FOLLOWING DIGITAL FOOTPRINTS Conducting Investigations involving Cryptocurrency

CategoriesACFE By

History is a witness that criminals have always outsmarted law enforcement in adopting newer techniques of committing fraud. It’s nothing new now that criminals have adopted cryptocurrency faster than their general acceptance by the public. Since cryptocurrencies were initially adopted by criminals, they have generally received a bad name in the public perception, overlooking their primary objectives, technology, and advantages, such as decentralisation, transparency (not all cryptocurrencies), and speed.

The investigators, law enforcement personnel and the law itself have to willy-nilly accept this fact and become proactive in their endeavour to conduct meaningful investigations to reach at logical conclusions in their cases.

What is a Cryptocurrency Investigation

A cryptocurrency investigation is the process of tracking, analyzing, and understanding transactions involving digital currencies to uncover illegal activities such as fraud, money laundering, or scams. More often than not, these investigations involve both technical aspects like blockchain analysis and HUMINT processes like identifying suspects on the ground and legal procedures. The goal is to trace the flow of funds, identify the people or entities behind suspicious transactions, and bring them to justice.

Understanding Blockchain

Blockchain is the technology on which Cryptocurrencies run. In general, the two terms Blockchain and Crypto are interchangeably used which is factually incorrect as not all cryptocurrencies use Blockchain technology and the use of Blockchain technology is not limited to Cryptocurrency only. However, since most cryptocurrencies run on a blockchain that is visible to everyone and each transaction is recorded with a unique transaction ID, hence, it is possible to trace the transactions using open-source data. The transparency in crypto transactions makes it possible to trace funds from one wallet to another.

Wallet Tracing

Each user has a wallet address, which acts like a bank account. Investigators analyze wallet activity using blockchain explorers (e.g., Blockchain.com for Bitcoin, Etherscan for Ethereum). These tools show where money came from and where it went. Although these wallet addresses are visible to everyone (the public), the persons behind these wallet addresses are not. To identify a person behind a wallet an investigator needs to connect the address with a real-world entity like an exchange.

Using Forensic Tools

Professional tools like Chainalysis, TRM Labs, and Elliptic help investigators by linking wallet addresses to real-world entities (e.g., exchanges), detecting patterns of fraud and creating visual charts to explain the flow of Crypto.

Criminals try to hide their tracks using mixers (services that blend funds) or converting crypto between different coins (called chain hopping). They also split funds into multiple smaller wallets called peeling. Trained investigators look for these techniques and trace the paths despite the complexity. Here the speed of investigation is paramount since some crypto like Monero and Zcash do not leave behind transaction chains due to their privacy protocol and once any coin gets converted to Monero the chain goes off the radar. That’s why these are the preferred cryptocurrencies on the DarkNet.

Exchange Cooperation

Once an exchange behind a suspected wallet address is identified then it can be approached through enforcement authorities to obtain the KYC data of the person associated with that wallet address. In India at least, each exchange must maintain a KYC data record and the same can be obtained through the Financial Intelligence Unit – India (FIU-IND) which is the enforcement authority for all the Cryptocurrency exchanges operating in the country.

Centralised Exchanges (CEX), which keep the client’s funds in their wallet, generally follow all the norms imposed by the authorities but the Decentralised Exchanges (DEX), which do not keep funds in their wallet, mostly do not follow such norms and are preferred by the fraudsters. However, due to some inherent limitations with DEX like low volume of sale/purchase of crypto and conversation of crypto to fiat (Rupees) they too sometimes use CEX and that’s where an eye for details of an investigator comes into play.

Even some CEX in other countries, like WazirCrypto of Dubai, have lax KYC norms and are widely regarded as the means of money laundering for shell companies and fraudsters. These pose significant challenges to the investigators when the cryptos are routed through such exchanges by the fraudsters where either very little or no cooperation is available due to geographies, jurisdictions and lax norms.

Criminals exploit this fact and bypass these regulations by the use of fake Aadhar cards and fake KYC kits. As an investigator, therefore, it’s imperative not only to obtain the KYC data but also to study its related metadata like the IP, exchange logs, etc. from where these wallets have been created/operated. Such related data helps in homing down to some real-world geographic location where the HUMINT sources can be activated.

The good luck charm for an investigator is when some fraudster converts its crypto into fiat (Rupees) and deposits the same in some bank account in India. Although that bank account would most probably be a mule but can provide a significant lead for further deep dive.

Legal Processes and Asset Seizure

After collecting evidence, investigators may approach a court to freeze or seize digital assets. Cooperation from exchanges and proper documentation is critical and so is the fact that every investigator must blend the traditional with the contemporary techniques of identifying the fraudsters. It demands both quick actions and patience from an investigator as and when either of the two is required given the situation. Local Police cooperation is then invariable required for local intelligence gathering, subsequent raids and follow-up legal processes.

The ED investigates crimes related to cryptocurrency under the PMLA (Prevention of Money Laundering Act) and FEMA (Foreign Exchange Management Act). The IT department tracks and penalizes tax evasion involving crypto profits, while the RBI does not recognize crypto as legal tender but it does not ban it. It advises caution and promotes compliance through FIU (Financial Intelligence Unit) oversight and KYC/AML requirements for exchanges.

Conclusion

Cryptocurrency investigations require a mix of technical know-how, legal awareness, and investigative instincts. For trainee investigators, this field offers both challenges and exciting opportunities. As crypto adoption grows, so does the need for skilled professionals who can trace transactions, uncover fraud, and bring wrongdoers to justice. Understanding the basics is the first step toward becoming an effective crypto investigator. Stay curious. Stay ethical.

Cheat Sheet for the Investigators in a Rush

Tools & Websites

  1. Free Public Blockchain Explorers. These allow input of a wallet address or transaction hash and view where funds came from and where they went while tracking time, value, and transaction ID (TXID): –
  1. Paid Blockchain Forensic Tools.

Used by professionals and law enforcement, the under-mentioned tools link wallet addresses to real-world identities and flag criminal activity: –

  • Chainalysis Reactor.                Visualizes money flow and links addresses to darknet markets, scams, etc.
  • Elliptic. Tracks financial crime risk related to crypto and is used for AML compliance and risk scoring.
  • TRM Labs.       Real-time risk detection and crypto forensics and is generally used by financial institutions and regulators.
  • CipherTrace (by Mastercard). Tracks crypto across hundreds of assets and connects to KYC data.
  • Crystal Intelligence.    Visualization tool for tracing.
  1. Databases of Known Malicious Wallets
  • Bitcoin/Chain Abuse Database – com
  • CryptoScamDB – org
  • AMLBot – Provides wallet risk scoring (some free tools are available).
  1. Supplementary Tools

Note: – The above list is not exhaustive.

Techniques for Tracing Funds

  1. Transaction Mapping
  • Map the flow of funds from source to destination.
  • Check for patterns like peeling (splitting into many smaller wallets), chain hopping (moving from one crypto to another), or the use of mixers/tumblers.
  1. Cluster Analysis
  • Detect groups of wallets that are controlled by the same entity by analyzing transaction patterns and timing.
  1. Exchange Identification
  • Identify when crypto is sent to or from a known centralized exchange (CEX).
  • Centralized exchanges often require KYC, and the investigator can ask enforcement authorities for identity verification from the exchange.
  1. Darknet Monitoring
  • Tools like Chainalysis & TRM can flag addresses connected to ransomware groups, darknet markets, or illegal financial flows.
  1. Taint Analysis
  • Measures how much of the cryptocurrency in a given wallet came from illicit or high-risk sources.
  1. Hard Reminders
  • A wallet address is NOT an identity. Investigator needs additional metadata (IP, KYC, exchange logs) to link a wallet to a real-world person.
  • Privacy coins (e.g., Monero, Zcash) are extremely hard to trace due to encrypted transactions.
  • Speed matters: Once funds are moved through mixers or exchanged into privacy coins, they may become untraceable.

About the Author

Lt Col Vivek Gupta (Veteran), PCI, CFE, IIM-K alumni, is currently serving as Associate Director (Forensic Investigations) at Netrika Consulting. He has over 24 years of rich, cross-functional experience shaped by a distinguished tenure in Army Intelligence and corporate leadership. A results-driven professional, he thrives at the intersection of strategy, risk management, security, and compliance.

He can be reached at www.linkedin.com/in/vivekguptapcicfeiim