How cryptocurrency movements are tracked. Introduction to blockchain tracing

Investigating incidents involving digital assets involves tracing the movement of cryptocurrency after theft, hacking, or other fraudulent schemes. GetBlock AML Research publishes a brief guide to blockchain tracing.

Unlike the traditional financial sector, where transactions pass through banks and other regulated institutions, blockchain operates differently: each transaction becomes part of an open ledger that cannot be altered. But it is the combination of transparency and pseudonymity that creates a dual effect — investigation becomes both accessible and technically challenging.

The main goal of such analysis is to understand how stolen or illegally obtained assets are moved. It is important to establish:

• the methods used by attackers to cover their tracks — through mixing services, bridges between networks, or DeFi protocols;
• which centralized exchanges ultimately receive funds for withdrawal in fiat or exchange.

Essentially, the investigation resembles a search for a “financial trail” that criminals try to obscure as much as possible. This is countered by special blockchain analysis techniques that allow investigators to reconstruct the chain of transactions, detect connections between wallets, and ultimately identify specific individuals involved.

To hide the path of stolen funds, attackers use a variety of obfuscation techniques. Their main task is to break the link between the source address and the final recipient. They use bridges to move between networks, mix assets, exchange on DEXs, split into many small amounts, convert to stablecoins, or more private coins. Increasingly, they also use second-layer solutions and combine several methods in a row.

The main ways to conceal the origin of funds

• Bridges — transferring assets from one network to another, making tracking more difficult.
• Mixers — methods of mixing coins that eliminate direct links between transactions.
• DEX exchanges — transferring funds to other tokens on decentralized platforms.
• Peel-chain (splitting) — sending small amounts to many different addresses.
• Chain hopping — sequential operations on several networks in a row.
• Conversion to stablecoins — simplifying the storage and withdrawal of funds.
• Privacy coins — moving to networks with a higher level of anonymity (e.g., XMR).
• Use of Layer 2 and rollups — dissolving transactions among more massive second-layer data flows.

Methods for tracking addresses during an investigation

One of the key tasks of an investigation is to establish a connection between addresses controlled by suspected attackers and centralized services through which funds can be withdrawn. To do this, a set of analytical approaches widely used in professional blockchain analytics practice is applied.

Deterministic Tracing

This method is used in situations where funds move in a straight chain without the intervention of multiple third-party addresses. It is effective when:

• transactions are sequential and unmixed;
• the network does not change (e.g., TRON → TRON);
• the entire path is easily traceable through open explorers.

The connection is confirmed based on a chain of hashes and timestamps without gaps.

Clustering and Behavioral Analysis

Used to identify groups of addresses controlled by the same entity. The following criteria are taken into account:

• common sources and recipients of funds;
• simultaneous activity;
• repetitive asset movement patterns;
• common technical characteristics.

This approach allows you to combine multiple intermediate addresses and prove that they belong to the same operator.

Taint Analysis

Allows you to determine the degree of “contamination” of addresses that have come into contact with stolen funds. The method helps to find out:

• what proportion of stolen funds ended up at a particular address;
• what portion reached exchanges, even after mixing;
• whether the address was involved in laundering.

Taint analysis is especially important in complex schemes involving mixers, bridges, and P2P platforms.

Correlation by time and volume

This method involves comparing transactions by:

• time of sending and receiving;
• transaction volume;
• intervals between transfers.

This makes it possible to increase the accuracy of determining the belonging of addresses to a single chain of events.

Determining final deposit addresses (CEX Attribution)

The method helps to establish the fact of assets arriving at centralized services. Confirmation is based on:

• databases of known deposit addresses;
• data from exchanges;
• memo or tag identifiers.

This allows us to accurately record the moment when funds cross the border of a centralized platform.

The combined use of these methods helps to reconstruct the entire path of assets, establish the controller, and determine the final withdrawal point.

Freezing funds and the ultimate goal of the investigation

One of the key stages is identifying the person who actually controls the stolen assets and tracking the movement of funds until they reach a centrally controlled platform.

Freezing assets on the exchange side serves two critical purposes:

• Preventive — stopping the further movement of stolen funds.
• Evidential — preserving data confirming the user’s connection to specific transactions.

It is important to understand that blocking is not the end of the investigation, but a tool that allows assets to be kept within the jurisdiction of the law until the actual perpetrator is identified.

Investigation results

Despite the technical component, the final result of the investigation is always legal. It consists of establishing the identity of the person involved in illegal transactions.

Blockchain shows all movements of funds, but does not reveal who controls the addresses. Therefore, at the final stage, centralized services play a key role, where the following are stored:

• user logins and devices;
• IP addresses;
• internal identifiers and transaction history.

This data makes it possible to identify the person whose account received the stolen assets.

Completion of the investigation

After identifying the person involved, there are several possible scenarios:

• Legal proceedings — filing a lawsuit, pressing charges, confiscating assets.
• Pre-trial negotiations — returning funds by agreement between the parties or through intermediaries.
• International cooperation — if the participants or platforms are located in other countries, the case escalates to the format of intergovernmental procedures.

Thus, investigation in the blockchain environment is a complex task that includes transaction analysis, identification of the asset controller, freezing of funds, and legal completion of the process, from court to return of the stolen funds.