proprietary injunction over the traced assets, coupled with a disclosure order against the exchanges that hold them. In AA v Persons Unknown [2019] EWHC 3556 (Comm) the court treated bitcoin as property capable of being the subject of a proprietary injunction, which is what allows a victim to assert an ownership claim over specific coins rather than a bare money claim against an unidentified defendant. The Property (Digital Assets etc) Act 2025, which received Royal Assent on 2 December 2025 and came into force the same day, removed the residual classification argument by providing that a thing is not prevented from being the object of personal property rights merely because it is neither a thing in possession nor a thing in action. The Act does not create the new asset class by itself; it leaves the courts to define the boundaries of the third category, so the case law still matters and the pleading still has to be right.

The United States. Civil subpoenas to a US-regulated exchange, and applications under 28 U.S.C. section 1782 for evidence located in the US for use in a foreign proceeding, are the two instruments most often used. Criminal referral through the FBI or a US Attorney's office is slower but carries the asset-forfeiture machinery, which is ultimately how seized crypto is returned to victims in most large cases.

The European Union. Regulation (EU) 2023/1113, applicable since 30 December 2024, requires crypto-asset service providers to accompany transfers with originator and beneficiary information and to apply enhanced checks to transfers involving self-hosted addresses above a threshold. For a victim this matters indirectly but powerfully: the regulated leg of a transfer chain is now documented by the intermediary at the time of transfer rather than reconstructed afterwards, so a disclosure order has a better chance of returning something specific. Cross-border requests still travel through mutual legal assistance or a European investigation order, and that is where the months go.

Italy. The criminal route runs through the prosecutor and the polizia giudiziaria, with preventive and probative seizure of the wallet or of the claim against the intermediary, and the possibility of entity liability under Legislative Decree 231/2001 where the fraud was carried out through an organised structure. The civil route runs through a claim for restitution and damages, with a freezing order where the defendant or the asset can be located.

In every jurisdiction the sequencing is the same: identify the address, find the intermediary, obtain an order that the intermediary must answer, and only then expect a name. A tracing report that stops before the intermediary is a map without a destination.

Where tracing actually stops

Traceability is not a property of the asset; it is a property of the path. Four structures end a trace, and a proposal that does not name them is either optimistic or inexperienced.

Bridges. A lock-and-mint bridge takes value on one chain, locks it, and issues a representation on another. The two legs are linked only in the bridge operator's own records, so unless that operator is regulated, cooperative, or compromised, the graph has a hole in it. Analysts can sometimes re-link the legs through amount and timing correlation, which is an inference and should be labelled as one.

Instant exchangers and no-KYC swaps. These are the standard exit for small and mid-sized fraud. There is no customer record to disclose, the deposit address is used once, and the output goes to a wallet the operator controls. What survives is the operator's own logs, obtainable only if the operator is in a jurisdiction that will act and is still trading.

Peel chains. Long series of small forwards, each paying a fresh address and passing the remainder on. There is no terminal destination to freeze, so the value of the analysis shifts from finding an endpoint to characterising the actor's infrastructure - useful for linking cases, much less useful for recovering money.

Cash-out into an unregulated venue. Gambling sites, over-the-counter desks, peer-to-peer brokers and mining pools all convert crypto into something else while holding a record that is either weak or offshore. When a path lands in one of these, the honest answer is that the trace has produced intelligence rather than a recovery prospect.

The practical stop rule is economic. Every additional hop, chain and jurisdiction adds cost, and the marginal prospect of recovery falls faster than the cost rises. A competent engagement states at the outset what it will do when the trace reaches a hole: report the hole, name the operator, and stop, rather than bill for another month of speculative clustering.

Mixers, sanctions and the legal weather after Tornado Cash

Mixing is the technique most associated with untraceability, and the one most distorted by headlines. A mixer pools deposits from many users and pays out from a shared pool, which breaks the one-to-one link between deposit and withdrawal. Continuity is not destroyed - it is obscured, and obscuring it depends on the pool being large and the withdrawals being well timed.

The legal picture around the best-known example changed twice in eighteen months. The US Treasury's Office of Foreign Assets Control designated Tornado Cash in August 2022. On 26 November 2024 the Fifth Circuit held, in Van Loon v. Department of the Treasury, that the immutable smart contracts at the core of the service were not the property of a foreign national or entity and could not be blocked under the International Emergency Economic Powers Act - a ruling about the limits of the statute rather than about the merits of mixing. OFAC removed Tornado Cash from the SDN list on 21 March 2025 while stating that it had exercised its discretion rather than conceded the point, and at least one developer remained designated.

For a victim or an investigator the lesson is narrower than the coverage suggested. A delisting is not a finding that mixed funds are clean, and it is not a compliance safe harbour: an exchange's risk-scoring system will still treat a direct interaction with a mixing pool as a red flag, and an incoming transfer from one is a routine reason for a deposit to be held. Equally, a vendor's sanctioned label attached to an address is a data product's opinion, not a legal determination, and a report that presents it as one invites exactly the challenge that discredits the rest of the file.

Valuing the claim: what the number in the report means

Crypto losses are easy to overstate and hard to prove. Three figures are usually in play, and they are not interchangeable: the amount transferred at the time of transfer, the value of the same tokens today, and the value actually recoverable after costs.

In a proprietary claim the asset is the thing claimed, so if the traced tokens are recovered in kind the claimant receives the tokens, whatever they are worth by then. In a claim for damages the measure is usually the value at the date of loss, subject to argument about mitigation and about the date of assessment the court prefers. When the asset rose after the theft a defendant will argue for the earlier date; when it fell, the claimant will. A report that quotes a single number without saying which of these it is has not helped anybody.

The recoverable value is a different calculation again. Legal costs in a multi-jurisdiction proprietary claim routinely exceed the value of a mid-sized loss, and a claim against an entity that is insolvent or dissolved is worth nothing. That is why the first question in a scoping call should be what the claim is worth net of costs if it works, and why a firm that answers honestly will sometimes advise against an engagement.

Recovery fraud: the second theft

The most reliable predictor of a follow-up fraud is the first fraud. Lists of victims circulate - sometimes originating from the platform that took the money, sometimes from data sold on by a call centre that handled the complaint. The pitch is consistent: a blockchain recovery specialist, often with a plausible website, a profile with stolen credentials, and a case reference that matches the victim's own report.

The mechanics are predictable. An upfront trace fee or court filing fee. Then a demand for a gas fee or unlock fee to release funds that have supposedly been located. Then a tax clearance or anti-money-laundering certificate required before transfer. Sometimes a fake escrow portal that shows the recovered balance and updates in real time, with a withdrawal button that requires one more payment to activate. Sometimes a forged court order arriving as a PDF on a real court's letterhead.

Four rules are enough to defeat all of it. No legitimate firm can reverse a blockchain transaction, because nobody can. No legitimate firm needs the seed phrase or private key of a wallet holding the claimed funds, and any request for one is the fraud itself. No legitimate firm requires payment to a personal account, a crypto address, or a third-party escrow that is not a regulated agent you selected yourself. And no legitimate firm contacts you first with your case details, because a firm you have not engaged has no lawful way to know them. Recovery fraud is common enough that a second report to the same police unit, quoting the first case number, is expected and useful.

What a forensic report must contain

A tracing report is bought for one of three purposes: to support a court application, to support a police or prosecutor file, or to support a decision about whether to spend money on either. The same document should serve all three, because a report assembled for internal use and then handed to a lawyer is a report that will be attacked for the gaps its first purpose did not require it to fill.

Scope and authority. What was traced, from which starting addresses, for what period, and on whose instructions. If the claimant is not the account holder, the chain of authority should be visible. Anything outside the stated scope should be explicitly excluded rather than silently omitted.

Evidence inventory with hashes. Every file the analysis depends on - exports, screenshots, bank statements, transaction dumps - listed with a hash and a timestamp. For devices, the intake record should say who held the device, when it was imaged, and with what tool. Without that record the opposing expert has an argument about provenance before the substantive analysis is even read.

Methodology and tool versions. Software records address attributions, and attributions change between releases. A report that names the version used, the date the data was pulled and the queries run can be reproduced; one that says the vendor database cannot. Where a heuristic is used, the report should name it and state the failure modes that were considered.

The graph as data, not only as a picture. A screenshot of a colourful cluster diagram is marketing. A table of hops - transaction hash, block height, UTC timestamp, sending address, receiving address, asset, amount, contract or protocol - can be re-derived by anyone with a block explorer, and that is what makes it evidence rather than an illustration.

Attribution separated from fact. The report should state what the ledger proves in one section and what the analyst infers in another, with the basis for each inference graded. Clustering is an inference. A deposit-address match to an exchange is an inference of an account, not of a person. A name in a vendor database is a third party's assertion. Conflating all three into a confident narrative is the most common reason a technically correct report fails in a hearing.

Limitations. What the analysis could not see, what it assumed, and what would change the conclusion. A limitations section does not weaken a report; it forecloses the cross-examination that would otherwise find the gap unannounced.

Exhibits and the expert declaration. Exhibits should be numbered and referenced from the text, and the declaration should state the analyst's qualifications, the instructions received, and - in England and Wales - that the duty is to the court rather than to the party paying. That last sentence is not a formality; it is the difference between an expert and an advocate with a spreadsheet.

Ten questions to ask before you pay a tracing firm

Most of the money lost to bad engagements would have been saved by a fifteen-minute call. These are the questions that separate an investigation from a subscription with a covering letter.

One. Which specific addresses will you analyse, and which chains? A firm that answers with a product name rather than an address list has not read your case. Two. What will you produce at the end - a PDF, a data file, an expert declaration, or a willingness to give evidence? Three. Will the graph be delivered as data with transaction hashes, or only as images? Four. Which parts of your conclusion are inferences, and how are they graded? Five. What do you do when the trace reaches a bridge or a no-KYC exchange? Six. Do you have a route to a lawyer in the jurisdiction where the funds landed, and what does the order you would seek actually require? Seven. Will you speak to the police officer handling the case directly? Eight. What is the fee structure - fixed, per hop, per hour - and what stops the meter? Nine. Have you given evidence before, and in which courts? Ten. What would make you tell me not to proceed?

The answer to the last question is the most informative. A firm that has never advised against an engagement is not filtering; it is selling. In our own work the honest answer is often that a loss below a certain size is better pursued through the police and the issuer freeze process than through a paid trace followed by a civil claim, because the legal costs would consume the recovery.

How an engagement is scoped, and what moves the fee

Three variables drive cost: the number of hops worth following, the number of chains and jurisdictions involved, and whether the output has to withstand adversarial scrutiny. A single payment into a regulated exchange is a short job. The same value routed through two bridges, a mixing service and an over-the-counter desk is a long one, and a firm that quotes the same price for both has not understood the second.

The scope should define the stopping point in advance. Fixed-fee engagements usually cover a stated number of hops or intermediary requests, with a written decision point at the end: continue, litigate, or close. Hourly engagements without a decision point are the ones that produce a large invoice and a graph ending at a wallet nobody can name.

Litigation support changes the shape of the work again. Once a report is going to be served, the methodology has to be documented as it is performed rather than reconstructed afterwards, the tooling has to be reproducible, and the analyst has to be available for cross-examination. That is a different job from an intelligence product, and it should be priced and staffed differently.

The lawful boundary of this work

Blockchain analysis is unusual in that almost everything an investigator needs is public. That is also why the boundary has to be stated explicitly, because the temptation to step over it is constant and the consequences are criminal rather than merely professional.

Authority comes from the asset owner. A tracing engagement should be commissioned by the person or entity that held the funds, or by their lawyer, or by law enforcement. Where a company commissions work on a wallet it does not control - a subsidiary, a client, a family member - the written authority should be in the file before the first query runs.

No access to anyone else's account. Nothing in this discipline requires logging into a third party's exchange account, mailbox or wallet, and doing so is unauthorised access in every jurisdiction that matters, whatever the moral justification. The same applies to social engineering an exchange's support staff into disclosing account details: it is fraud on the intermediary, and it contaminates evidence that could have been obtained lawfully.

No purchased breach data. Commercially available dumps of stolen credentials and personal records are frequently offered to investigators as a shortcut to attribution. Using them creates a data-protection problem, a provenance problem and, in several jurisdictions, a criminal one. Public chain data, the client's own records, lawful disclosure and open-source material are sufficient for the work described here.

Data protection applies to on-chain analysis. An address is pseudonymous, not anonymous, and once it is linked to a person the analysis is processing personal data. In the EU and the UK that means a lawful basis - usually legitimate interests or the establishment of legal claims - plus minimisation, a retention period, and care about what is written into a report about people who turn out to be uninvolved. The fact that the ledger is public does not exempt the processing.

Report, do not confront. The correct destination for attribution evidence is a police file, a prosecutor, or a court. Contacting an identified suspect with a demand, publishing an address with a name attached, or organising a crowd to pressure an exchange are all ways to destroy a case and expose the investigator to liability.

The shape these cases take, and where they usually end

The details differ; the structure repeats often enough to be useful. A victim is contacted on a social platform or through an advert, moves money onto a platform that shows a convincing dashboard, and makes two or three transfers before a withdrawal is refused. The money leaves the platform within minutes of each deposit and passes through a small set of collection wallets that receive payments from dozens of victims before being consolidated into a handful of addresses that are used only for that purpose.

From the consolidation address the value usually goes one of three ways. It may be deposited directly into a regulated exchange account, which is the good case: the identity exists, a freeze request can land in time, and the disclosure order that follows has a named respondent. It may cross a bridge and reappear as a different asset, which is the ordinary case: the trace survives, but only with the bridge operator's cooperation or a well-argued correlation. Or it may go through a long peel chain into a no-KYC swap, which is the case where the honest deliverable is a report that names the infrastructure and supports a police file, not a promise of recovery.

The timing is what distinguishes the outcomes. In cases we see concluded, the freeze request reached the intermediary within days, the victim had preserved the deposit address and the exact transfer times, and the police file was opened before the platform disappeared. In cases that end without recovery, the pattern is equally consistent: the trace started months later, the chat history was already deleted with the platform, and the funds had left the first custodian long before anyone asked it to hold them.

None of this makes the discipline powerless. Public ledgers keep the evidence permanently, and a determined investigation can attribute infrastructure years after a fraud - the enforcement actions against mixing services and the takedowns of scam compounds in Southeast Asia were built substantially on on-chain work. It does mean that the value of analysis is highest at the beginning and that the first week deserves more attention than the first month.

Where the discipline is going

Two regulatory shifts are changing the work rather than ending it. The travel rule under Regulation (EU) 2023/1113 has made the regulated segment of a transfer chain self-documenting, which improves the odds that a disclosure order returns something specific; the same logic is spreading through the jurisdictions that adopted the Financial Action Task Force's Recommendation 16. And the licensing regime for crypto-asset service providers under MiCA means that a service which would once have been an anonymous offshore venue is either authorised, and therefore answerable, or operating unlawfully, which is itself a fact worth putting in a report.

On the analytical side, the trend is towards reproducibility as a requirement rather than a courtesy. Courts have grown used to clustering evidence, and the questions have become more specific: which heuristic, which false positive rate, which competing explanation was excluded. The firms that will still be giving evidence in five years are the ones that can hand over the data behind the picture.

The strategic consequence for a victim is a change of emphasis from tracing to freezing. The trace is the means by which the right address is identified in time; the freeze is what preserves the value; the legal process is what converts a frozen address into money. Viewed that way, the analytic work is urgent, cheap relative to the alternative, and only worth doing in service of an order that somebody can actually enforce.

If funds have already gone

The order of operations is short enough to memorise. Preserve the evidence before touching anything, including the chat history, the deposit address and the transaction hashes. Contain the loss if the key or an approval is compromised. Report to the police in the jurisdiction that can act, and get a case number. Notify the receiving exchange or stablecoin issuer in writing with that case number, because the freeze window is measured in hours and days, not weeks. Then commission analysis, scoped to the question of which intermediary holds the value and what order will make it answer.

If you are reading this before an incident, the useful work is different and cheaper: know which wallets your business controls and who can move funds from them, treat any payment instruction received by message as unverified until it is confirmed on a known number, and keep a copy of every transaction you make so that a chronology exists on day one rather than being rebuilt from memory in month three.

Our digital forensics service covers the tracing and reporting side of this work, and the recovery planning that follows it: digital forensics and blockchain tracing. If the loss involved a fraudulent platform rather than a stolen key, the companion guide on cryptocurrency scam recovery sets out the platform-side evidence to collect, and avoiding hacker-for-hire scams covers the market of people who will offer to get the money back for a fee. For the device side - a phone or laptop that may carry the malware or the session that enabled the theft - see digital forensics for legal cases. If you need an investigator engaged this week, the fastest route is the contact form, with the transaction hash and the police reference if you have one.