How to Trace Cryptocurrency Transactions in an Investigation

The most common mistake in cryptocurrency cases is to assume that crypto is anonymous. In reality, Bitcoin, Ethereum, and most tokens such as USDT are pseudonymous: every transaction is permanently recorded in a public blockchain, and the investigator’s task is to link a wallet address to a specific person. In my expert practice, a chain of crypto transactions can often be reconstructed even more precisely than the movement of funds through classic banking channels — you simply need to understand where technical tracing ends and where work with exchange data begins.

Pseudonymous, not anonymous: the key distinction

This is the premise from which any work with crypto assets should start.

• Public blockchains (Bitcoin, Ethereum, and the tokens built on them — notably USDT in the ERC-20 and TRC-20 standards) are open databases. Every entry is visible to anyone and stays there permanently: the ledger cannot be edited or deleted.
• A wallet address is a pseudonym, not a name. Until an address is tied to a person, the investigation sees the movement of funds but not the owner.
• Deanonymization is the act of establishing the link “address ↔ person.” This is exactly what blockchain analysis (chain analysis) is designed to achieve.

The exception is so-called privacy coins, which conceal data at the level of the protocol itself:

Asset type	Examples	Traceability of transactions
Transparent blockchains	BTC, ETH, USDT (ERC-20/TRC-20)	High — public, immutable ledger
Privacy coins	Monero (XMR), Zcash in shielded mode	Low — amounts and addresses hidden by the protocol

So the first practical question in a case is which asset we are dealing with. For Bitcoin or USDT, tracing is almost always technically possible; for Monero, it is extremely limited.

What the blockchain records, and why it is evidence

Every transaction carries a set of immutable attributes that become evidentiary “anchors”:

• the transaction hash — the unique identifier of a specific transfer;
• the sender and recipient addresses;
• the amount and the type of asset;
• the timestamp (block time) and the block number.

These data are immutable: an entry in the blockchain cannot be rewritten. That is why it is critical to correctly preserve the transaction hashes, addresses, and timestamps — not with a screenshot from an explorer website, but with a reference to the specific block and the ability for anyone to verify it independently. This reproducibility is precisely what separates evidence from assumption.

Methods of chain analysis

Tracing is not “intelligence-agency magic” but a set of logical methods for working with open data.

Address clustering

A single actor usually operates not one address but many. Clustering means grouping addresses that, with high probability, belong to the same owner into a single “wallet.” This is how scattered transfers add up into a coherent picture of the behavior of one person or service.

Heuristics

Clustering relies on behavioral assumptions (heuristics), in particular:

• common-input-ownership — if several addresses jointly sign a single transaction, they are most likely under unified control;
• change address — identifying the address to which the “change” is returned after a payment;
• peel chain — the characteristic “peeling off” of small amounts from a large balance through a sequence of transfers.

It is important to remember that heuristics yield probability, not one-hundred-percent identity. A responsible conclusion always reflects that level of probability rather than presenting an assumption as fact.

Entry and exit points

The most reliable path to deanonymization lies at the points where crypto meets the real world: exchanges and swap services with a KYC procedure (know-your-customer identification). When funds enter or are withdrawn from an exchange, the platform knows who stands behind the account. The goal of tracing, therefore, is to follow the chain to such an entry/exit point, after which identifying the person becomes a matter of a request to the exchange.

How to obtain the data that links an address to a person

The blockchain itself is public, but the exchange keeps its customer data private. It can only be obtained through procedural means. Dedicated legislation on virtual assets in Ukraine is still taking shape, so in practice investigations rely primarily on the general mechanisms of the Criminal Procedure Code of Ukraine (KPK) and on anti-money-laundering (financial monitoring) law.

Ukrainian platforms and services

• In criminal proceedings, the basis is a ruling of the investigating judge on temporary access to items and documents (Chapter 15 of the Criminal Procedure Code, Articles 159–166). It is this ruling that compels disclosure of KYC data, transaction history, and the linked account details.
• Providers of services connected with the circulation of virtual assets are classified as primary financial-monitoring entities under the law on preventing and countering money laundering, and the relevant information is aggregated by the State Financial Monitoring Service (Derzhfinmonitoring).

Foreign exchanges

Most large platforms are registered abroad. Data from them is obtained through the institution of international legal assistance (mutual legal assistance, MLAT) under the procedure the Criminal Procedure Code provides for international cooperation. In practice this is the longest stage, so the request should be initiated as early as possible, as soon as the chain has been traced to a specific exchange.

Two examinations: one traces the chain, the other calculates the sums

This is the point on which parties most often get confused. A cryptocurrency case usually requires knowledge from two different fields — and therefore two areas of expert work.

Examination	Class of specialties	What it establishes
Computer-technical	Class 10	Traces the chain of transactions; verifies hashes, addresses, wallet attribution, and the technical circumstances of transfers
Economic	Class 11 (11.1–11.3)	Calculates sums and the amount of damages; reconciles asset movements with accounting and documents

Forensic expert activity in Ukraine is conducted under the Law of Ukraine “On Forensic Expert Activity,” while the list of examination types and expert specialties is set by the Instruction on the appointment and conduct of forensic examinations, approved by Order of the Ministry of Justice of Ukraine No. 53/5. It is under this list that computer-technical studies fall into Class 10 of specialties, and economic ones into Class 11.

A computer-technical examination answers the question “how did the assets move technically,” while an economic one answers “how much is that in monetary terms and what is the economic result.” That is why more complex cases call for a comprehensive (multidisciplinary) examination, in which specialists from different fields work toward a joint conclusion. The legal basis for appointment is the Criminal Procedure Code provision on engaging an expert where special knowledge is needed to establish the facts; analogous mechanisms are provided by the Commercial Procedure Code, the Civil Procedure Code, and the Code of Administrative Procedure, while tax control is exercised within the framework of the Tax Code.

Within their respective competencies, such cases are handled by the Bureau of Economic Security (BEB), the State Tax Service (DPS), the State Financial Monitoring Service (Derzhfinmonitoring), and the National Agency on Corruption Prevention (NAZK), while anonymized court decisions involving similar examinations are available in the Unified State Register of Court Decisions.

The limits of the method: where the chain “gets lost”

An honest specialist always spells out the limitations. The traceability of crypto is not boundless — there are tools that complicate or break the analysis:

• mixers and tumblers (including CoinJoin) — deliberately blend the funds of many users, destroying the direct “from–to” link;
• cross-chain bridges — move assets between different blockchains, so the trail has to be picked up again in another ledger;
• decentralized exchanges (DEX) — operate without KYC and therefore hold no data about the customer’s identity;
• privacy coins — conceal amounts and addresses at the protocol level.

Yet even these tools rarely deliver complete anonymity. Funds must ultimately “exit” into fiat somewhere, and entries and exits, timing correlations (timing analysis), characteristic amounts, and cross-referencing with off-chain data often make it possible to restore the picture. A broken chain is not a dead end but a signal to shift the emphasis from pure chain analysis to other sources of evidence.

Common mistakes to avoid

• Giving up too early by believing in “anonymity.” A pseudonymous asset is traceable in most cases — abandoning the analysis costs lost evidence.
• Overstating the result. Attribution of an address to a specific person cannot be asserted from clustering alone — it requires confirmation from an entry/exit point or from other case materials.
• Equating control over a wallet with ownership. The person who signs transactions is not always the beneficiary — these are different questions.
• Preserving evidence improperly. A screenshot without a hash, address, and block reference is easy to challenge; what must be recorded are verifiable attributes.
• Confusing competencies. Technical tracing of the chain and calculation of damages are different examinations; the wrong choice of direction drags the case out.

Cryptocurrency transactions are traceable far more often than is commonly assumed — but the quality of the result depends on choosing the right method, obtaining the data lawfully, and preserving the evidence competently. If, as a lawyer, investigator, or business leader, you are dealing with the movement of virtual assets in your case, it is wise to engage a forensic expert at an early stage. I would be glad to help you understand your situation within the bounds of the law and prepare a well-founded expert opinion.