Blockchain Forensics in Cybercrime Investigations

Blockchain forensics turns pseudonymous transaction data into evidence a prosecutor can actually use in court, tying specific wallets to real people, real timestamps, and real intermediaries. The setup behind it explains why this field even needed to exist.

Every wallet address is a string of characters, not a name. Pseudonymous, not anonymous, and that distinction is the entire ballgame. Bank records can be shredded, edited, or "accidentally" deleted right before a subpoena lands. A blockchain ledger can't. It's public and permanent, and criminals cannot erase it. That permanence makes tracing possible: criminals get to hide behind a fake name, but they don't get to erase the paper trail behind it.

Turning that raw ledger into something a judge will accept means stacking two different kinds of evidence TRM Labs 2026 Crypto Crime Report Chainalysis 2026 Crypto Crime Report Elliptic. On-chain data covers the transaction history, the address clusters, the smart contract calls. Off-chain intelligence covers everything else: who owns the exchange account behind an address, what OSINT turns up, whether a wallet shows up on a sanctions list. Neither one works alone. On-chain data without context is just numbers moving between strings of letters. Off-chain intelligence without on-chain data is just a hunch.

The actual techniques break down into a handful of moves: clustering algorithms that group addresses likely controlled by one entity, behavioral heuristics that flag patterns that look like laundering, cross-referencing against open-source intelligence, and good old-fashioned subpoenas for KYC records held by regulated exchanges. What's exotic is doing all four at once, fast enough to matter.

This isn't some fringe hobby for crypto nerds with too much free time. It sits squarely at the intersection of financial forensics, computer science, criminal law, and intelligence work, and universities have noticed: RIT now runs a Vertically Integrated Project training students across computer science, cybersecurity, psychology, criminal justice, law, and policy, all pointed at the same problem. The criminal writes a permanent record they can't take back. Reading that record well is the craft.

The scale of what investigators are chasing

Two of the biggest names in the field published 2025 numbers that don't match, and that mismatch tells you more than either number alone TRM Labs 2026 Crypto Crime Report Chainalysis 2026 Crypto Crime Report Elliptic. TRM Labs put illicit wallets at $158 billion in incoming value for 2025, up from $64.5 billion the year before TRM Labs 2026 Crypto Crime Report Chainalysis 2026 Crypto Crime Report Elliptic. Chainalysis landed at $154 billion for the same year, a 162% jump from 2024 TRM Labs 2026 Crypto Crime Report Chainalysis 2026 Crypto Crime Report Elliptic. Close, but not the same. And that gap isn't a mistake by either firm, it's a difference in how each one draws the line around what counts as "illicit". Different measuring instruments, different readings. Neither is lying.

Then the FBI muddies the water further Elliptic. Its IC3 report for 2024 pegged crypto scam losses at $16.6 billion, which runs 67% higher than Chainalysis's figure for that same category Elliptic. Why the gap? The FBI counts what victims report Elliptic. Forensic firms count what they can actually prove happened on-chain Elliptic. Two very different definitions of "we found this TRM Labs 2026 Crypto Crime Report Chainalysis 2026 Crypto Crime Report Elliptic."

Forensic firms hold themselves to accuracy standards above 99%, which sounds impressive until you realize what it means in practice. It means they only publish what they can prove with near-certainty. Anything murkier gets left out. False negatives aren't a bug in these reports, they're baked into the methodology by design. Roughly 85% of fraud victims never report the crime in the first place, so the real annual losses could top $110 billion Elliptic. Every headline figure in this field is a floor, not a ceiling.

What's actually driving the 2025 numbers, category by category TRM Labs 2026 Crypto Crime Report Chainalysis 2026 Crypto Crime Report Elliptic? Ransomware pulled in $820 million in on-chain payments even as claimed attacks rose 50% (fewer big scores, apparently, but plenty of activity) Chainalysis/Prudential Associates. Sanctions evasion got a boost from Russia's A7A5 token, which alone moved over $93.3 billion in transactions in under a year Chainalysis/Prudential Associates. State-sponsored theft, largely DPRK-linked hackers, accounted for $2 billion stolen in 2025 Chainalysis/Prudential Associates. And despite all that, illicit activity stayed under 1% of total attributed crypto volume, a stat the industry likes to cite, though it only means as much as the denominator behind it Chainalysis 2026 Crypto Crime Report.

The Bybit hack: a worked example of an investigation

Start with the number that makes this the biggest heist in crypto history: on or about February 21, 2025, roughly $1.5 billion in virtual assets vanished from the exchange Bybit Chainalysis FBI IC3 Elliptic DOJ/FBI. The FBI confirmed it was North Korea's TraderTraitor group Chainalysis FBI IC3 Elliptic DOJ/FBI. That single hack made up the majority of the $3.4 billion stolen by hackers across all of 2025 Chainalysis FBI IC3 Elliptic DOJ/FBI. One job, most of the year's damage.

Elliptic had already attributed the attack to DPRK actors before the FBI's official confirmation came through, showing that commercial forensic platforms can move faster than the government agencies whose job this technically is. Speed matters, because laundering starts the second the theft is confirmed.

The laundering itself ran through refund addresses, worthless tokens meant to muddy the trail, and diversification across mixing services Elliptic. By August 2025, over $1 billion of it had been laundered, much of it funneled through suspected Chinese OTC services Elliptic. Nick Carlsen, a former FBI intelligence analyst now at TRM Labs, has a name for this approach: "flood the zone." Overwhelm compliance teams and blockchain analysts with a firehose of rapid, high-frequency transactions across as many platforms as possible. Volume, not subtlety, drives the approach.

DPRK's playbook has changed Chainalysis/Prudential Associates. Older heists leaned on Ren Bridge, Avalanche Bridge, and mixers like Sinbad, YoMix, Wasabi Wallet, and CryptoMixer. After enforcement actions took down platforms like Tornado Cash, North Korea pivoted away from classic anonymity tools and toward raw speed and automation instead. Chainalysis called 2025 the worst year on record for DPRK crypto theft, with DPRK responsible for a record 76% of all service compromises, pushing the lower-bound cumulative estimate of DPRK crypto theft to $6.75 billion Chainalysis 2026 Report. And this is the honest lesson Bybit teaches: even with real-time blockchain tracing running at full speed, sufficiently fast, automated laundering can outrun investigators in the short window before funds get cashed out. The adversary adapts. This isn't a solved problem, it's a moving target.

Other investigations where blockchain forensics drove the outcome

The Bitcoin Fog case is the field's landmark win Stout ius.center. Roman Sterlingov was found guilty on March 12, 2024, of operating one of the longest-running Bitcoin money laundering services on the darknet Stout ius.center. For nearly 10 years, Bitcoin Fog moved over 1.2 million bitcoin (worth $400 million at the time of the transactions), much of it connected to narcotics, computer fraud, and identity theft Stout ius.center. Chainalysis evidence sat at the center of the prosecution Stout ius.center.

Then there's the Hamas financing case from March 2025 Chainalysis/Prudential Associates Chainalysis FBI IC3 Elliptic DOJ/FBI. DOJ and the FBI disrupted a financing network by seizing roughly $200,000 in USDT Chainalysis/Prudential Associates Chainalysis FBI IC3 Elliptic DOJ/FBI. Investigators traced at least 17 crypto addresses that had pulled in over $1.5 million, coordinated through an encrypted group chat Chainalysis/Prudential Associates Chainalysis FBI IC3 Elliptic DOJ/FBI. Blockchain intelligence connected those addresses to actual operatives and enabled seizures across multiple jurisdictions Chainalysis/Prudential Associates Chainalysis FBI IC3 Elliptic DOJ/FBI.

June 2025 brought the Intelbroker takedown: French police and U.S. prosecutors used Chainalysis to identify and arrest five administrators of BreachForums, a well-known hacking marketplace. IntelBroker himself was picked up in February, four others followed in June. Cryptocurrency activity was the thread connecting anonymous online handles to real names.

The UK Metropolitan Police case is almost comically patient ius.center. Investigators recovered 61,000 Bitcoin from a Chinese national who ran an investment fraud scheme that victimized more than 128,000 people worldwide UK Metropolitan Police ius.center. The funds sat dormant for years before the guilty plea came in September 2025 and sentencing followed that November UK Metropolitan Police ius.center. Years of silence, then traced anyway.

The DOJ's Scam Center Strike Force filed five civil forfeiture complaints on July 21, 2026, seeking forfeiture of more than $25 million in cryptocurrency recovered across separate fraud investigations Chainalysis/Prudential Associates DOJ/U.S. Attorney's Office for the District of Columbia. U.S. Attorney Pirro credited the Strike Force, which launched back in November 2025 Chainalysis/Prudential Associates DOJ/U.S. Attorney's Office for the District of Columbia.

Then there's Silk Road: over 50,000 Bitcoin recovered in a seizure valued at $3.36 billion, years after the original marketplace was shut down Law Enforcement/Police1. And Bitfinex, maybe the most cinematic entry on this list Thomson Reuters ius.center. In 2016, hackers made off with 120,000 Bitcoin worth $72 million at the time Thomson Reuters ius.center. It took until 2022 for law enforcement to seize $3.6 billion in crypto and arrest two alleged perpetrators, a saga documented in the Netflix film Biggest Heist Ever Thomson Reuters ius.center.

What ties all of these together is simple: the ledger doesn't forget. The clock investigators are actually racing is the cash-out window once laundering begins.

The accuracy trap: why high confidence produces systematic blind spots

The tension nobody puts on a billboard sits right here. Forensic platforms hold themselves to 99%-plus accuracy since their main customer, law enforcement, needs that bar cleared before anything goes near a courtroom. That's a deliberate choice, not a shortcoming. But that same discipline guarantees blind spots. Chase near-zero false positives hard enough, and you mathematically lock in a pile of false negatives: real illicit activity that exists but can't be pinned down with enough confidence to publish.

A peer-reviewed academic study of Chainalysis data (the largest of its kind at the time) put numbers on how big that gap can get Chainalysis 2026 Crypto Crime Report. False positive rates were tiny: 0.01% for BestMixer, 0.15% for Hansa Market, 0.11% for Wall Street Market Chainalysis 2026 Crypto Crime Report. Sounds airtight. But the same study found Chainalysis identified only about 25% of sampled BestMixer addresses, roughly 79% of Hansa Market addresses, and about 95% of Wall Street Market addresses Chainalysis 2026 Crypto Crime Report. A 75% miss rate on BestMixer, a service purpose-built to scramble fund flows, tells you exactly where the tooling struggles hardest Chainalysis 2026 Crypto Crime Report. Alison Jimenez of Dynamic Securities Analytics flagged this coverage gap directly, giving the criticism a named, citable source rather than leaving it as vague industry chatter.

The Sterlingov defense leaned into this same tension Stout ius.center. CipherTrace, testifying for the defense in the Bitcoin Fog Daubert hearing, argued blockchain forensics is "more of an art than a science". The court rejected that argument in this instance, but methodology in this field is still evolving, and pretending otherwise does nobody favors.

The takeaway for anyone reading a vendor's headline number: that figure represents what the tools could confidently prove, not the full scope of what actually happened TRM Labs 2026 Crypto Crime Report Chainalysis 2026 Crypto Crime Report Elliptic. And this loops right back to the $158 billion versus $154 billion gap from earlier TRM Labs 2026 Crypto Crime Report Chainalysis 2026 Crypto Crime Report Elliptic. Different heuristics, different attribution models, different coverage TRM Labs 2026 Crypto Crime Report Chainalysis 2026 Crypto Crime Report Elliptic. Comparing two vendors' numbers side by side isn't comparing apples to apples, it's comparing two different rulers TRM Labs 2026 Crypto Crime Report Chainalysis 2026 Crypto Crime Report Elliptic.

Evasion techniques that push investigators to combine on-chain and off-chain methods

Mixers exist for exactly one reason: to break the chain of custody a forensic analyst relies on. Services like Sinbad, YoMix, Wasabi Wallet, CryptoMixer, and Tornado Cash pool funds from multiple sources, so the challenge becomes figuring out which output money actually belongs to which input. It's a shell game, run at blockchain speed.

Cross-chain bridges make it worse. Elliptic's 2026 regulatory outlook notes that laundering now routinely hops across multiple blockchains, with sophisticated actors moving funds between chains without missing a beat. That's become the single hardest technical problem in modern investigations. The Bybit case showed "flood the zone" tactics at industrial scale: rapid, high-frequency transactions spread across platforms specifically to overwhelm compliance teams and analysts at once. Over $1 billion of that hack's proceeds moved through suspected Chinese OTC brokers, entities that often aren't regulated VASPs and therefore have no KYC records for anyone to subpoena Elliptic. No paperwork means no shortcut.

Sometimes the evasion tactic is simpler than any of that: just wait. The Bitfinex thieves sat on stolen Bitcoin for years before making a move. The blockchain's permanence made recovery possible anyway, despite the delay. Patience doesn't beat a permanent record, it just postpones the reckoning.

The response to all of this is the same combination every time: on-chain tracing narrows down a suspect list of addresses, then OSINT (domain registrations, forum posts, social media activity), subpoenaed KYC data, and human intelligence close the last gap to an actual name and face. ZachXBT is probably the clearest example of this method in action. Wired called him the most prolific independent crypto detective in the world, and his approach blends blockchain tracing and address clustering with domain records, court filings, and social media, all self-taught. He's helped recover more than $350 million for victims and assisted law enforcement with arrests across multiple countries Paradigm/Wikipedia. In August 2025 he became a launch partner for TRM Labs' Beacon Network, a real-time response system that lets investigators, exchanges, and stablecoin issuers freeze stolen funds together, in something closer to real time than the old subpoena-and-wait model Paradigm/Wikipedia.

Getting blockchain evidence into court under the Daubert standard

None of this evidence matters if a judge won't let it in the room. In U.S. federal courts, expert testimony has to clear the Daubert standard, set by Daubert v. Merrell Dow Pharmaceuticals back in 1993. The method has to be testable, carry a known error rate, have gone through peer review, and be generally accepted within its field.

Chainalysis cleared that bar directly in the Sterlingov case Stout ius.center. The judge ruled that Chainalysis Reactor's methodology was reliable enough to serve as substantive evidence, rejecting the defense's "black-box algorithm" argument outright. The court found the methodology transparent, tested, reviewed, and reliable.

But don't read that as a blanket pass for every tool out there. One platform clearing Daubert doesn't automatically clear another, since different providers run different processes and different attribution models. That's a distinction any vendor building forensic tools needs to take seriously, and any lawyer relying on their output needs to ask about directly.

Courts don't treat blockchain evidence as some special new category, either. It gets run through the same familiar frameworks as other digital evidence: FRE 901, 803(6), 702, 1006, alongside Daubert. Getting it admitted takes disciplined prep work: authentication, hearsay analysis, reliability groundwork, properly supported summaries. The earlier issue of false negatives resurfaces here in a courtroom context. A report that overstates its own certainty is handing the defense a gift, and a competent one will use it.

State law is starting to catch up too. Texas Senate Bill 1498, effective September 1, 2025, expanded the legal definition of "contraband" to include digital currencies, NFTs, and stablecoins, establishing clear guidelines for seizure, storage, and forfeiture. Connecticut's House Bill 6990, signed June 23, 2025, and effective July 1, 2026, similarly lists virtual currency and digital wallets as property subject to forfeiture if connected to criminal activity. The legal plumbing is slowly getting built for a world where the evidence lives on a ledger instead of a filing cabinet.

The tools investigators use and their coverage gaps

The blockchain analytics market itself has grown into a multibillion-dollar industry, with strong growth expected to continue through the early 2030s as global regulation tightens and institutional players keep piling in. That growth is being pulled forward by exactly the pressures covered above: courts demanding better evidence, regulators demanding better screening, and criminals getting faster at evasion.

Chainalysis remains the most widely deployed platform across regulated crypto firms globally, with a product suite that spans KYT for real-time wallet screening, Reactor for deep investigations, and dedicated tools for forensic case management. TRM Labs runs a comparable lane, and its Beacon Network (the real-time fund-freezing system ZachXBT joined) points at where the field is headed: less after-the-fact reconstruction, more live response while money is still moving Paradigm/Wikipedia. Elliptic rounds out the field with its own tracing and regulatory intelligence work, particularly on the cross-chain bridge problem that's becoming the industry's biggest headache.

No tool on the market claims to close those gaps completely, and any vendor who says otherwise should get some skeptical follow-up questions. The tooling keeps improving. The criminals keep adapting to it. That's not a flaw in the system; it's just what an arms race looks like when one side writes its crimes onto a ledger it can never take back. This article was produced by Cyberou, a cybersecurity content studio that grounds its reporting in live threat intelligence.