From Blockchain Tracing to Proof: Four Thresholds in Cryptocurrency Theft Investigations

Share this post

A transaction graph can show that stolen cryptocurrency moved from one address to another. It may show conversion through a bridge, mixer, exchange or other service. It may even identify an address associated with a known organization.

That is important investigative intelligence. It is not, by itself, proof of who controlled the wallet, who authorized a transaction, who committed the underlying theft or whether the assets can be recovered.

The defensible unit of analysis is a dated, reproducible chain connecting the source event to a transaction, wallet or account control, an identified person or organization, the conduct under examination and a legally available restraint or recovery pathway. In practice, this means separating four thresholds that are often collapsed into the single phrase “wallet attribution.”

The four thresholds that should not be confused

1. The tracing threshold: where did the assets move?

Public blockchain data can establish recorded transactions, asset movements and relationships among addresses. Depending on the chain, the available record may include transaction hashes, block heights or timestamps, amounts, contract calls and input-output relationships.

Investigators can use that data to reconstruct forward and backward flows, identify conversion points and map movement through bridges, decentralized exchanges, mixers and custodians. This can establish a transaction path with considerable precision.

But the ledger records state changes on a network. It does not inherently record a person’s name, physical location, mental state or legal status. A graph may end at an exchange deposit address, an unhosted wallet or a service with incomplete public information. Cross-chain movement, custodial internal ledgers and privacy-enhancing mechanisms can also create ambiguity or breaks in the visible path.

Tracing is therefore the beginning of an evidentiary analysis, not its conclusion.

2. The control threshold: who could control the relevant wallet or account?

Address clustering can identify addresses that may share control. On Bitcoin-style UTXO systems, co-spending can be a relevant structural signal, subject to exceptions such as collaborative transactions. On account-based chains, the analysis may involve signing keys, contract administration, nonce history and smart-contract permissions.

A cluster is not automatically a person. A custodian may control deposit addresses for many customers. Several people may share operational authority. An address may be associated with a service without establishing the identity of the beneficial owner. Different analytical providers may also reach different results because they use different datasets, heuristics, update times and confidence models.

The control question usually requires off-chain evidence. Potential sources include exchange KYC and account records, authenticated service sessions, device and IP data, cloud records, communications, seized seed phrases or private keys, and infrastructure obtained under legal process.

Capability and conduct should be assessed separately. Evidence that a person could sign or direct a transaction is relevant to control. Evidence that the person actually accessed the relevant device, account, key or operational workflow at the relevant time strengthens the connection. Neither proposition should be silently substituted for the other.

The Bitfinex matter illustrates the distinction. The U.S. Department of Justice reported that approximately 119,754 bitcoin were stolen in 2016 and that investigators later obtained a cloud-storage warrant leading to a file containing approximately 2,000 addresses and corresponding private keys. Authorities used those keys to seize bitcoin held in a wallet linked to the hack. The blockchain tracing established linkage to the stolen funds; the decrypted private-key evidence provided a materially stronger basis for demonstrating technical control than a label or transaction pattern alone. The public record still requires care when distinguishing the original hack, alleged laundering conduct, the defendants’ roles and the procedural basis for seizure. DOJ statement of facts

3. The conduct threshold: what did the person or organization do?

Even evidence of wallet or account control does not automatically prove the underlying criminal conduct. The relevant proposition may be much narrower or broader: access to an account, use of a private key, initiation of a transaction, participation in an intrusion, laundering activity, concealment, knowing receipt or intent.

Those propositions require different evidence. A person’s access to an exchange account may be relevant without proving that they carried out the initial compromise. A transaction signed by a key may demonstrate that the key was used without identifying the person who physically initiated the transaction. A device associated with an account may have been shared, delegated or compromised.

The public record concerning major Asian incidents demonstrates why this distinction matters. The FBI attributed the Harmony Horizon Bridge theft to Lazarus Group/APT38 and official U.S. materials linked Lazarus to the Ronin theft. In the DMM Bitcoin matter, the FBI, the U.S. Defense Cyber Crime Center and Japan’s National Police Agency attributed the theft to North Korean actors tracked as TraderTraitor and described an earlier social-engineering contact involving a Ginco employee. These official attributions are significant, but the public releases do not disclose every underlying intelligence source or technical step. They should not be converted into a claim that a wallet graph alone identified every individual operator. FBI release on Harmony FBI, DC3 and NPA release on DMM

WazirX provides a different caution. The company reported that a multisignature wallet was attacked in July 2024 and that transactions obtained multiple WazirX and Liminal signatures. It also reported that preliminary findings had not found evidence of compromise of the WazirX signers’ machines. Those disclosures establish what an involved party reported, not a final independent explanation of whether the decisive mechanism involved endpoint credentials, custody infrastructure, social engineering, policy manipulation or another pathway. A confirmed threshold transaction shows that the relevant protocol or custody mechanism accepted the required authorization condition. Depending on the implementation and available transaction data, it does not necessarily reveal which keys, devices or people supplied or controlled that authorization. WazirX incident disclosure WazirX technical update

4. The recovery threshold: can the assets be restrained or recovered?

Tracing and recovery are connected but distinct. A trace may identify an address holding suspected proceeds. Restraint depends on factors such as the current custodian, the asset form, available keys, timing, jurisdiction, legal authority and cooperation from an exchange, stablecoin issuer, bridge operator or other service.

The U.S. Department of Justice identifies private-key access and third-party custodians as material to cryptocurrency seizure and recommends preparing a law-enforcement-controlled wallet before execution. In an Ohio forfeiture matter, investigators traced funds to a Tron address, identified conversion to USDT, obtained a Tether freeze and transferred the assets to a law-enforcement-controlled wallet under a seizure warrant. The DOJ expressly described the forfeiture allegations as allegations and stated that the government bore the burden of proof. DOJ cryptocurrency seizure guidance Ohio forfeiture matter

Official U.S. and UK materials illustrate why vocabulary matters. Freezing or seizure is not the same as final forfeiture, confiscation, restitution or compensation. The supplied UK materials should be read as jurisdiction-specific guidance rather than as establishing a universal procedural or evidentiary rule. A recovery analysis must therefore ask not only where the assets are, but whether they remain reachable, identifiable, legally restrainable and capable of transfer.

An address with no cooperative custodian, an inaccessible key, a foreign service, a mixer or a privacy-enhanced asset may still provide intelligence without offering an immediate recovery route.

What turns a transaction graph into defensible evidence?

A strong investigation separates three layers: ledger data, analytical output and attribution.

Ledger data

The underlying transactions should be preserved with the relevant hashes, block heights, timestamps, amounts, contract interactions and treatment of swaps, bridges and custodial boundaries. Screenshots may illustrate a conclusion, but they should not replace the underlying records or a reproducible method. Timestamps, provider labels and exported analytical states should also be preserved with their source, retrieval time, chain or system context and version information. None, standing alone, establishes physical time, authenticity or human involvement.

Analytical output

The investigation should record clustering rules, exceptions, tool name and version, dataset date, attribution source, confidence and analyst decisions. Deterministic observations should be distinguished from probabilistic scores, behavioral typologies and vendor labels.

Chainalysis describes address clustering and attribution, including the distinction between analytical grouping and real-world identification. TRM Labs emphasizes timestamping, reproducibility, transparency and version control in its framework for blockchain evidence. These descriptions are useful methodological benchmarks, but vendor-authored material is not independent validation of every output. Chainalysis, “Blockchain address clustering and attribution” TRM Labs framework

Attribution and corroboration

Off-chain records may include exchange account-opening and KYC material, login and withdrawal records, API activity, internal ledgers, signer approvals, custody policies, device and cloud artefacts, authentication logs, communications and corporate records. Whether such material is available, complete and lawfully obtainable is matter-specific.

A technical conclusion should state precisely what it establishes. “The address received funds from the victim wallet” is different from “the address was controlled by the suspect,” which is different again from “the suspect authorized the transaction and participated in the theft.” The evidentiary basis and uncertainty should be visible at each step.

Preservation, timing and competing explanations

Digital evidence is time-sensitive in more than one sense. Assets may move. Exchange records may change or become unavailable. Devices may remain live, encrypted or logged in. Blockchain state and vendor labels may update. Different systems may record time using different clocks, time zones and retention periods.

SWGDE guidance supports documenting acquisition, minimizing changes to source data, computing hashes for validation and preserving chain-of-custody information. Its cryptocurrency guidance also notes that hardware wallets should not be treated like ordinary USB storage and that live acquisition may matter where encryption, memory, browser sessions or wallet artefacts are relevant. These are general technical considerations, not findings that any such artefact was collected in the incidents discussed here. SWGDE cryptocurrency guidance SWGDE endpoint collection guidance

The investigative record should preserve the state at the time of analysis, including block height, transaction status, provider-data version, attribution version, source and retrieval time, exchange response date, wallet balance and relevant legal-process milestones. These records document the analytical state; they do not, by themselves, establish that a timestamp reflects physical time or that an exported provider label is authentic or attributable to a particular person.

It should also test competing explanations. Shared custody may explain an apparent individual attribution. A login may reflect delegated or compromised access. A multisignature transaction may be compatible with phishing, malware, insider activity, workflow failure or manipulated destination data. A missing provider record is not proof that an event did not occur. Disagreement between analytics providers should be recorded rather than hidden.

The distinct role of analytics providers

Chainalysis, TRM Labs and Elliptic describe capabilities involving clustering, cross-chain tracing, graph analysis, attribution and investigative reporting. Such tools can accelerate discovery, organize complex transaction paths and identify leads or service endpoints.

They do not replace the investigator’s evidentiary reasoning. The investigator must explain what was observed, what was inferred, which source supports the inference, what alternatives were considered and how the conclusion relates to the factual or legal question. A vendor label or risk score is not, without more, proof of criminal conduct, intent, beneficial ownership or legal liability.

Law-enforcement and litigation teams should therefore request and preserve the underlying transactions, analytical reasoning, source attribution, confidence information and tool version rather than relying only on a final visual graph or exported label.

Questions for litigation lawyers and investigations professionals

Before treating a blockchain analysis as proof, ask:

Is the proposition about movement, common control, account control, beneficial ownership, authorization, conduct or intent?
Which part is supported by public-chain data, and which part requires exchange, device, cloud, communications or identity records?
Was the analysis preserved with the relevant block height, timestamp, dataset and tool version, together with source and retrieval context?
Does the evidence show possession of a key, access to an account, or actual execution of the transaction?
What alternative explanations remain consistent with the current record?
Which custodian, issuer, bridge or service could preserve or restrain the assets?
Are the assets still at a reachable endpoint, and what legal process or cooperation would be required?
Can another analyst reproduce the path from the original transaction to the stated conclusion?

Conclusion: follow the evidence across all four thresholds

The central discipline in a cryptocurrency theft investigation is not merely following funds. It is maintaining the separation between where assets moved, who could control the relevant wallet or account, who conducted the alleged act and whether the assets remain recoverable.

A matter may satisfy the tracing threshold without satisfying attribution. It may support attribution without proving criminal conduct. It may establish conduct without producing practical recovery because the assets have moved beyond a reachable or legally cooperative endpoint.

For counsel and investigators, the consequence is practical: define the proposition before selecting the evidence, preserve the analytical state, corroborate on-chain observations with appropriate off-chain records and describe every conclusion at the level the evidence actually supports. When those boundaries matter to a live dispute or investigation, an independent technical assessment can help test the transaction path, attribution basis, unresolved alternatives and recovery assumptions without treating software output as the conclusion.

When a cryptocurrency trace must support a consequential investigative or litigation decision, discuss an independent technical assessment with IVIDENTIA focused on the transaction path, control evidence, attribution basis, unresolved alternatives and recovery assumptions.