Resources Beginner's Guide

Blockchain
Forensics
101

Everything you need to understand how cryptocurrency can be traced, what blockchain forensics actually is, how the process works in practice, and what it means for your situation - explained from the ground up.

8 Chapters
~20 min read
No prior knowledge needed
Chapter 01

What is a Blockchain?

Before understanding how cryptocurrency can be traced, it helps to understand what a blockchain actually is - and why its fundamental design makes tracing possible in the first place.

A blockchain is a public, shared database that records transactions in a permanent, ordered sequence. Think of it as a giant ledger - but instead of being held by one bank or company, thousands of computers around the world each hold an identical copy of it, and new entries can only be added when the majority of those computers agree.

Each "block" in the chain contains a batch of recent transactions and a mathematical reference to the block before it. This linking is what makes the chain tamper-proof: changing one block would break the mathematical reference, and every copy of the ledger around the world would reject the change.

The key insight: Every transaction ever made on a public blockchain is permanently recorded, publicly visible, and impossible to alter. This is the foundation that makes blockchain forensics possible - the data cannot be deleted or hidden.
Block 841,203
TX: 3FZb → 1BvB · 0.45 BTC
TX: 1A1z → bc1q · 2.10 BTC
Hash: 0000000000000000003a...
Block 841,204
TX: bc1q → 1Hbc · 1.20 BTC
TX: 3J98 → 14qV · 0.33 BTC
Hash: 0000000000000000001f...
Block 841,205
TX: 14qV → 3NPp · 0.33 BTC
TX: 1Hbc → TRx9 · 1.19 BTC
Hash: 0000000000000000002c...
Each block links to the one before it - creating an unbreakable chain of transaction history

The key difference between a blockchain and a traditional bank database is transparency. When you make a bank transfer, that record is private - only you, the bank, and the recipient know about it. When you send Bitcoin, that transaction is broadcast to thousands of computers worldwide, verified, and written permanently into the public record. Anyone, anywhere, can look it up.

"The blockchain does not forget. Every satoshi ever moved is still traceable - the question is only whether you have the expertise to follow the trail."
Chapter 02

What is Blockchain Forensics?

Blockchain forensics is the discipline of reading the public blockchain record in a structured, methodical way - to trace the movement of funds, identify who controlled them, and produce findings that hold up in legal proceedings.

The term "forensics" comes from the Latin forensis - meaning "of the forum," referring to public legal proceedings. In the traditional sense, digital forensics means recovering and analysing data from computers in a legally defensible way. Blockchain forensics applies the same rigour to the on-chain record.

What it involves

  • Following transaction paths through multiple wallets
  • Identifying which addresses belong to the same entity
  • Recognising known exchanges and services
  • Detecting mixing and obfuscation attempts
  • Building legally defensible evidence packages

Who uses it

  • Law enforcement investigating crypto crime
  • Fraud victims seeking to recover funds
  • Lawyers preparing evidence for court
  • Exchanges monitoring suspicious activity
  • Regulators assessing compliance

Blockchain forensics is not the same as hacking or gaining access to private information. Everything used in blockchain forensics - the transaction records, the wallet balances, the transfer history - is already publicly available on the blockchain. What forensics provides is the expertise to interpret it: the tools, the databases, and the analytical methods to turn raw public data into structured, meaningful evidence.

An analogy: If transactions are telephone calls, the blockchain is the public phone book showing that a call was made from number A to number B at 3pm. Blockchain forensics is the investigator who uses that phone book - combined with other records - to build a picture of who was really behind those numbers.
Chapter 03

How Transactions Are Traced

Tracing a cryptocurrency transaction means following the path money took - from the wallet it started in, through every intermediate step, to where it ultimately ended up. Here is how that process works in practice.

Step 1: The Seed Transaction

Every trace starts with a seed transaction - the specific transfer you want to follow. This is usually the transaction where your funds left your control: the moment you sent crypto to a scammer, or the moment a hacker drained your wallet.

With the seed transaction's ID (a long string of letters and numbers that uniquely identifies it), a forensic investigator can look up the exact details on the blockchain: exactly how much was sent, exactly when, and exactly which wallet address it went to.

Step 2: Following the Hops

From the first destination wallet, the investigator follows every subsequent transaction - each called a "hop." Fraudsters and criminals often move funds through multiple wallets before reaching their intended destination, specifically to make tracing harder. Each hop adds complexity, but because every transaction is permanently recorded, each hop can still be followed.

Your Wallet
Origin
2.1 BTC
W
Wallet A
Hop 1
2.1 BTC
W
Wallet B
Hop 2
2.1 BTC
Binance
Exchange - Found

Step 3: Identifying the Destination

The most important moment in a trace is when the funds reach a known entity - particularly a centralised exchange. Exchanges hold identity information about their users, which means that once funds are traced to an exchange, there is a real person on the other side of that transaction. That identity information can be requested through legal channels.

If funds do not reach a known exchange - if they remain in anonymous wallets or are dispersed across many addresses - the trace still documents what happened, but the recovery options are more limited.

Why exchanges matter so much: When a criminal deposits stolen crypto into a regulated exchange, that exchange has their name, passport photo, and often their bank details on file. The chain of evidence from your wallet to their exchange account is the key that unlocks identity disclosure.
Chapter 04

Wallets, Addresses & Identity

One of the most common misconceptions about cryptocurrency is that it is completely anonymous. It is not. It is pseudonymous - which is an important distinction.

What is a Wallet Address?

A cryptocurrency wallet address is a string of letters and numbers - something like 1A1zP1eP5QGefi2DMPTfTL5SLmv7Divf on Bitcoin. It is not tied to your name, email, or any personal information. Anyone can create as many wallet addresses as they want, for free, instantly, with no registration required.

This is why people often assume crypto is anonymous: the address carries no name. But the blockchain records every transaction involving that address - and those transactions can be extremely revealing.

The Pseudonymity Problem

Pseudonymity means using a consistent alias rather than your real identity. The "alias" in crypto is your wallet address. While the address itself carries no name, the pattern of transactions associated with it often reveals far more than a name would.

Exchange deposits

When a wallet sends to a known exchange, the exchange knows exactly who owns that account. The on-chain link from the wallet to the exchange links the address to a real identity.

Address reuse

Reusing the same wallet address across multiple transactions makes it possible to build a complete financial history for that address - who paid it, who it paid, and how much.

Co-spend patterns

When multiple wallet addresses are used together in the same transaction, they almost certainly belong to the same person - revealing that a single entity controls multiple addresses.

IP & mempool data

When a transaction is broadcast to the network, it temporarily reveals the IP address of the computer that sent it - linking the wallet to a physical location.

"Calling cryptocurrency anonymous is like saying a person is anonymous because their name isn't written on their house. Their habits, their neighbours, their utility bills - all tell the story."
Chapter 05

Mixers & Obfuscation

Criminals who know they are being traced use various techniques to try to break the on-chain trail. Understanding these methods - and their limitations - is important for setting realistic expectations about what forensics can achieve.

What is a Cryptocurrency Mixer?

A cryptocurrency mixer (also called a tumbler) is a service that takes funds from many different users, pools them together, and sends back equivalent amounts to destination addresses - making it harder to connect the original sender with the final recipient.

Think of it like a crowded busy cash machine: you put in £100 and get out £100, but the specific notes you receive were not the ones you put in. For someone trying to trace which £100 went where, this creates genuine difficulty.

Common Obfuscation Techniques

01

CoinJoin & Wasabi Wallet

Multiple users combine their Bitcoin transactions into one large transaction, making it difficult to determine which input corresponds to which output. Wasabi Wallet is a popular implementation. Forensic countermeasure: denomination clustering and timing analysis.

02

Smart Contract Mixers (e.g. Tornado Cash)

On Ethereum-compatible chains, smart contract mixers allow users to deposit a fixed amount and withdraw the same amount from a different address, breaking the on-chain link. Forensic countermeasure: timing correlation and deposit/withdrawal pattern analysis.

03

Chain Hopping

Converting funds from one cryptocurrency to another (e.g. Bitcoin to Monero, then Monero to Ethereum) to break the tracing thread at the point of conversion. Forensic countermeasure: cross-chain bridge tracking and timing analysis at on/off ramps.

04

Privacy Coins (Monero, Zcash)

Some cryptocurrencies are designed with built-in privacy features that obscure sender, receiver, and amount at the protocol level. Monero is the most advanced. Forensic countermeasure: focus on entry/exit points and off-chain OSINT rather than on-chain analysis.

Honest expectation: Mixers make tracing harder, but they rarely make it impossible. Most mixing implementations leave exploitable patterns. However, true privacy coin usage - particularly Monero - is the most significant barrier to on-chain analysis. Even then, criminals must eventually convert their funds back to usable currency, and that exit point is often where forensics succeeds.
Chapter 06

What Forensics Can & Cannot Do

Setting honest expectations is one of the most important things in this field. Blockchain forensics is powerful - but it is not magic. Understanding what it can and cannot achieve helps you make informed decisions about your case.

What blockchain forensics CAN do
  • Trace the complete path of your funds from origin to destination
  • Identify whether funds reached a known cryptocurrency exchange
  • Show which wallets were controlled by the same entity
  • Detect interaction with known fraud wallets or sanctioned addresses
  • Produce a court-admissible evidence report
  • Give an honest assessment of recovery feasibility
  • Provide documentation for police complaints and legal proceedings
  • Often trace through mixing attempts with high confidence
What blockchain forensics CANNOT do
  • Automatically return your funds - that requires legal action
  • Force exchanges or authorities to act
  • Guarantee recovery when funds are fully dispersed or cashed out
  • Guarantee identity in all cases - attribution is probabilistic
  • Overcome true Monero transactions with on-chain analysis alone
  • Work backwards in time once evidence is destroyed off-chain
Chapter 07

The Legal Side

Blockchain forensics is most valuable when the findings can be used in real-world legal proceedings. Understanding how this works helps you know what to do with a forensic report once you have it.

What Makes Evidence Court-Admissible?

For forensic findings to be used in court, they must be produced in a way that is documented, repeatable, and methodology-transparent. This means the investigator must be able to show exactly how each finding was reached - not just assert a conclusion.

Industry standards like the ACPO Good Practice Guide, NIST SP 800-101, and ISO/IEC 27037 set out the requirements for digital forensic evidence. Reports produced to these standards include a full chain-of-custody log, methodology disclosure, and an expert witness declaration that can withstand cross-examination.

What Happens After a Forensic Report?

Chapter 08

Key Terms Glossary

A quick reference guide to the key terms used in blockchain forensics - explained in plain English.

Blockchain
A public, distributed database that records transactions in permanent, ordered blocks - maintained by thousands of computers worldwide. Think of it as a ledger that no single party controls and nobody can alter.
Wallet Address
A unique string of characters that serves as the destination for cryptocurrency payments - similar to a bank account number, but pseudonymous rather than tied to a real identity by default.
Transaction ID (TXID)
A unique identifier for each blockchain transaction - a long string of letters and numbers. If you have this, investigators can locate your transaction instantly on the blockchain.
UTXO
Unspent Transaction Output - Bitcoin's accounting model. Rather than tracking balances, Bitcoin tracks discrete "coins" from previous transactions. Forensic analysis must trace these UTXOs individually.
Mixer / Tumbler
A service that pools cryptocurrency from multiple users and redistributes it, designed to obscure the trail between sender and recipient. Mixers make forensic analysis harder but rarely impossible.
CoinJoin
A Bitcoin privacy technique where multiple users combine their transactions into one, making it difficult to identify which input funded which output. Used in Wasabi Wallet and JoinMarket.
Clustering Heuristics
Analytical rules used to group multiple wallet addresses that likely belong to the same controlling entity - such as the common-input-ownership rule, which says inputs to the same transaction share a controller.
Exchange (CEX)
A centralised cryptocurrency exchange - a regulated company that allows users to buy, sell, and hold cryptocurrency. CEXes require identity verification (KYC), making them critical points in forensic investigations.
KYC (Know Your Customer)
The regulatory requirement for financial services to verify the identity of their users. Regulated exchanges must collect government-issued ID, linking wallet accounts to real identities.
Chain of Custody
A documented record of how evidence was collected, handled, and preserved - required for forensic evidence to be admissible in legal proceedings. Breaks in chain of custody can invalidate evidence.
Expert Witness
A person with specialist knowledge who provides opinion evidence in court proceedings. In blockchain cases, a forensic analyst can serve as an expert witness to explain technical findings to a judge or jury.
Seed Transaction
The starting point of a forensic trace - the specific transaction where funds left the victim's wallet or first became associated with suspicious activity.
End of Guide

You've Completed Blockchain Forensics 101

Now that you understand how blockchain forensics works, you are in a much better position to assess your own situation - and to have an informed conversation with our team about whether a forensic assessment makes sense for your case.