In This Article
When people ask how a crypto forensic investigator actually traces stolen funds, the answer is: specialized software, structured methodology, and a substantial amount of manual analysis. There is no single button that reveals who stole your cryptocurrency. The work requires the right tools applied with the right analytical framework.
This article breaks down the specific tools and techniques used in professional crypto forensics — from the commercial platforms that power government investigations to the open-source block explorers that form the foundation of any on-chain analysis. Understanding these capabilities helps you evaluate what an investigation can realistically accomplish in your case.
Commercial Crypto Forensics Platforms
The major commercial platforms in crypto forensics share a core capability that free tools lack: massive, continuously updated databases that attribute wallet addresses to real-world entities. These attribution databases are built through a combination of proprietary research, transaction monitoring, exchange data partnerships, and intelligence gathered from investigated cases over years.
The most widely used crypto forensics platform in law enforcement — used by FBI, Europol, IRS-CI, and dozens of other agencies. Reactor provides a visual transaction graph interface where investigators can expand wallet clusters, identify entity tags, and build documented case timelines. Its attribution database covers exchanges, mixers, darknet markets, ransomware infrastructure, and known fraud operations.
Reactor's strength is depth of attribution data and court-tested credibility. Its limitation is cost: enterprise licensing is priced for government agencies and large compliance teams, not independent investigators serving individual victims.
Elliptic competes directly with Chainalysis in the enterprise market and is particularly strong on DeFi and cross-chain analysis. Elliptic's Holistic Blockchain Analytics covers cross-chain transactions and bridges more comprehensively than most competitors — relevant for cases where stolen funds were quickly bridged from Ethereum to another chain. Used by financial institutions for compliance as well as investigators for case work.
TRM Labs has grown rapidly as a Chainalysis alternative, with strong coverage of emerging chains and deep integration with exchange compliance teams. TRM's real-time transaction monitoring is used by exchanges for AML screening; its investigative module is used by law enforcement and compliance teams. Notable for high-quality risk scoring models and DeFi transaction decoding.
Crystal provides blockchain analytics with a focus on compliance and financial crime investigation. Particularly strong on Bitcoin analysis with extensive UTXO clustering. Used by investigators and compliance teams in Europe and increasingly in the US. Competitively priced relative to Chainalysis for investigators not requiring the full enterprise feature set.
Open-Source and Free Investigation Tools
Commercial platforms are the backbone of serious investigations, but open-source and free tools play an important supporting role — for verification, for chains not covered by commercial platforms, and for investigators building their own analysis capabilities.
Every blockchain has one or more public block explorers that expose raw transaction data. These are the foundation of any crypto forensic analysis — the authoritative source for transaction hashes, block confirmations, timestamps, and raw address balances.
- Blockchain.com / Mempool.space — Bitcoin transaction explorer
- Etherscan.io — Ethereum and EVM chain standard
- Tronscan.org — Tron chain analysis (critical for USDT-TRC20 cases)
- Solscan.io / Explorer.solana.com — Solana transaction explorer
- BscScan.com — Binance Smart Chain
Block explorers provide raw data. They do not provide entity attribution — you can see that funds moved from Address A to Address B, but you cannot determine from the explorer alone whether Address B belongs to Binance, a mixer, or a private wallet.
A free visual transaction graph tool for Ethereum and EVM chains. Useful for quickly mapping fund flows without requiring a commercial platform license. Not as comprehensive as Chainalysis or TRM in attribution data, but usable for preliminary case assessment and simple single-chain traces.
A Bitcoin-specific analysis platform with strong UTXO visualization and clustering capabilities. Used by researchers and investigators for Bitcoin-specific analysis. Not as broad as commercial platforms but valuable for Bitcoin cases where visual UTXO analysis is required.
The FBI's in-house blockchain analytics platform, used internally by federal agents. Mentioned here for context: when you submit a case to law enforcement and it reaches the FBI Cyber Division or IRS-CI, investigators may use QLUE alongside commercial tools like Chainalysis. Not available to the public.
Core On-Chain Analysis Techniques
Tools are only as good as the analytical techniques applied through them. The following are the foundational methods that crypto forensic investigators use, regardless of which platform they operate on.
Transaction Graph Analysis
The baseline method. Every input and output of every transaction is mapped to reveal the flow of funds over time. The transaction graph turns raw blockchain data into a navigable map: a victim's wallet at the starting node, each intermediate wallet as a subsequent node, and each transaction as a directed edge with value and timestamp. This graph is the visual foundation of any forensic report.
Common-Input-Ownership Heuristic (CIOH)
The most powerful Bitcoin clustering technique. When multiple addresses appear as inputs to the same transaction, they are assumed to be controlled by the same entity — because signing that transaction required access to all of their private keys. This heuristic allows investigators to link dozens or hundreds of wallet addresses under a single entity, revealing the full scale of a scammer's operation even if funds were spread across many wallets.
Change Output Analysis
Bitcoin transactions often produce a "change" output back to the sender. Identifying which output is change — versus which is the actual transfer — is a key clustering technique. Patterns in change output behavior (address reuse, round-number amounts, address type matching) allow investigators to follow wallet activity more accurately through a transaction graph.
Peel Chain Detection
A peel chain is a common fund-movement pattern where an actor sends a large sum through a sequence of wallets in small decrements — "peeling" off small amounts at each hop while forwarding the bulk to the next address. Peel chains are used to slow down investigators and create the appearance of complex routing. Commercial forensics tools detect peel chain patterns automatically.
Entity Attribution Database Lookup
Commercial forensics platforms maintain databases of tagged addresses — wallets known to belong to specific exchanges, mixers, darknet markets, sanctioned entities, and fraud infrastructure. When a traced address matches a tagged entity, the investigation gains a named endpoint: "funds moved to Binance deposit address cluster," or "funds routed through Tornado Cash," or "funds sent to known pig butchering wallet." These attributions are the highest-value outputs of the investigative process.
Dust Analysis and Address Poisoning Detection
Scammers sometimes send tiny "dust" amounts to victim wallets to try to trick them into sending to a lookalike address through transaction history poisoning. Forensic analysis identifies dust transactions and distinguishes them from legitimate activity, preventing misidentification of the actual attack path.
Cross-Chain and Bridge Tracing
Modern crypto scam operations routinely move funds across multiple blockchains — often to increase investigative friction or to access specific liquidity pools. Cross-chain tracing is a growing area of crypto forensics.
Bridge Transaction Analysis
When funds cross a bridge (e.g., Ethereum to Arbitrum via the Arbitrum Bridge, or Ethereum to Tron via a third-party bridge), the source transaction on one chain and the destination transaction on the other chain can be correlated using bridge contract events and timing data. Commercial platforms like Elliptic and TRM have built explicit cross-chain correlation into their tooling.
Swap and DEX Analysis
Stolen funds are often swapped through decentralized exchanges (Uniswap, PancakeSwap, Jupiter on Solana) to change token type before being moved to a centralized exchange. DEX swaps are on-chain events — they are fully visible and traceable. The swap changes the token denomination but not the wallet address, so the trace continues through the swap event without a break.
Centralized Exchange Bridge Identification
Some actors move funds across chains not through decentralized bridges but by depositing on one chain at an exchange and withdrawing on another. This pattern leaves the investigative trail at the exchange deposit — which is exactly where a subpoena is most powerful.
Mixer and Obfuscation Analysis
Mixers and privacy protocols are the tools scammers use to try to break the forensic trail. Understanding how they work — and their limitations — is essential to evaluating investigative outcomes.
Bitcoin Mixer Analysis
Bitcoin mixing services pool inputs from multiple users and redistribute outputs, attempting to disconnect the input-output relationship. Forensic techniques include: amount correlation (matching input and output amounts), timing analysis (correlating when inputs and outputs occur), and fee analysis (identifying operational patterns unique to a specific mixer). No mixing service has proven immune to forensic analysis over time — most have had significant de-anonymization research published against them.
Tornado Cash (Ethereum)
Tornado Cash is a smart contract-based privacy pool for Ethereum. Forensic analysis on Tornado Cash uses deposit/withdrawal timing, amount clustering, and, for cases where the operator made operational security errors, address reuse patterns. OFAC sanctioned Tornado Cash in 2022, meaning any interaction with its contracts is itself a traceable and legally significant event.
Monero (XMR)
Monero uses ring signatures and stealth addresses to obscure transaction graphs. On-chain tracing within Monero is significantly harder than transparent chains. However, Monero must enter and exit via exchanges — and those on/off-ramp events are traceable. Investigators focus on the conversion events rather than the Monero chain itself.
In most retail scam cases — romance scams, pig butchering, wallet drains — scammers do not use Monero or sophisticated mixing. They use USDT on Tron or Ethereum, route funds through a few hops, and deposit at a major exchange. Professional crypto forensics tools handle this common pattern extremely well. The "untraceable crypto" narrative overstates the difficulty in the majority of victim cases.
How These Tools Are Used Together in a Real Investigation
A professional crypto forensic investigation does not use one tool in isolation. The typical workflow combines platforms and techniques:
- Start with block explorer verification — confirm the victim-provided transaction hashes are valid and establish the exact starting wallet and amount
- Load into commercial platform — import the starting wallet into Chainalysis Reactor or TRM Labs; run automated entity attribution on all reachable addresses
- Build the transaction graph — manually expand the graph following fund flows, flagging each hop and any entity attributions
- Apply clustering heuristics — use the platform's clustering to reveal wallet groups controlled by the same actor
- Identify exchange deposits — confirm any attributed exchange addresses and document the deposit event with hash and timestamp
- Verify findings with block explorer — cross-check commercial platform findings against raw block explorer data to confirm accuracy before including in the report
- Document the complete chain of evidence — compile every finding with citations into the formal report
What Crypto Forensics Tools Can and Cannot Do
✓ What the Tools Can Do
- Trace transparent-chain transactions with high confidence
- Identify exchange deposits via attribution databases
- Cluster wallets to reveal operational scale
- Follow funds through most DEX swaps and bridges
- Produce reproducible, independently verifiable findings
- Analyze mixing services with probabilistic techniques
- Flag known criminal infrastructure at tagged addresses
✗ What the Tools Cannot Do
- Identify a person from a wallet address alone
- Compel exchanges to provide KYC data (requires legal process)
- Guarantee complete traces through Monero or heavy mixing
- Recover funds — they produce evidence, not transactions
- Trace funds to exchanges in non-cooperating jurisdictions without legal process
- Provide real-time alerting without active monitoring
Frequently Asked Questions
Want These Tools Applied to Your Case?
Wallet Witness uses professional-grade blockchain forensic analysis tools on every case. Initial case assessments are free — tell us what happened and we will assess traceability at no charge.
Start a Free Case Review