Blockchain Forensics: How Crypto Is Traced

Pseudonymous, Not Anonymous

A public blockchain is a shared record that anyone can read. Every transfer is stored as an amount moving between addresses, which are long strings of characters rather than names. That makes the system pseudonymous: the record shows what moved and when, but it does not print who owns an address. Bitcoin's 2008 design paper described this as keeping public keys anonymous while the transactions stay public, like a stock exchange tape that shows the time and size of trades without naming the parties. Blockchain forensics is the work of reading that record to follow funds and, where possible, connect addresses to real parties.

How a Name Gets Attached

Investigators start with what the ledger shows: addresses, amounts and timestamps. A name usually arrives from outside the chain. A common route is an exchange, a company that holds customer accounts and usually collects identity documents when an account is opened, a process known as know-your-customer checks. If stolen or ransom funds are traced to a deposit address at an exchange, the exchange's records can show whose account it was, once a legal request is made. Other routes include an address published online, an address reused many times, or a seized device or account that holds the keys.

A Worked Example: The Colonial Pipeline Ransom

In June 2021 the US Department of Justice announced that it had seized 63.7 bitcoin linked to the DarkSide ransomware group. Colonial Pipeline had told the FBI it paid a ransom demand of approximately 75 bitcoin after a May 2021 attack. According to the supporting affidavit described in the June 2021 release, law enforcement reviewed the Bitcoin public ledger, tracked multiple transfers, and found the 63.7 bitcoin at an address for which the FBI held the private key, the secret that controls an address. The release does not explain how the FBI came to hold that key, so this page does not either.

1. Start from a known address, such as the one a victim paid.
2. Follow each onward transfer, hop by hop, noting where funds are split or merged.
3. Group addresses that appear to be controlled by the same party.
4. Look for a point where the funds reach a service that keeps identity records, then ask that service through legal process.

Grouping and Labelling Addresses

A 2013 academic study, A Fistful of Bitcoins, by researchers at the University of California, San Diego and George Mason University, set out two clustering rules and cites earlier work such as a 2011 analysis by Reid and Harrigan. Its first rule, the common-input heuristic, says that addresses spent together as inputs to one transaction are controlled by the same user. The rule chains: if one transaction spends from addresses A and B and another from B and C, all three are grouped. Bitcoin's 2008 design paper had already noted that multi-input transactions necessarily reveal that their inputs share an owner. In 2013 the authors applied the rule to about 12 million public keys and obtained roughly 5.6 million clusters.

Change Addresses and Peeling Chains

A second rule targets change. When a wallet spends only part of the value at an address, the remainder goes to a fresh change address controlled by the sender, and spotting it links the new balance back to the sender. The 2013 study found this rule riskier: its first version produced 555,348 false positives in 2013, about 13 percent of the change addresses it labelled, where a false positive is an address wrongly labelled as change. Waiting a week before labelling cut the rate to 0.17 percent in that data, yet the authors still found in 2013 that the rule merged services such as Mt. Gox and Silk Road into one cluster of 1.6 million public keys until they ignored certain re-use patterns.

Together the rules make a peeling chain followable. In such a chain a large balance sits at one address and a small amount is sent onwards at each step, with the remainder moving to a new change address, repeated for hundreds or thousands of hops. By following the change address at each hop, the 2013 authors tracked stolen coins until some peels reached exchanges, where, as they noted, an agency with subpoena power could learn whose account received the deposit.

Labels and Cross-Chain Hops

Clusters become useful once they carry labels such as 'exchange', 'mining pool' or 'darknet market'. The 2013 team obtained labels by transacting with services itself: 344 transactions let them tag 1,070 addresses by hand, and the clustering rules extended those tags to far more. Government casework uses attribution too. A November 2020 civil forfeiture complaint in the Silk Road matter said IRS Criminal Investigation used a third-party attribution company to identify 54 previously undetected Silk Road transactions, and the release named Chainalysis and Excygent as assisting. Launderers respond by switching currencies: the 8 February 2022 Justice Department release described 'chain hopping', converting bitcoin into other virtual currencies, as one alleged technique.

Limits and Error Rates

Every clustering rule is a probabilistic inference. Harrigan and Fretter, whose second author worked for the forensics firm Elliptic, wrote that the multi-input heuristic is not true in the general case but is useful in practice, and they attributed its effectiveness over Bitcoin's first seven years to address reuse, avoidable merging, super-clusters with high centrality and the incremental growth of clusters. They also noted that CoinJoin, in which several users combine inputs in one transaction, makes the multi-input rule produce false positives. For their change-address rule, Meiklejohn and colleagues chose caution in 2013: they designed the safest rule they could, accepting a high false-negative rate and that it might need redesign if habits changed.

Other Chains and Privacy Coins

On Ethereum a native transfer has one sender and one receiver, so the common-input rule does not apply in the same way. A 2020 study by Béres and co-authors argued the account model is weaker for privacy than Bitcoin's output model and reported that users tend to use a handful of addresses. It used Ethereum Name Service names as ground truth to compare graph-learning methods with time-of-day activity and fee-setting profiles, and described heuristics linking Tornado Cash deposits to withdrawals in transactions up to April 2020. A 2018 study of Monero data up to early 2017, excluding RingCT inputs, found about 62 percent of inputs with decoys vulnerable to deduction by elimination; the Monero topic covers the current design.

Sanctions and the Policy Fault Line

On 8 August 2022 the US Treasury sanctioned the Tornado Cash mixer, saying it had been used to launder more than 7 billion US dollars since 2019, including over 455 million stolen by the Lazarus Group, and that virtual currency firms should generally treat mixers as high-risk. In Van Loon v. Department of the Treasury, decided on 26 November 2024, the Fifth Circuit held that Tornado Cash's immutable smart contracts were not 'property' that could be blocked under the sanctions statute, because they could not be owned. On 21 March 2025 Treasury said it had removed the economic sanctions, cautioning US persons about dealings that could assist the DPRK or other malicious cyber actors. As of October 2026 that statement is the most recent Treasury document cited here; the Tornado Cash topic covers mechanics and prosecutions.

Legal Process and Evidential Weight

Ledger analysis rarely ends the story; legal process does. In the Colonial Pipeline matter a US magistrate judge authorised the seizure warrant in June 2021, and in the Bitfinex matter agents reached the keys after court-authorised search warrants, according to the February 2022 release. A civil forfeiture complaint, as in the Silk Road matter of November 2020, only alleges that property is subject to forfeiture, and the government must then prove it by a preponderance of the evidence. Forensic output therefore carries different weight at different stages: a lead for investigators, a basis for a warrant, and evidence that a court may test.