Blockchain Investigations & Crypto Forensics: From Alert to Evidence

Every stolen token, ransom payment, and laundered deposit leaves a permanent record on a public ledger. A blockchain investigation is the work of reading that record: following the money from address to address, attaching real-world identity to pseudonymous wallets, and turning raw transactions into evidence a compliance team, a bank, or a court can act on. This guide explains how blockchain investigations and crypto forensics work, walks through two recent landmark cases, and shows what to look for in an investigation platform.

What is a blockchain investigation?

A blockchain investigation is the process of tracing cryptocurrency movements across public ledgers to identify the parties behind a transaction, measure their exposure to illicit activity, and produce evidence for compliance or law enforcement. It combines transaction tracing, entity attribution, and risk scoring. Crypto forensics is the same discipline applied to a specific incident, such as a hack, fraud, or ransomware payout.

The three terms people use interchangeably are worth separating. Blockchain analytics is the broad field of extracting meaning from on-chain data. Blockchain intelligence is the labelled, contextual layer that names the wallets and services behind addresses. A blockchain investigation is the applied work: a specific question ("where did these funds go, and who controls the destination?") answered with those tools. Scorechain groups these capabilities under Digital Asset Intelligence, a single graph that supports screening, monitoring, and investigation rather than treating forensics as a separate silo.

Why screening a wallet once is no longer enough

Investigations have moved from a niche law enforcement skill to a core compliance requirement. The EU's Markets in Crypto-Assets Regulation (MiCA), the Sixth Anti-Money Laundering Directive (AMLD6), and the incoming EU Anti-Money Laundering Regulation (AMLR) all expect Crypto-Asset Service Providers (CASPs) to establish the source and destination of funds, not screen a wallet once at onboarding and move on. The Financial Action Task Force (FATF) Travel Rule adds an obligation to exchange originator and beneficiary information between Virtual Asset Service Providers (VASPs).

When a supervisor asks a VASP to explain why it processed a transaction later linked to a sanctioned entity, "the address was clean when we checked" is no longer a defence. Firms need to reconstruct the full path of funds, show indirect exposure several hops away, and document the decision. That is an investigation, and increasingly it is expected as routine practice rather than a response to a subpoena.

How blockchain forensics works

Blockchain forensics follows a repeatable lifecycle. An investigator starts from a trigger (an alert, a victim report, or a suspicious counterparty), traces the flow of funds across the ledger, clusters related addresses to a single controlling entity, attributes that entity to a real-world service, and packages the findings as reviewable evidence. The public and permanent nature of most blockchains is what makes each step possible.

The lifecycle has five stages:

1. Trigger and scoping. A transaction monitoring alert, a Know Your Transaction (KYT) risk flag, a law enforcement request, or a theft report defines the starting address and the question to answer.
2. Tracing. The investigator follows inputs and outputs forward and backward through the transaction graph, across swaps, bridges, and decentralised exchanges.
3. Clustering and attribution. Addresses controlled by the same actor are grouped using techniques such as multi-input clustering, then matched against a database of labelled entities to name the exchanges, mixers, and services involved.
4. Risk assessment. Each address and counterparty is scored for direct and indirect exposure to categories such as sanctions, ransomware, darknet markets, or fraud.
5. Evidence and reporting. The path, the attributions, and the risk findings are documented in a form suitable for a suspicious activity report, an internal case file, or a court exhibit.

Tracing funds across multiple blockchains

The hardest part of a modern investigation is that criminals rarely stay on one chain. Stolen funds are swapped through decentralised exchanges, moved across bridges between blockchains, and passed through mixers designed to break the link between source and destination. Cross-chain tracing follows that movement automatically, reconstructing a single path from what looks, on any one ledger, like an unrelated set of deposits.

This is where indirect exposure matters. A wallet may never have touched a sanctioned address directly, yet sit two or three hops downstream from one. A credible investigation measures that distance and weighs it, rather than treating exposure as a simple yes or no. Mixers, bridges, and privacy protocols raise the difficulty, but they rarely erase the trail: funds that enter a mixer still have to leave it, and consolidation patterns, timing, and amounts often reconnect the pieces.

Linking on-chain activity to off-chain identities

Attribution is what turns a string of hexadecimal into an actionable name. It works in two steps. First, clustering groups the addresses that provably share a controller. The common-input-ownership heuristic does most of this work, treating addresses spent together in one transaction as one owner, and change-address analysis extends a cluster by identifying the address that receives the leftover value from a payment. Second, those clusters are matched against a library of labelled entities built from exchange deposit records, known service wallets, sanctions lists, prior investigations, and on-chain behaviour. Scorechain maintains more than 939,000 labelled on-chain entities [VERIFY figure]. That library is the layer that lets an investigator say not just "the funds moved here" but "the funds reached this named exchange, on this date, in this amount," which is the difference between an interesting chart and admissible evidence.

Case study: tracing a ransomware payout

Ransomware is where tracing and attribution meet enforcement. In August 2025, the US Department of Justice unsealed warrants in the Northern District of Texas showing the seizure of 2.8 million dollars in cryptocurrency, 70,000 dollars in cash, and a luxury vehicle from Ianis Aleksandrovich Antropenko, tied to the Zeppelin ransomware operation (US Department of Justice, via CyberSecurityNews, August 2025).

It is a textbook run through the lifecycle above. Zeppelin was a ransomware-as-a-service strain that encrypted victims' systems and extorted payment in cryptocurrency, and the proceeds had to be laundered before they could be spent. Antropenko moved them through ChipMixer, a mixing service that had itself been dismantled by law enforcement in 2023. Investigators did not stop at the mixer. They used multi-input clustering, transaction graph analysis, and temporal spending patterns to follow the funds through and past it, and found that the money had been moved repeatedly and then consolidated into a single wallet the operator controlled directly (US Department of Justice, via CyberSecurityNews, August 2025).

Two things made that possible. Multi-input clustering rests on a simple property of most blockchains: when several addresses are spent together as inputs to one transaction, they are almost always controlled by the same party, because the transaction needs every one of their private keys to sign. Chained across thousands of transactions, that single heuristic rebuilds an actor's wallet set even after funds pass through a mixer. Temporal analysis then matches the amounts and timing of deposits into the mixer against withdrawals out of it. The mixer slowed the trace; it did not defeat it. Mixing and consolidation leave signatures of their own, and patient graph analysis, backed by federal forfeiture statutes, recovered both the path and the funds.

Case study: tracing a major exchange hack

The largest cryptocurrency theft on record shows the same techniques at nation-state scale. On or about February 21, 2025, more than 1.5 billion dollars in virtual assets were stolen from the exchange Bybit. Five days later the FBI attributed the theft to North Korea, naming the activity "TraderTraitor," the label it uses for this Democratic People's Republic of Korea cyber operation associated with the Lazarus Group (FBI IC3 Public Service Announcement I-022625-PSA, February 26, 2025).

How the funds were taken

The breach was not a flaw in Bybit's own on-chain logic. Attackers compromised a developer machine belonging to Safe{Wallet}, the multisignature interface Bybit relied on, and injected malicious code into the web application its signers used. When Bybit moved assets from its Ethereum multisignature cold wallet to a hot wallet, the manipulated signing interface rewrote the transaction, and more than 400,000 ETH and staked ETH, worth over 1.5 billion dollars, went to an attacker-controlled address instead of the intended destination (BleepingComputer, reporting the Safe Ecosystem Foundation findings, February 2025). Forensic firms Sygnia and Verichains confirmed the compromise. There is a lesson here before any tracing begins: the ledger behaved exactly as designed, and the human signing layer was the weak point.

How investigators followed the money

Once the funds moved, the investigation became a race to map them faster than the attackers could fragment them. Figures published by Bybit chief executive Ben Zhou on March 4, 2025 show the pattern. The attackers converted roughly 83% of the stolen assets, about 417,348 ETH worth close to 1 billion dollars, into Bitcoin, spreading it across 6,954 wallets at an average of 1.71 BTC each. Around 361,255 ETH, some 900 million dollars, was pushed through THORChain, a cross-chain swap protocol, and remained traceable throughout. Fragmentation and chain-hopping are the whole point of an operation like this: split one conspicuous balance into thousands of small, unremarkable ones across several blockchains, and bet that no single analyst can hold the full picture. Cross-chain tracing and entity attribution are what keep that picture intact, naming each exchange, bridge, and swap service the funds touch. Sanctions screening matters here too, because the FBI has published wallet addresses tied to the operation, and any dealing with them carries designated-entity exposure.

What the trace recovered

Public ledgers do not forget, which is why so much of the value stayed in view. By early March 2025 Bybit reported that 77% of the funds, about 1.078 billion dollars, remained traceable, 3% had been frozen with the help of 11 cooperating entities, and 20% had gone dark, much of it through services that refused to cooperate, including the exchange eXch. That split is the real lesson of the case. Tracing is not the same as recovery, but it turns a theft into a live, monitored map: frozen where exchanges cooperate, watched everywhere else, and ready to serve as evidence the moment laundered funds reach a regulated off-ramp.

The path the funds took, and where the trace stands, looks like this:

Figure: simplified fund flow of the Bybit theft, based on figures reported by Bybit on March 4, 2025.

"The permanence of the ledger is the investigator's advantage," says Lisa Boussard, Chief Strategy Officer at Scorechain. "Criminals can fragment funds across thousands of wallets and hop between chains, but they cannot delete the record. The work, for us and for our clients, is keeping the map current, so that the moment those funds reach a regulated exchange, the exposure is already documented."

Common laundering typologies investigators look for

Most investigations turn on recognising a handful of recurring laundering patterns. Criminals reuse the same techniques to put distance between stolen funds and a cash-out point, and an experienced investigator reads them the way a fraud analyst reads a suspicious invoice. The patterns below appear again and again, including in the two cases above.

• Dispersion: splitting one large balance into many small transfers across thousands of addresses to dilute the trail, as in the 6,954 Bitcoin wallets used after the Bybit theft.
• Chain-hopping: swapping assets across blockchains through bridges and cross-chain protocols such as THORChain, so that following the money means following it off one ledger and onto another.
• Mixing: routing funds through a mixer or privacy protocol to break the direct link between deposit and withdrawal, the technique the Zeppelin operator used through ChipMixer.
• Peel chains: moving funds through a long sequence of addresses, peeling off a small amount to a cash-out point at each hop while the bulk moves on, so no single transaction looks significant.
• Consolidation: the mirror image of dispersion, pulling scattered funds back into one wallet before a cash-out, which is often where an operator's own control of the addresses becomes visible.

None of these defeats a determined trace on its own. They raise the cost and the time, which is why automation, cross-chain coverage, and a deep attribution database matter more than any single clever query.

Blockchain investigation tools and techniques

Modern investigation platforms share a common core of capabilities. A buyer evaluating any tool, including Scorechain Investigator, Chainalysis Reactor, Elliptic Investigator, TRM Forensics, Merkle Science Tracker, or Crystal Expert, should expect all of the following as table stakes:

• Visual fund-flow graph: an interactive map of wallet-to-wallet movement with annotations and adjustable layouts.
• Cross-chain tracing: automatic following of funds through bridges, swaps, decentralised exchanges, and mixers across many blockchains.
• Entity attribution and clustering: a database of labelled counterparties, with clustering to group addresses under one controller.
• Automated risk scoring: direct and indirect exposure scores for addresses, wallets, and transactions.
• Case management: cases, statuses, notes, and collaborative review.
• Evidence export: reports formatted for suspicious activity reporting and law enforcement submission.
• An AI assistant: plain-language summaries of fund flows and risk.
• API and integration: the ability to feed investigation data into an existing compliance stack.

Chain counts and entity-label totals are where vendors compete loudest, but they have become expected claims rather than points of difference. The more useful questions are how transparent the risk methodology is, how the tool handles cross-chain and indirect exposure, and whether the AI layer is auditable.

Inside Scorechain Investigator

Scorechain Investigator is Scorechain's dedicated exploration and investigation tool, built to take an analyst from a single address to a complete, documented case. It runs on the same Digital Asset Intelligence graph as Scorechain's screening and monitoring products, so an alert can move into a full investigation without leaving the platform or switching data sources.

At its core is a graph-based fund-flow workspace. An investigator seeds the graph with an address or a known entity, expands outward node by node, groups related addresses into a single entity node, and reads the flow of funds visually rather than from raw transactions. It is built for exactly the cases where tracing usually breaks down: busy addresses with tens of thousands of interactions, swaps between assets, and funds moving through mixers.

Several capabilities set the approach apart from the incumbent tools.

• One tool across blockchains. Scorechain Investigator queries each blockchain's backend and aggregates the results into a single graph, so a cross-chain trace stays in one workspace instead of forcing the analyst to stitch together a separate tool for each chain.
• Interoperability, not a walled garden. An investigation can be exported to widely supported graph formats for use in other analysis tools, so the work is not locked inside one vendor's application. Most competitor tools keep the graph inside their own product, and this is a deliberate difference.
• Filtering built for real laundering patterns. An analyst can filter a trace by amount and asset, which is what makes a mixer or a dust-seeded path workable. Filter out the round-amount noise and the real outgoing hop becomes findable, the exact problem the typologies above describe.
• A transparent, invertible risk score. Scorechain scores risk from 0 to 100, where a lower score means higher risk and 0 is maximum risk. The scale is granular and auditable, so an analyst can see why a score landed where it did rather than accept a black-box flag. [VERIFY: 47 risk categories.]
• European-native by design. Scorechain is built in Luxembourg and holds ISO/IEC 27001:2022 certification. For EU CASPs and institutions, evidence produced under MiCA, AMLD6, and the Travel Rule, with European data handling, is a design principle rather than an afterthought.

Central to Scorechain's direction, and on the near-term roadmap, are real-time tracking that flags fresh movement in an open case so an investigator can follow a hacker's funds as they move, collaborative casework with shared comments and tagging, and an agentic AI layer delivered through Scorechain MCP that automates parts of the investigative workflow through an open, tool-callable interface rather than a chat box locked inside one application.

Positioned against the market, Scorechain Investigator combines investigator-grade depth with the transparency, interoperability, and European framing that the large, US-centric platforms treat as secondary. Named competitors such as Chainalysis, Elliptic, and TRM Labs offer mature, well-regarded products. Scorechain's differentiation is the shared intelligence graph, the auditable risk methodology, the open export path, and the MiCA-native posture, not a claim to hold more of any single metric.

How law enforcement and compliance teams use investigations

The same platform serves several audiences. Compliance teams at VASPs and banks use investigations to clear or escalate alerts, establish source of funds, and file well-documented suspicious activity reports. Financial institutions use them to assess counterparty and correspondent risk before onboarding. Law enforcement uses them to trace stolen or extorted funds toward an off-ramp where identity can be compelled.

For a VASP, a common workflow is counterparty due diligence: before opening or continuing a relationship, the team investigates the counterparty's on-chain history, measures indirect exposure to high-risk categories, and records the finding. Scorechain's Know Your VASP report supports this directly. The through-line across every audience is the same: an investigation converts on-chain activity into a defensible, documented decision.

Frequently asked questions

What is the difference between blockchain analytics and a blockchain investigation?

Blockchain analytics is the broad discipline of extracting insight from on-chain data. A blockchain investigation is the applied work of answering a specific question, such as tracing where stolen funds went and who controls the destination, using analytics, attribution, and risk scoring together.

How are stolen cryptocurrency funds traced?

Investigators start from the theft address and follow the funds across the ledger, through swaps, bridges, and mixers, using clustering to group addresses under one controller and attribution to name the services the money reaches. Public blockchains keep a permanent record, so even fragmented, cross-chain movement can usually be followed, as the 2025 Bybit investigation showed.

Can transactions through a mixer or bridge still be traced?

Often, yes. Mixers and cross-chain bridges raise the difficulty but rarely erase the trail. Funds that enter a mixer still have to leave it, and clustering, timing analysis, and consolidation patterns frequently reconnect the path, as the 2025 Zeppelin ransomware seizure showed.

How do investigators connect a wallet to a real-world identity?

Through clustering and attribution. Clustering groups addresses that provably share a controller, and those clusters are matched against a database of labelled entities built from exchange data, known service wallets, sanctions lists, and prior cases.

What does the Scorechain risk score mean?

Scorechain scores risk on a scale of 0 to 100 where a lower score indicates higher risk, and 0 is the highest risk. The scale is designed to be transparent and auditable so an analyst can see the basis for each score.

Do MiCA and the Travel Rule require blockchain investigations?

They require the underlying capability. MiCA, AMLD6, and the FATF Travel Rule oblige CASPs and VASPs to establish the source and destination of funds and to exchange originator and beneficiary information, which in practice means being able to trace and document the flow of funds.

See it on your own data

Scorechain Investigator brings tracing, attribution, and transparent risk scoring into one European-native workspace, on the same intelligence graph as your screening and monitoring. To see how it handles a real investigation, book a demo or explore Flux analysis, transaction monitoring, and the Know Your VASP report.