How to Investigate a Crypto Wallet: Blockchain Forensic Analysis

What Blockchain Forensics Is and Is Not

Every transaction on a public blockchain is recorded in an immutable ledger — permanently, publicly visible. Blockchain forensics is the systematic analysis of that ledger to trace funds, identify patterns, and connect addresses to real-world entities.

What forensics can establish: the complete transaction history of an address, which other addresses an address transacted with, whether funds passed through high-risk entities (sanctioned exchanges, mixer services, known theft addresses), and in many cases, which centralized exchange holds a key to an address (enabling subpoena for KYC data).

What forensics cannot establish from on-chain data alone: the real-world identity of an address holder. Blockchain addresses are pseudonymous, not anonymous. Identity requires connecting on-chain data to off-chain records — exchange KYC data, IP logs, or other identifying information obtained through legal process or open-source intelligence.

Common Reasons to Commission a Wallet Investigation

• Pre-transaction due diligence: before accepting a large crypto payment from an unknown counterparty, verifying the funds do not trace to sanctioned parties or illicit sources
• Post-fraud analysis: after suffering a crypto theft or receiving fraudulent funds, tracing where the assets went to support recovery or legal action
• AML/compliance screening: screening counterparty wallets before or during a DeFi transaction, token sale, or institutional settlement
• Legal proceedings: providing evidence of asset flows for civil litigation, divorce proceedings, bankruptcy proceedings, or regulatory investigations
• Sanctions compliance: verifying a counterparty's wallet has not transacted with OFAC-sanctioned addresses or exchanges
• Investor due diligence: investigating token treasury wallets or founder wallets before committing to an investment round

What a Forensic Report Contains

A professional blockchain forensic report typically includes:

• Address summary: total assets received and sent, current balance, first and last transaction dates, and primary blockchain
• Transaction graph: visual and tabular representation of direct counterparties and their entity attribution (known exchange, mixer service, flagged address, or unattributed)
• Fund flow analysis: tracing funds backward (source of funds) and forward (destination of funds) through multiple hops, typically to 5–10 degrees of separation
• Risk exposure by category: percentage of transaction volume associated with each risk category (darknet markets, sanctions, stolen funds, gambling, high-risk exchanges)
• Entity attribution: identification of known services the address has interacted with (Binance, Coinbase, Tornado Cash, specific sanctioned entities)
• Risk score and narrative: an overall risk assessment with supporting analysis, written for legal or compliance audiences

Chain Tracing: How Far Back Does Analysis Go?

Bitcoin and Ethereum transactions trace back to genesis. There is no statute of limitations on blockchain data — a transaction from 2016 is as visible today as it was then. Professional forensics typically traces funds through multiple hops: if a counterparty received funds from address A, which received them from address B, which received them from a known darknet market — all three degrees of separation are relevant.

The depth of analysis depends on the purpose and budget. Sanctions screening may only require direct counterparty analysis. Litigation support may require exhaustive tracing across dozens of hops to establish a complete fund flow narrative.

Mixer Services, Privacy Coins, and Obfuscation

Cryptocurrency mixing services (Tornado Cash, CoinJoin, and similar) pool funds from many users to break the traceability link. OFAC sanctioned Tornado Cash in August 2022 — interaction with Tornado Cash is itself a red flag regardless of the underlying funds' origin.

Privacy coins (Monero in particular, Zcash shielded transactions) use cryptographic mechanisms that make on-chain tracing significantly harder or impossible. Forensics for these assets is a specialized field with different tooling and often lower certainty in results.

Chain bridges (transferring assets from Ethereum to another chain) can obscure fund flows, but bridge contracts are themselves transparent. Professional tools track cross-chain movements where the bridge contract records both sides of the transfer.

Using Forensic Reports in Legal Proceedings

Blockchain forensic reports have been admitted in US federal court, UK courts, and numerous EU jurisdictions as evidence of asset flows. Key requirements for admissibility:

• Clear chain of custody: how the raw blockchain data was obtained and preserved
• Documented methodology: which data sources were used, how attribution determinations were made
• Analyst qualifications: the investigator's credentials and experience
• No speculation: conclusions grounded in data, not inference

Reports used in legal proceedings should be prepared with the expectation of cross-examination. A litigation-ready report is more detailed than a compliance screening report.

Commission a forensic wallet report — TRACR

TRACR generates comprehensive blockchain forensic reports for Bitcoin, Ethereum, and all major EVM chains. Used by legal teams, compliance officers, and DAO treasuries. Reports include fund flow analysis, risk scoring, and entity attribution. Starting at $29.

Frequently Asked Questions