Investigating Cryptocurrencies With OSINT: Turning Trails Into Evidence

On 29 October 2026, attackers took assets from Binance across multiple blockchains, and the FBI attributed a theft of more than $6 billion to North Korea. Binance’s November 3 update described a multi-stage campaign that involved compromised software, fake job interviews and a malicious code repository. Cases like this show how investigators connect transaction trails with public-source evidence, while acting quickly to preserve records and support possible freezes.

Investigating cryptocurrencies means turning those trails into evidence: a verified starting transaction, a documented path and a clear statement of what remains unknown. This guide is written for investigators and compliance teams, with an evidence-preservation checklist for fraud victims who have already lost funds. It explains what tracing can establish, why recovery is a separate outcome and how public-source research supports both.

In this article, we examine what blockchain analysis can and cannot show, how compromised access drives recent losses, how fraud and theft scenarios change the evidence, how a trace moves from a transaction hash to a report, how OSINT connects wallet addresses to public context, and how to evaluate specialist help and report an incident.

What Blockchain Analysis Can and Cannot Establish

Public blockchains record transfers between addresses, so movement can be observed by anyone. They rarely record who controls an address, which makes the identity of a person a separate finding that needs support from outside the chain.

On transparent blockchains such as Bitcoin and Ethereum, addresses are generally pseudonymous, though transaction visibility varies across networks. A wallet address is a label for activity, and a person becomes linked to it only through supporting records. Tracing can establish that a transfer occurred, when it occurred, in what amount and where the funds went next. It cannot establish intent, ownership or the legitimacy of a counterparty by itself.

Tracing, Attribution and Recovery

Tracing. The observation of transfers between addresses on a public ledger, which anyone with a block explorer can inspect and repeat.

Attribution. Address attribution is the identification of who controls an address. It is assessed by the provenance of each label, the independence of the sources, the timing and plausible alternative explanations, because two sources that agree may simply repeat the same underlying label.

Recovery. Recovery is the return of assets. Freezes, seizures and court orders may support that process but do not themselves mean funds have been returned. A trace alone returns nothing, so cryptocurrency recovery has its own requirements.

Public-source evidence can support a defensible attribution, while non-public customer records are a separate category. Compliance teams work from their own customer records, journalists and victims from public data, and only authorities and courts can compel a provider to produce know-your-customer records.

How Compromised Access Fuels Crypto Losses

The incidents below illustrate how compromised access can start a loss that then plays out on a public ledger. Each left a different mix of public and restricted evidence.

Bybit, February 2025. The FBI attributed the theft of about $1.5 billion to North Korea’s TraderTraitor group and reported that the funds were converted and dispersed across thousands of addresses on multiple blockchains. Bybit later said forensic reviews found that the credentials of a Safe developer were compromised, and one firm’s report traced the attack to malicious JavaScript in Safe’s cloud infrastructure.

Coinbase, May 2025. In a securities filing, Coinbase said an attacker appeared to have paid overseas support contractors or employees to collect customer data, that no passwords or private keys were compromised, and that it expected remediation and reimbursement costs of $180 million to $400 million. It also said it intended to reimburse eligible customers who sent funds to the attacker, so the breach became a crypto fraud investigation problem as well as a data problem.

Binance, October 2026. Binance’s November 3 update described a multi-stage campaign, and Binance called its findings initial, with the investigation ongoing. A trojanized installer for an AI tool reached one engineer in June, fake job interviews in September led another engineer to run a malicious repository, and on 20 October the attacker used an internal AI tool to take over further machines. A stolen deployment token and unauthorized access to a wallet signing service then allowed transactions outside the normal withdrawal process. Stablecoin issuers froze part of the funds.

In each case the ledger showed where the funds went, while logs, filings and interviews showed how access was obtained. The first is public. Internal logs may require authorized access; filings, published findings and some interviews are publicly available. An investigation therefore records the two separately. OSINT connects the two where attackers leave public traces, such as a fake recruiter’s profile or a website that advertises a payment address.

Investment Scams, Theft and Laundering: What Evidence Each Leaves

Scenarios differ in who authorized the transfer, and that decides which records matter. Suspicious activity is a lead in every one of them, not a finding of guilt.

Investment and Impersonation Scams

In 2025, the FBI’s Internet Crime Complaint Center received 181,565 complaints involving cryptocurrency, with $11.4B in reported losses, a measure of what victims reported and not of all crypto crime. Investment fraud accounted for most of those losses. A cryptocurrency fraud investigation of an investment scam starts with the victim’s own transfers, which were authorized, so the decisive evidence is the conversation that induced them: messages, platform addresses, deposit instructions and screenshots. Impersonation adds a second question, which is who actually controlled the account or website the victim trusted.

Theft, Ransomware and Laundering Indicators

Theft involves unauthorized transfers, so the first task is establishing how access was obtained, as the incidents above show. Ransomware investigations begin with the payment address named in the demand.

Transaction patterns, such as rapid dispersal across many addresses or conversion through several services, can raise laundering concerns and guide further investigation. The FATF handout on red flags cautions that a single indicator “is not necessarily proof of criminal activity,” and in anti-money laundering work the same indicators trigger a review and not an accusation. The FATF’s 2026 update adds that most identified on-chain illicit activity now involves stablecoins, although ordinary stablecoin transfers are not suspicious in themselves.

Preserving Evidence Before Following the Funds

Preservation comes first because exchange records, chat histories and web pages change, while on-chain data stays public. Evidence is copied in its original form with a record of when and by whom it was collected, following the same logic as digital evidence preservation in any investigation. Screenshots show what was displayed and not what happened, so platform exports and original files are preferred where they exist. Wallet secrets such as seed phrases and private keys are never submitted through ordinary reporting forms or shared with unsolicited contacts, and authorized forensic handling uses separate secure procedures.

Network and asset. The chain name, token symbol and contract address, where applicable, since similar token names can exist on different networks.

Transaction identifiers. The full transaction hash, the sending and receiving addresses, and the timestamp with its time zone, which makes the starting event reproducible.

Loss chronology. Dates, amounts, fees and the sequence of interactions, from first contact to the last transfer, which separates real transfers from misleading account-balance screenshots. Communications are kept with sender handles, URLs and timestamps, because a platform or account that disappears may leave only these records.

Supporting records. Original exports, exchange receipts, messages, URLs and screenshots, which connect the on-chain movement to the off-chain account of what happened.

Preservation record. The source, the collection time, the collector and file integrity details, which supports later review and establishes the chain of custody.

Cryptocurrency Investigations, Step by Step

Investigating cryptocurrencies at the transaction level moves through four stages, and each has an input, an action, an output and a limit. The work begins with the known transaction and not with a presumed offender.

Defining the Scope

The input is the complaint or alert, and the action is to state the question the trace must answer, such as where a specific transfer went, along with the period under review. The output is a scoped question tied to one starting transaction. The limit is that a broad question invites unsupported links between unrelated addresses.

Verifying the Transaction and Network

The input is the hash, the addresses and the stated chain. The action is to confirm that the hash resolves on that chain in a block explorer, that the token contract, where applicable, matches and that the amount and time agree with the victim’s records. The output is a verified starting event. The limit is that look-alike tokens, other networks and edited screenshots can all pass a casual check.

Tracing and Testing Hypotheses

The input is the verified transaction, and the action is to follow observable movements hop by hop while recording every branch. Each inference is written as a testable hypothesis, because a deposit at a service shows that the service received funds and not that a named user did. The output is an annotated trail with confidence labels. The limit is that mixers, bridges and sheer volume break or blur the trail.

Corroborating and Reporting

The input is the trail plus the off-chain evidence, and the action is to check address labels against independently sourced attribution, compare transfer timing with the victim’s messages and note branches that stay unresolved. The output is a report that separates confirmed facts, inferred links and unknown identities. The limit is that some identity questions remain unresolved without nonpublic provider records.

Transaction Tracing Methods and Their Limits

Every method used in investigating cryptocurrencies produces leads with a different degree of confidence, and none of them follows every transfer with certainty.

Transaction Graphs and Address Clustering

A transaction graph maps addresses as nodes and transfers as edges, which makes branching and consolidation visible. Address clustering groups addresses that appear to share a controller, using heuristics that yield probabilities and not proof. Explorer labels carry the same risk: the ICIJ and GIJN guide warns that blockchain exploration tools identify wallet owners but “this isn’t always reliable.” Graphs built with link analysis are readable, and each edge still needs its own evidence.

Cross-Chain Paths, Bridges and Mixers

A blockchain bridge splits a trail across two ledgers, so cross-chain tracing has to link the deposit on one chain to the release on the other. Some protocols expose identifiers and events that support a strong link, while timing and amount alone are weaker, so confidence depends on the bridge and the protocol evidence available. A crypto mixer pools funds from many users and obscures the relationship between deposits and withdrawals, so proposed links require corroboration and explicit confidence limits.

Some centrally issued stablecoins include controls that let the issuer block transfers involving particular addresses, as Circle describes for USDC, which is how issuers froze part of the Binance funds.

How OSINT Connects Wallet Addresses to Public Context

The ledger shows what moved, and public sources can show who advertised, registered or described the addresses involved. OSINT techniques start from one identifier and test where else it appears, and each pivot carries a qualification that is recorded with the result.

Wallet address to public mention. Donation pages, forum posts, code repositories and published payment instructions can show where an address was displayed. A published address does not prove that the publisher controls it.

Scam domain to public infrastructure. Registration information where available, certificate records and archived pages can connect a payment page to its hosting and history. Shared hosting and registration services do not prove common ownership.

Username to public profiles. Reused handles, linked websites and historical posts can connect accounts, but similar usernames can belong to different people.

Claimed company to official records. Company registers and applicable regulator registers can test a business claim, although registration does not authenticate a website or establish legitimacy.

Explorer label to original source. The provenance, publication date and underlying evidence of a label show whether it is evidence or an echo, because two tools may reproduce the same source and not corroborate each other.

Each source is recorded for what it establishes. A public page may show that an address was advertised by an account at a particular time, which does not identify who controls either one.

Tools for Crypto Forensic Analysis

Tools differ in purpose, access, coverage and evidential weight, and none of them settles attribution alone.

Explorers, Analytics and Off-Chain Research

Block explorers. Public interfaces open to anyone, usually one per chain family, show transactions, balances and contract details. They are the best way to verify a starting event, but they cover one network at a time, and the labels they display come from third parties.

Blockchain analytics platforms. Commercial services, usually accessed by license, cluster addresses, label entities and visualize flows across chains. Coverage depends on each provider’s data, and their attributions are assessments to corroborate and not findings.

Off-chain research. Open-source intelligence supplies the context that the ledger lacks, as the previous section shows, and each result is recorded with its source, version and access date.

In practice, explorers verify, analytics platforms map and off-chain research explains. Confidence depends on the quality and independence of the evidence, not the number of tools that agree.

What a Forensic Report Should Contain

A professional report is one that another analyst could repeat. It states the scope and the question, lists the sources, and presents a transaction table with the hash, addresses, amounts and timestamps for every hop. An annotated graph shows the paths, and a confidence assessment labels each link as confirmed, inferred or unknown.

The report closes with unresolved questions and a short handoff note for counsel, compliance staff or authorities. The note names the custodians that may hold relevant records and the requests that only they can answer.

Evaluating a Cryptocurrency Forensic Investigator

A credible provider can describe relevant experience with the same type of case, offer a written scope and deliverables, and share a redacted sample of past work. An independent review of the findings and a clear statement of what the report cannot prove are further signs. Cost depends on the number of chains and transactions, the volume of off-chain material, urgency and any testimony, and pricing is stated in writing before work begins.

Some patterns deserve caution. Guaranteed returns, unsolicited approaches and demands for further payments or secrets are warning signs of a recovery scam, and the FBI’s guidance for cryptocurrency scam victims advises caution toward anyone who claims to recover funds, since the offer may be another scam.

Reporting Crypto Fraud, Including Exchange-Related Cases

In the United States, the FBI asks victims to report at ic3.gov and to include the transaction hash, addresses, amounts, dates and a timeline. Report promptly even if some transaction details are missing. Elsewhere, the national police or financial-crime reporting body is the equivalent route. An agency decides whether to open a crypto scam investigation, and law enforcement reporting works best when the facts above are ready, because requests to an exchange depend on them.

Exchange-related cases split into three situations that need different routes.

Impersonation of an exchange. A scammer posing as the platform is reported as fraud, and contact details are checked by typing the exchange’s official address directly.

A transaction through an exchange. A deposit address shows custody and not a customer’s identity. Victims can send the transaction details to the exchange’s support team, which lets it review its own records, although a notification does not oblige it to freeze or return funds.

An incident at the exchange itself. Official announcements and support pages govern customer instructions, and detailed guidance for one platform belongs on its own maintained page.

Practical Example: Where a Trace Stops and Identity Begins

Consider a hypothetical example. A victim sends 5,000 units of a stablecoin to an address given by an online adviser, here called Address A.

Observation. The hash resolves on the stated network, the token contract matches, and the amount and time agree with the victim’s exchange export. Within an hour, Address A forwards the full amount to Address B in two transfers, and Address B moves it to Address C. Addresses A and B had no prior balance or intervening inflows of that token, so the onward transfers can be described as the victim’s funds.

Public-source finding. An archived version of the adviser’s website displays Address A as a payment destination. The investigator preserves the page, the capture date and the surrounding payment instructions. This supports an association between the website and the address at that time, and it does not establish who controlled the wallet.

Hypothesis. Address B behaves like a pass-through wallet, because it holds funds only briefly. Address C receives deposits from many unrelated addresses, and a block explorer labels it as an exchange deposit address.

Corroboration. The label is checked against an independently sourced attribution, and the later consolidation of Address C’s balance into a larger wallet fits the way exchanges sweep deposits. The result: the victim’s transfer reached Address C and the website displayed Address A, which are confirmed, and Address C is probably an exchange deposit address, which is inferred. Who controls Address A and who holds the account at the exchange stay unknown.

The report names the exchange as a custodian that may hold records and goes to counsel and the relevant authority. A freeze or return depends on the exchange and legal process, and the trace on its own recovers nothing.

The Takeaway

Investigating cryptocurrencies is a discipline of keeping three things separate: what the on-chain evidence shows, what public and off-chain records add and what remains unknown. The incidents above illustrate how compromised access can initiate losses, and speed and preservation decide how much of the trail can be used.

A trace is strongest when it begins with a verified transaction, links each address to public sources only as far as they support, labels every inference by confidence and ends with a report that another party can act on.

FAQ

How does OSINT support a blockchain trace?

OSINT connects what the ledger shows to public context, such as archived payment pages, forum posts, domain records, company registers and label sources. Each finding supports an association at a point in time and is recorded with its source. It narrows hypotheses about who is behind an address, and it does not replace on-chain verification or provider records.

Can stolen cryptocurrency be traced?

Transfers on public blockchains can usually be observed, so the path of stolen funds can often be followed until it reaches a service, a mixer or another chain where visibility drops. Freezing or returning the funds is a separate decision made by custodians, issuers and courts.

Can investigators identify a wallet owner?

Not automatically. Labels, clustering and public-source research can suggest who may control an address, and the case strengthens when independently sourced evidence agrees. Exchange account holders are identified through provider records that authorities or courts can request.

What evidence should be provided?

The chain and asset, the full transaction hash, the addresses, the timestamps with time zones, the dates and amounts of every transfer, and the original messages, receipts and exports that show how the transfers came about. Wallet secrets such as seed phrases and private keys are not submitted through ordinary reporting forms or shared with unsolicited contacts.

How long does an investigation take, and what does it cost?

Both depend on the number of chains and transactions, the access to off-chain records and the scope agreed in writing. A provider can estimate or agree a delivery schedule for defined work, but should not guarantee identification or recovery. A written scope with defined deliverables and transparent fees is the reliable guide.

Want to see how OSINT can help investigators connect wallet addresses to public sources, analyze relationships and document findings? Book a personalized demo to explore how SL CrimeWall brings public-source collection, link analysis and investigative records together in one platform.