Crypto glossary
Blockchain forensics
Blockchain forensics is the investigation of public blockchain data to trace funds, link addresses to real-world entities and support legal cases.
Because public blockchains record every transaction permanently, investigators can follow funds from address to address. Forensic work combines that data with clustering heuristics that group addresses controlled by one entity, attribution databases of known exchange, mixer and scam wallets, and off-chain information such as exchange KYC records obtained by subpoena, leaked data or open-source intelligence.
Specialist analytics firms sell this capability to exchanges, banks and governments, and police units in many countries now have dedicated crypto teams. High-profile results include the US Justice Department's 2021 recovery of part of the bitcoin ransom paid in the Colonial Pipeline attack and the 2022 seizure of about 94,000 BTC stolen in the 2016 Bitfinex hack. Exchanges use the same tools for sanctions screening and to freeze stolen funds when they arrive.
Forensics has limits. Mixers, privacy coins, cross-chain bridges and peel chains make tracing harder, and attribution relies on heuristics that can be wrong. Courts have begun scrutinising how reliable these methods are when they are used as evidence.
Example
After a DeFi hack, investigators follow the stolen ETH through two bridges and a mixer to a deposit address at a centralized exchange, which freezes the account and shares the user's identity with police.