Cryptocurrency & Blockchain Investigations
How investigators trace cryptocurrency across public blockchains, distinguish wallets from addresses and exchanges, use blockchain analytics, obtain provider records, investigate mixers and stablecoins, preserve attribution evidence, seize digital assets, and address Fourth Amendment, forfeiture, evidentiary, privacy, and governance issues.
What this explainer does
Cryptocurrency investigations often begin with a transaction hash, wallet address, exchange account, victim payment, seizure target, ransom demand, or device artifact. Public blockchain data can then reveal where digital assets moved, when they moved, and how addresses interacted.
The difficult step is attribution. A blockchain normally records addresses and transactions—not the legal identity of the human being who controlled a private key at a particular moment. Investigators therefore combine ledger analysis with exchange records, device evidence, communications, IP data, KYC records, financial records, admissions, surveillance, and other traditional evidence.
The central investigative principle is simple: blockchain tracing can follow value, but independent evidence is usually required to prove who controlled the assets.
Cryptocurrency tracing is now routine in major fraud, cybercrime, narcotics, ransomware, money-laundering, sanctions, and asset-forfeiture investigations. DOJ announced multiple 2026 seizures involving tens of millions of dollars in digital assets after investigators traced funds across addresses and laundering networks.
At the same time, stablecoins, bridges, cross-chain swaps, privacy-enhancing tools, decentralized services, and rapidly changing exchange practices make attribution and seizure more complex.
1. Overview
Most major public blockchains are transparent but pseudonymous.
A transaction can often be viewed by anyone with access to a block explorer. The public record may show sending and receiving addresses, amount, timestamp or block time, transaction fees, smart-contract interactions, token transfers, and other network-specific details.
That visibility makes cryptocurrency unusually traceable compared with physical cash. But the ledger does not ordinarily identify the person behind an address. Investigators must bridge from pseudonymous on-chain activity to off-chain identity.
2. Blockchain Basics
Distributed ledger recording validated transactions according to a network's protocol.
Public identifier used to receive or send digital assets; not necessarily equivalent to one person or one wallet.
Unique identifier used to locate and verify a specific transaction on a blockchain.
Group of transactions incorporated into the ledger according to network rules.
Digital asset represented through a blockchain or smart contract; may include stablecoins, governance tokens, or other assets.
Code deployed on a blockchain that executes defined operations when called.
3. Wallets, Addresses, Seed Phrases, and Private Keys
A cryptocurrency wallet does not necessarily “contain coins.” It manages the cryptographic keys that authorize transactions involving assets recorded on a blockchain.
| Term | Investigative Significance |
|---|---|
| Private key | Cryptographic secret capable of authorizing transactions for associated assets. |
| Seed / recovery phrase | Words that can recreate keys for a wallet; possession may permit control of assets. |
| Public address | Identifier visible on-chain; can be shared without disclosing the private key. |
| Hosted / custodial wallet | Exchange or service controls keys on behalf of customer and may maintain identity and transaction records. |
| Self-custody wallet | User controls the keys directly; provider records may be limited or nonexistent. |
| Hardware wallet | Physical device used to protect private keys and authorize transactions. |
4. Blockchain Analytics
Commercial and government analytics tools can organize public ledger information into graphs, clusters, risk indicators, service labels, transaction paths, and investigative leads.
Analytics may use heuristics to infer that multiple addresses are controlled by the same entity. Some labels are supported by provider disclosures or known deposit addresses; others are inferred through transaction behavior.
5. Attribution Is the Hard Part
KYC records, account email, phone, IP logs, payment methods, deposits, withdrawals, and device history may connect an address to an account.
Wallet files, seed phrases, screenshots, browser history, authenticator apps, transaction records, and messages can show control.
Texts, email, chats, ransom notes, invoices, and social-media messages can connect a person to a wallet or transfer.
Bank transfers, card purchases, ACH records, and fiat on/off ramps can corroborate cryptocurrency activity.
Login and transaction logs may connect exchange activity to networks and devices.
Statements, observed transactions, undercover activity, or controlled transfers may establish actual control.
6. Exchanges and Other Virtual-Asset Service Providers
Centralized exchanges are often the key bridge between public blockchain activity and real-world identity. Regulated U.S. exchanges may maintain customer-identification, Bank Secrecy Act, transaction, login, deposit, withdrawal, and account records.
Records differ substantially by provider and jurisdiction. Investigators should preserve the provider's response format and understand whether an address is a unique customer deposit address, pooled address, omnibus wallet, withdrawal address, or internal ledger entry.
7. A Defensible Cryptocurrency Investigation
8. Mixers, Tumblers, and Obfuscation Services
Mixers attempt to reduce traceability by combining, routing, or transforming digital assets so that the relationship between input and output is more difficult to establish. Investigators may also encounter peeling chains, rapid address changes, intermediary wallets, decentralized exchanges, token swaps, and chain hopping.
Use of a mixer is not itself proof of criminal intent. The investigative significance depends on the service, transaction pattern, surrounding conduct, source of funds, destination, communications, and other evidence.
9. Stablecoins Can Be Both Traceable and Seizable
Stablecoins such as USDT or USDC are digital tokens designed to maintain value relative to a fiat currency. Many are issued by centralized entities with technical capabilities that may permit freezing or blocking assets under appropriate circumstances.
Recent DOJ cases demonstrate large-scale recovery of stablecoins tied to fraud investigations. In February 2026, federal agents announced seizure of more than $61 million in Tether tied to alleged laundering of investment-scam proceeds; other 2026 forfeiture cases similarly involved traced USDT.
10. Bridges and Cross-Chain Swaps Complicate Tracing
Digital assets can move from one blockchain to another through bridges, exchanges, wrapped assets, swaps, or liquidity protocols. A single criminal proceeds trail may therefore require analysis across Bitcoin, Ethereum, Tron, Solana, or other networks.
Cross-chain movement should be documented as a sequence of linked transactions rather than described casually as one continuous transfer unless the analytical basis for that linkage is preserved.
11. Privacy-Enhancing Technologies Reduce Observability
Some cryptocurrencies and wallet technologies are designed to obscure transaction amounts, addresses, or transaction relationships. Privacy features may make ordinary public-ledger tracing incomplete or impossible.
Investigators may then rely more heavily on exchange records, endpoint seizures, undercover transactions, network evidence, device forensics, informants, financial records, or mistakes made when assets enter or leave privacy-enhancing systems.
12. United States v. Gratkowski: Public Blockchain and Coinbase Records
United States v. Gratkowski, 964 F.3d 307 (5th Cir. 2020), is the leading federal appellate decision addressing Fourth Amendment privacy in Bitcoin blockchain and exchange records.
The Fifth Circuit held that the defendant lacked a reasonable expectation of privacy in information recorded on Bitcoin's public blockchain and in the Coinbase transaction records at issue. Agents had used blockchain analysis to identify transactions and then served a grand-jury subpoena on Coinbase.
The court distinguished Carpenter, reasoning that Bitcoin transactions required affirmative acts and that the records were more analogous to conventional financial records than comprehensive CSLI.
13. Fourth Amendment Analysis Depends on the Data Source
| Data Source | Likely Legal Issue |
|---|---|
| Public blockchain | Publicly observable ledger information; Gratkowski found no reasonable expectation of privacy in Bitcoin blockchain information |
| Exchange business records | Third-party records, statutory process, provider requirements, and jurisdiction-specific Fourth Amendment analysis |
| Wallet on seized phone/computer | Riley, device-search warrant scope, particularity, forensic method, and cloud/local distinction |
| Seed phrase / private key in residence | Physical/digital search warrant scope and seizure of instrumentalities or assets |
| Cloud wallet or account | Stored Communications Act or other provider process depending on service architecture and information sought |
| Commercial blockchain analytics | Public-source analysis plus proprietary inference; discovery and reliability may become more important than search doctrine |
14. Legal Process Should Match the Record Sought
Cryptocurrency investigations can involve subpoenas, search warrants, preservation demands, seizure warrants, restraining orders, civil forfeiture complaints, mutual legal assistance, emergency requests, and provider-specific processes.
A provider request should identify the relevant account, address, transaction, date range, asset, and categories of records rather than asking broadly for “all cryptocurrency information” where narrower process will accomplish the investigative objective.
15. Seizure and Forfeiture Require Technical Planning
Cryptocurrency can be seized by transferring assets to a government-controlled wallet, restraining assets held by a cooperating provider or issuer, seizing a device or private key, or using other court-authorized mechanisms.
Possession of a private key creates operational risk. Anyone with a valid copy may move the assets. Agencies therefore need secure key-generation, multi-person controls, offline storage where appropriate, documented transfers, transaction-fee planning, valuation records, and auditable chain of custody.
16. Evidence, Authentication, and Discovery
Preserve transaction hashes, addresses, block information, token contracts, and export files.
Retain graphs, labels, clusters, path calculations, confidence fields, and vendor reports used by investigators.
Document which conclusions came from public ledger facts and which came from proprietary heuristics or labels.
Preserve certified exchange responses, KYC documents, account logs, IP records, and deposit/withdrawal data.
Maintain forensic images, wallet artifacts, seed/private-key handling, and extraction documentation.
Record government destination address, transaction hash, authorization, signer(s), fees, timestamp, and resulting custody.
17. Common Analytical Errors
An address may be controlled by an exchange, service, smart contract, shared wallet, or unknown user.
Clustering heuristics can produce false associations or require network-specific assumptions.
A deposit to an exchange address does not automatically identify who controlled the sending wallet.
Accounts can be compromised, opened with stolen identity, shared, or operated by money mules.
Asset values fluctuate; reports should identify valuation source and time.
A bridge or swap can break an analysis if the investigator assumes continuity without documenting the linkage.
18. Governance Framework for Cryptocurrency Investigations
Define who may conduct blockchain tracing, obtain provider records, handle keys, and testify to analytical conclusions.
Evaluate analytics accuracy, supported chains, labeling methodology, clustering assumptions, and known limitations.
Maintain jurisdiction-specific guidance for subpoenas, warrants, preservation, seizure, forfeiture, and international requests.
Require independent corroboration before identifying a person as the controller of an address or account.
Use dual control, secure key management, documented government wallets, and auditable transfer procedures.
Address licensing, data retention, query logs, government search visibility, model updates, and discoverability.
Retain raw exports, block data, screenshots, provider returns, device evidence, analytical notes, and seizure records.
Define when analysts testify as fact witnesses versus experts and how methodology will be explained.
Audit major traces for attribution errors, unsupported labels, missing cross-chain steps, or overstatement of confidence.
19. Questions Every Agency Should Answer
20. What Comes Next
Dollar-linked tokens will remain important in fraud, laundering, sanctions, and rapid asset recovery.
Investigations will increasingly span multiple networks, bridges, decentralized exchanges, and token formats.
Analytics vendors will use machine learning to identify patterns, services, risk, and attribution leads.
Government seizure programs will require increasingly mature key-management and digital-asset custody controls.
Courts will continue addressing whether new categories of exchange, wallet, and digital-asset records implicate Fourth Amendment interests.
Crypto ATMs, investment scams, extortion, theft, drug trafficking, and ordinary fraud increasingly bring blockchain evidence into state and local investigations.
21. Key Terms
22. Related ShieldPST.ai Resources
Wallet applications, seed phrases, screenshots, authenticator data, and device artifacts frequently become attribution evidence.
Open explainer →Review provider process, preservation, warrants, subscriber information, content, metadata, and cross-border evidence.
Open explainer →Compare blockchain transaction graphs with broader entity-resolution and link-analysis methods.
Open explainer →Review vendor provenance, proprietary analytics, government procurement, and corroboration principles.
Open explainer →Apply chain of custody, metadata, integrity, audit, retention, and discovery to cryptocurrency evidence.
Open explainer →Connect cryptocurrency investigations to warrants, evidence, privacy, procurement, cybersecurity, and governance.
Open resource →23. Selected Authoritative and Primary Sources
Leading appellate decision addressing Fourth Amendment privacy in public Bitcoin blockchain information and Coinbase transaction records.
Review Gratkowski
Recent appellate application of third-party doctrine to a specific cryptocurrency transaction and subscriber information, citing Gratkowski among relevant authorities.
Review Whipple
Major federal action describing blockchain analysis of hundreds of thousands of transactions in an alleged investment-fraud laundering network.
Review DOJ action
Federal seizure of Tether allegedly connected to laundering of cryptocurrency investment-fraud proceeds.
Review seizure announcement
Multiple investigations in which Secret Service investigators traced victim funds through cryptocurrency addresses and laundering networks.
Review DOJ announcement
Current federal financial-intelligence resources concerning virtual-currency investment scams, kiosks, suspicious activity reporting, and laundering indicators.
Review FinCEN resources
Official Treasury action removing economic sanctions against Tornado Cash itself while maintaining sanctions and enforcement against malicious actors and designated persons.
Review Treasury action
24. Key Takeaways
- Public blockchains are transparent but ordinarily pseudonymous.
- An address is not the same thing as a person, account, wallet, or device.
- Blockchain tracing establishes movement of value; attribution requires separate evidence.
- Commercial analytics combine direct ledger observations with inferred clusters and labels that must be distinguished in reports and testimony.
- Centralized exchanges can provide the key bridge from an address to KYC, account, IP, and transaction records.
- Self-custody wallets shift the investigation toward device forensics, communications, surveillance, and private-key evidence.
- Gratkowski held that the defendant lacked a reasonable expectation of privacy in the Bitcoin blockchain and Coinbase records at issue, but it is Fifth Circuit precedent and should not be overgeneralized.
- Mixers and cross-chain swaps complicate tracing but do not automatically establish criminal intent.
- Tornado Cash itself was removed from the OFAC sanctions list in March 2025; current sanctions should always be checked rather than relying on older training materials.
- Stablecoins can provide meaningful recovery opportunities because some issuers can freeze assets under proper legal authority.
- Cryptocurrency seizure requires secure key management, dual control, auditable government wallets, and precise chain-of-custody procedures.
- Proprietary analytics may create discovery and expert-testimony issues when a prosecution depends on clustering, attribution, or service labels.
- The governing question should be: what facts are actually recorded on the blockchain, what conclusions were inferred by analytics, and what independent evidence proves who controlled the assets?