Bitcoin on guard of the law: how BTC helped to identify the criminal

Recently, there was an event that once again proves that the anonymity of cryptocurrencies is a myth. Law enforcers managed to track the movement of funds in BTC and identify the criminal. GetBlock AML Research publishes the details of the operation.

Your data is no longer yours

In June 2025, with international cooperation, law enforcement agencies from different countries shut down BreachForum, one of the largest trading platforms for stolen identities. Five administrators of the platform (known by their aliases: Shinyhunter, Noct, and Depressed) were detained and arrested.

Also in February 2025, Kai West, the head of the IntelBroker fraud group that owned the BreachForum platform, was arrested in France. West’s identity and his whereabouts were helped by a coordinated law enforcement operation using bitcoin.

How bitcoin led to criminals

In 2023, IntelBrokers wanted to sell a voluminous database of stolen data. Law enforcers seized the moment and planned an operation in which an undercover operative attempted to buy the database. All IntelBroker transactions were conducted in Monero (XMR), but the operative managed to convince the scammers to accept payment in BTC. It was this mistake by the attackers that led to their identification and subsequent arrest.

Kai West’s (IntelBroker) profile on the BreachForum platform.

Thanks to the BTC transaction, law enforcers were able to find out the attacker’s blockchain address and then track the movement of funds. It turned out that cryptocurrency from the Ramp crypto exchange was transferred to the address. The account on the crypto exchange, from which the withdrawal transactions were made, contained the attacker’s real name (Kai Logan West) and his real date of birth.

Movement of funds through Kai West’s wallet. Visualization: Chainalysis

Some of the funds received from the transaction were sent to Coinbase. An account on the exchange was opened in the name of Kyle Northern, but this data also eventually led law enforcement to Kai Logan West. An IntelBroker group-affiliated email address ([email protected]) was later discovered to have also been used to register Kai West’s LinkedIn account. West’s profile revealed that he had previously worked as a security researcher for the National Crime Agency.