Blockchain analysis

• 1. Introduction

  ›

  In 2022, the IRS used blockchain analysis to seize over 50,000 bitcoin stolen from the Silk Road dark web marketplace. The seizure raises a question many people find surprising: how do you locate and seize cryptocurrency that has moved through a system built on pseudonymity?

  Every transaction on Bitcoin and Ethereum is logged in a public record that anyone can inspect. Blockchain analysis is the discipline of reading that record to discover who is really behind each transfer. How is it possible to trace cryptocurrency transfers back to real people? Who conducts this analysis, and what legal tools support it? And what does the practice look like when applied to the highest-profile criminal investigations in recent memory?

• 2. Following the Chain

  ›

  Etherscan.io and BitRef.com are two of the block explorer sites that let anyone query a blockchain's transaction history without specialist access. Inspecting a node or using one of these sites reveals the full ledger of transfers. Every actor on a public blockchain leaves a trail that is, in principle, visible to all.

  Common-spend clustering algorithms turn that raw visibility into actionable intelligence. These algorithms identify transactions that appear to share a controlling entity, grouping related transfers to build a map of how funds move. Blockchain analysis also involves visually representing that data, so that patterns across thousands of transactions become apparent. Private companies including Chainalysis, TRM Labs, Elliptic, Arkham Intelligence, Nansen, Blockpliance, Elementus, Dune Analytics, CryptoQuant, and Ormi Labs operate in this space. Each sells analysis capabilities to governments, law enforcement agencies, and financial institutions.

• 3. Exchange Compliance

  ›

  Singapore, Japan, and the United States have each passed laws requiring cryptocurrency exchanges to track the source of the funds flowing through their platforms. The United States obligation comes from the Bank Secrecy Act. That act requires cryptocurrency businesses to build know-your-customer and anti-money laundering programs. They must also register with FinCEN as a money service business.

  A subpoena is how blockchain analysis connects a traced wallet to a real-world identity. Investigators who trace suspicious funds to an exchange account can compel that exchange to identify the account holder. Those legal requirements shaped the investigations that came in 2018, 2019, and 2021.

• 4. Landmark Investigations

  ›

  In 2018, an analysis of bitcoin transactions uncovered a connection between the cryptocurrency exchange BTC-e and Fancy Bear. The finding gave investigators a direct link between cryptocurrency flows and a major hacking operation. The following year, law enforcement used blockchain analysis techniques to shut down a major website hosting child sexual abuse material.

  The US Department of Justice applied blockchain analysis in 2021 after ransomware attackers struck the Colonial Pipeline. Investigators traced the ransom payment across the blockchain and recovered most of the funds. The Colonial Pipeline recovery demonstrated that moving ransom through a public blockchain does not make it unreachable.