Cryptocurrency and Blockchain Forensics

What it is and why it matters

A blockchain is a ledger that everyone can read and no one can quietly edit. Each transfer moves value from one address to another and the record is copied to thousands of computers. Addresses are not names, which is why people call cryptocurrency anonymous, but every movement is permanent and public, which is why it is better described as pseudonymous. The examiner's task is to connect addresses to people, and the usual bridge is the point where cryptocurrency meets ordinary money, an exchange that verified the customer's identity.

The work has an on-chain half and an off-chain half. On-chain, the examiner reads transactions, groups addresses that appear to belong to one wallet, follows funds through exchanges, mixers and other chains and attributes clusters to known services. Off-chain, the examiner looks at seized phones and computers for wallet apps, browser extensions, exchange logins and seed phrases of twelve or twenty-four words in notes and photos, as well as keys that may still be in memory. Neither half is enough alone.

In India the legal setting shapes the cases. The Income Tax Act defines a virtual digital asset and taxes gains at a flat rate with tax deducted at source on transfers. Since March 2023 providers of exchange, transfer and custody services for virtual digital assets are reporting entities under the Prevention of Money Laundering Act, 2002, registered with FIU-IND and bound to verify customers and report suspicious transactions. That makes registered exchanges the main source of identity in a trace. Most Indian cases involve investment scams, fake trading apps and peer-to-peer stablecoin deals rather than sophisticated laundering.

Types of digital evidence

Wallet Files and App Data
Desktop wallet files, mobile wallet app databases and browser extension storage holding addresses, transaction history and encrypted keys.
Seed Phrases and Private Keys
The words or key strings that control a wallet, found written on paper, photographed, typed into notes apps, saved in password managers or sent to oneself by chat.
Ledger Transactions
The public record of transfers between addresses, with amounts, times, fees and block heights, read from a node or an explorer.
Exchange Account Records
Identity documents, bank accounts, deposit and withdrawal addresses, trade history, login IP addresses and device information held by the exchange.
Browser and Chat Artefacts
Visits to explorers and exchanges, saved addresses, Telegram and WhatsApp groups where deals were arranged and screenshots of balances.
Memory Artefacts
Unlocked wallets, decrypted keys and session tokens present in RAM on a running machine and lost at shutdown.
Hardware Wallets
Devices such as those made by Ledger and Trezor and their companion apps, whose presence tells the examiner that keys exist even when they cannot be read.
Fiat Trails
Bank transfers, UPI payments and cash deals that bought or sold cryptocurrency, which connect ledger activity to a person.

Devices and data sources

Seized phones with wallet, exchange and messaging apps
Computers with desktop wallets, browser extensions and saved exchange sessions
Hardware wallets and their recovery cards
Paper, notebooks and photographs with seed phrases or addresses
RAM captured from running machines before shutdown
Public blockchains read through nodes, explorers and analytics platforms
Records from exchanges and other service providers obtained by lawful request
Bank and payment records that show the fiat side of each deal

How an examination runs

The order matters. Each step protects the one after it.

01
Authority
Confirm the basis for examining devices and for any step that touches funds. Moving or freezing assets is a legal act taken by the agency under its own powers, not an examiner's decision.
02
Spot the Indicators
Look for wallet and exchange apps, browser extensions, wallet file names, QR codes, address-shaped strings and groups of twelve or twenty-four common English words in notes, photos and chats.
03
Preserve the Volatile
If a machine is running and a wallet is open, capture memory before shutdown and record what was on screen. Keys in memory may be the only route to a locked wallet.
04
Extract and Decode
Image the devices, parse the wallet databases and extension stores and list every address, transaction and account identity found, with its source path.
05
Trace on Chain
Follow funds from the identified addresses using an explorer or an analytics platform. Group addresses with care, note each heuristic applied and record the block height and time of every observation.
06
Attribute Through Services
Where funds reach an exchange or other registered service, the investigating officer requests the customer records. Registration with FIU-IND tells the officer which Indian providers must respond.
07
Report the Chain and Its Gaps
Present the path from victim to cash-out as a chain of facts and inferences, labelling which is which, and give the value at the time of each transfer in rupees with the rate source.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

Blockchain: A ledger of transactions grouped into blocks, each linked to the last by a hash, copied across a network so that no single party can alter the history.
Address: A string derived from a public key that receives funds. A person can create as many as they like, which is why clustering matters.
Private Key: The secret that signs transactions from an address. Whoever holds it controls the funds, which is why its handling is an evidential and a security question.
Seed Phrase: A list of twelve or twenty-four words from which all of a wallet's keys are derived. It is the most valuable and most dangerous thing an examiner can find.
UTXO: Unspent transaction output, the model Bitcoin uses, where each transaction spends earlier outputs and creates new ones. Ethereum uses account balances instead.
Custodial and Non-Custodial: A custodial wallet is held by a service that knows the customer. A non-custodial wallet is controlled by the user alone, with no one to ask.
Virtual Asset Service Provider: The FATF term for exchanges, custodians and transfer services. Indian law calls the same businesses virtual digital asset service providers.
Mixer: A service that pools funds from many users and pays them out in a way meant to break the link between input and output. Some mixing can be partly unwound, some cannot.
Stablecoin: A token pegged to a currency such as the US dollar. Widely used in peer-to-peer deals in India and often moved on networks with low fees.
Clustering Heuristic: A rule such as common input ownership used to guess that several addresses belong to one wallet. Useful, but it is an inference and can be wrong.

Challenges and limits

What makes it hard

Privacy coins and mixing services hide the path, and some traces simply end
Chain hopping through swaps and bridges moves funds across ledgers that tools cover unevenly
Exchanges abroad respond slowly or not at all, and funds are often cashed out before a request lands
Decentralised exchanges and peer-to-peer deals leave no customer record to request
Clustering and attribution are probabilistic, and a confident-looking graph can rest on a weak heuristic
Values swing, so the amount involved must be fixed to a time and a rate source for every report
Finding a seed phrase creates a duty to secure it, because anyone who reads it can move the funds

Keeping the evidence intact

Never send, move or test a transaction from any address found in evidence without written authority and a documented reason
Photograph and seal seed phrases and keys, restrict who sees them and record every disclosure
Record the block height, the explorer or platform used and the time of every on-chain observation so it can be repeated
Hash device images and exported wallet data and keep source paths for every address listed
Label every attribution as fact from a record or inference from a heuristic, and check important links with a second method

Standards and legal considerations

Prevention of Money Laundering Act, 2002 and FIU-IND
Since the notification of March 2023, providers of exchange, transfer, safekeeping and related services for virtual digital assets are reporting entities under the Act. They register with FIU-IND, verify customers, keep records and report suspicious transactions, which makes them the main source of identity in a trace.
Income Tax Act, 1961, Virtual Digital Assets
Section 2(47A) defines a virtual digital asset. Section 115BBH taxes income from its transfer at a flat 30 per cent with only the cost of acquisition deductible, and Section 194S requires 1 per cent tax deducted at source on transfers to residents since July 2022. These create records that investigators can use.
FATF Recommendation 15 and the Virtual Assets Guidance
The international standard that brought virtual assets and their service providers under anti-money laundering rules, including the travel rule for transfers, with updated guidance issued in October 2021.
ISO/IEC 27042:2015
Guidelines for the analysis and interpretation of digital evidence, which frame the distinction between a ledger record and an attribution drawn from it.
Read the guide
ISO/IEC 27037:2012
The collection and preservation guidance for the devices where wallets and keys are found.
Read the guide

In practice

A Fake Trading App
Dozens of complainants paid into a trading platform that showed growing balances and then stopped allowing withdrawals. The deposit addresses on the complainants' exchange records are grouped by common input ownership into one cluster, which sent funds in bulk to a deposit address at an overseas exchange. The officer requests the account records through the proper channel.
A Ransom Followed to Cash-Out
A company pays a ransom in bitcoin. The examiner records the payment transaction, follows the funds through two hops and a swap into a stablecoin and finds a deposit to an Indian exchange registered with FIU-IND. The exchange's customer record, obtained by the investigating agency, identifies a money mule.
Twelve Words in the Gallery
A seized phone contains a photo of a handwritten list of twelve words. The examiner recognises a seed phrase, seals the finding, restricts access and reports it to the officer. The wallet it controls is identified from the phone's wallet app without any funds being touched.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

AdvancedAdvanced & Specialised ForensicsCryptocurrency / Blockchain ForensicsTrace bitcoin and USDT flows, group wallets and prepare requests to exchangesIntermediate

AdvancedAdvanced & Specialised ForensicsOSINT / Open Source IntelligenceFind, verify and record public online information in a form a court can checkIntermediate

MalwareIncident Response & Malware AnalysisMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.IntermediateMalware Analyst

LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.BeginnerDCFA

Careers that use it

Cybercrime Investigator

Questions people ask

Is cryptocurrency anonymous?

No. It is pseudonymous. Addresses are not names, but every transaction is public and permanent, and most people eventually use an exchange that verified their identity. Privacy coins and mixers make tracing harder, not impossible in every case.

Can seized cryptocurrency be recovered?

Only with the keys, and only under lawful orders. If the keys are not found, the funds cannot be moved by anyone, including the authorities. Securing keys found in evidence is itself a serious responsibility.

Do examiners need expensive analytics platforms?

Public explorers and open tools go a long way for simple traces. Commercial platforms add attribution databases and automation that help on complex or high-volume cases. Either way the examiner must understand the heuristics the tool applies.

What Indian records exist for a cryptocurrency user?

Registered exchanges hold identity, bank and transaction records under the Prevention of Money Laundering Act, 2002, and tax deducted at source on transfers leaves a trail with the tax authorities. Peer-to-peer deals outside registered services leave far less.