A cryptocurrency theft can leave an unusually visible trail. Transactions may be recorded on public ledgers, assets may move rapidly between addresses and funds may pass through exchanges, bridges, swaps or other services. Yet visibility is not the same as proof.
For counsel and investigators, the central challenge is to connect fragmented digital facts into a defensible account of what happened, which assets were stolen, how they moved and who—if anyone—can be linked to control, ownership, knowledge or intent.
The most reliable approach separates the investigation into three proof problems: how access was obtained and used; which assets represent the proceeds of the theft; and what evidence supports human attribution and intent. A transaction graph can contribute substantially to the second problem. It does not, by itself, resolve the first or third.
The central distinction: traceability is not attribution
Public blockchain data can document transactions between ledger addresses or interactions with smart contracts. It can support a chronology of movements, identify amounts and assets, and show patterns such as consolidation, rapid transfers, splitting, conversion or movement across chains.
But ledger identifiers do not inherently identify individuals. The fact that an address received, transferred or controlled an asset on-chain does not, without corroboration, establish who controlled the relevant private key, who operated an associated account, who benefited from the funds or what the person knew.
These are separate propositions:
- On-chain observation: a transaction or smart-contract interaction occurred.
- Entity attribution: addresses may be analytically associated with a service or actor.
- Control attribution: a person or organization controlled a key, account, device or service relationship at a relevant time.
- Beneficial ownership: a person or entity ultimately owned or benefited from the asset.
- Intent: the actor knew the origin or purpose of funds and acted with a particular objective.
A defensible investigation should identify which proposition each item of evidence supports—and which propositions remain unresolved.
Official U.S. forfeiture materials illustrate the value of combining blockchain records with other evidence. The 2025 verified complaint concerning approximately 225,364,961 USDT describes investigators using blockchain analysis, service-provider information and other investigative techniques. The complaint is a procedural filing, however, and its allegations should not be treated as final findings on the merits.
Reconstructing the compromise and the theft
The first evidentiary question is not “Where did the cryptocurrency go?” It is “What event caused value to leave the victim, and how was that event connected to the compromised environment?”
A reconstruction may need to correlate identity-provider records, multifactor-authentication events, privileged-account activity, endpoint telemetry, remote-access records, email and collaboration data, cloud audit logs, network records, payment approvals, wallet-policy changes and signing-device activity. These records are not interchangeable. Each has its own timestamp basis, retention period, collection limitations and potential for ambiguity.
CISA guidance supports preserving volatile and retention-limited evidence, including memory, security logs and relevant endpoint, network, audit, transaction and user-activity records. Its Federal Government Cybersecurity Incident and Vulnerability Response Playbooks also emphasize collecting perimeter, internal-network and endpoint information where possible.
The objective is a time-sequenced account that explains more than the existence of suspicious activity. It should test whether:
- an account, device, token or session interacted with the relevant system;
- the sequence is technically consistent with compromise or unauthorized access;
- privileged actions preceded the transfer of value; and
- the transaction or instruction departed from the organization’s expected authorization path.
A timestamp from one system should not automatically be treated as the authoritative chronology. Clock drift, time-zone conversion, delayed ingestion, log truncation, provider processing and retrospective exports can alter the apparent sequence. Correlation across independent sources is therefore more important than a visually precise timeline built from a single log.
The distinction between system action and human authorization is equally important. A compromised credential may have performed a transaction. That does not alone establish that the credential holder authorized it, that the holder operated the session or that a particular person intended the resulting loss.
What a transaction graph can—and cannot—show
Once the theft event is sufficiently defined, the funds-flow analysis should begin with a proven or carefully qualified seed transaction. The analysis can then preserve transaction hashes, block heights, asset types, token contracts, addresses, fees, values and subsequent movements in a deterministic graph.
That graph may reveal continuity of value. It may also show interactions with exchanges, bridges, swaps, mixing or other services. The 2020 DOJ complaint concerning 280 cryptocurrency accounts describes cryptocurrency as pseudonymous: transactions are public, but ledger identifiers do not inherently identify individuals. The complaint’s discussion of identity illustrates why on-chain analysis may need to be combined with other investigative tools.
The graph becomes weaker when its starting point is uncertain or when analytical transformations are not documented. A report should make clear:
- which addresses were supplied as an initial seed and how they were established;
- which transactions were observed directly on a public ledger;
- which links depend on clustering, service labels or proprietary analytics;
- how cross-chain movements, swaps, bridges and conversions were normalized;
- how fees, commingling and asset valuation were treated; and
- which alternative explanations remain possible.
A wallet cluster may represent a laundering network, an exchange’s internal structure, a legitimate customer relationship or unrelated users. It may also combine several of these possibilities. The hypothesis must be tested against provider records and independent evidence rather than promoted to a fact because the graph looks coherent.
Assessing potential laundering without overstating the evidence
Transaction patterns can justify further examination, but they do not independently prove laundering. The FATF framework on virtual-asset red-flag indicators identifies patterns that may warrant attention, including rapid movement without an apparent economic purpose, repeated conversions, multiple jurisdictions, anonymity-enhancing services, unusual transaction size or frequency and activity inconsistent with a stated profile.
FATF also cautions that red flags must be considered in context and that no single indicator establishes money laundering. That distinction matters in litigation and investigations because a pattern can be consistent with concealment while remaining equally compatible with other explanations that have not been tested.
A disciplined laundering assessment should separate at least four questions:
- Are there indicators of concealment or layering?
- What evidence connects the assets to the predicate theft?
- What evidence identifies account controllers or beneficiaries?
- What evidence supports knowledge or intent?
A transaction graph may contribute to the first two questions. It may assist with the third when combined with provider records. It rarely answers the fourth on its own.
The distinction is illustrated by government pleadings concerning alleged hacks, cryptocurrency theft and laundering. The DOJ material on 280 accounts tied to alleged exchange hacks, the Qakbot forfeiture complaint and the 2021 indictment concerning alleged North Korean cyber and financial crimes are useful primary-source examples of investigative theories. They remain allegations or procedural assertions unless established through the relevant adjudicative process.
The off-chain evidence that often decides attribution
The most consequential attribution evidence may sit outside the blockchain. Depending on the matter, relevant records may include exchange KYC and account-opening data, login and device fingerprints, IP and session information, account-support records, deposit and withdrawal data, hosted-wallet information, bank records, communications, identity documents and records held by custodians or other service providers.
These records can help test whether a wallet was connected to a particular account, device or person at a relevant time. They may also introduce new uncertainty. Shared credentials, compromised infrastructure, remote administration, VPNs, virtual machines, delegated access and service-level omnibus structures can produce technical patterns that appear more specific than they are.
The practical question is not whether an address has been assigned a label. It is whether the underlying methodology, raw data and assumptions support the proposition being advanced. Where a material conclusion depends on commercial blockchain analytics, the analytical output should be reconciled with public ledger data and, where appropriate, alternative tools or independent validation.
SWGDE’s Best Practices for Digital Evidence Collection emphasizes integrity-preserving collection, documentation, qualified personnel and recording deviations from best practice. Its Tech Notes on Cryptocurrency recognizes that cryptocurrency artefacts and transfers require matter-specific handling rather than a universal step-by-step procedure.
Preservation is an evidentiary decision, not an administrative afterthought
Cloud logs, identity-provider data, endpoint memory, provider records, messaging content and exchange data may be volatile, retention-limited or controlled by third parties. Remediation can also change or destroy artefacts that would later be needed to distinguish compromise from authorized activity.
Early priorities commonly include preserving cloud and identity-provider logs with export metadata and retention information; capturing relevant endpoint memory and disk images before remediation; preserving payment, messaging and access records; securing transaction hashes and asset details; and issuing timely preservation requests to relevant exchanges, custodians, infrastructure providers and platforms, subject to applicable authority.
Collection records should identify the source system, collector, time, tool and version, hashes where applicable, export limitations and any transformation applied. Screenshots can be useful supplementary material, but machine-readable records and underlying source data are generally more suitable for testing a material conclusion.
Preservation does not guarantee availability, completeness or admissibility. Those questions depend on the specific system, provider, jurisdiction and procedural context. The important point is that an investigation cannot later reconstruct evidence that was never preserved or whose provenance was not recorded.
Cross-border evidence changes the investigative sequence
A single digital theft may involve a victim in one country, infrastructure in another, an exchange in a third, devices in several locations and service providers operating across multiple jurisdictions. Evidence access is therefore part of the investigative architecture, not a final procedural detail.
The Second Additional Protocol to the Budapest Convention addresses enhanced cooperation and disclosure of electronic evidence where data may be stored in foreign, multiple, shifting or unknown jurisdictions. The EU’s electronic-evidence framework includes European Production and Preservation Orders, with application and procedural conditions that must be checked for the specific proceeding. Europol’s SIRIUS project describes practical challenges in obtaining cross-border electronic evidence, including from cryptocurrency exchanges.
Counsel and investigators should map each important record by holder, jurisdiction, retention period, preservation route, legal authority and expected production format. That map should distinguish private investigative requests from formal law-enforcement or judicial process. It should also identify which conclusions depend on records that may be difficult or impossible to obtain.
This is not jurisdiction-specific legal advice. Preservation, privilege, disclosure, lawful access, proportionality, data protection and admissibility require analysis under the applicable rules.
A decision-grade reconstruction
For professional decision-making, the investigation should be able to answer—with stated confidence—not only what the transaction graph shows, but also:
- What is the earliest reliable indicator of compromise?
- Which account, system, credential, wallet or payment control was affected?
- What exact event caused the loss?
- Which records are contemporaneous, reconstructed or inferred?
- What amount and asset type can be traced directly, indirectly or not at all?
- Which links depend on clustering, provider records or analytical assumptions?
- What evidence supports control, ownership, benefit, knowledge or intent?
- Which records may have been lost through retention limits, remediation or jurisdictional delay?
- What alternative explanation could produce the same technical pattern?
The strongest reconstruction is therefore not the one with the most elaborate wallet map. It is the one in which each material proposition has a visible evidentiary basis, a documented analytical path and a clear statement of remaining uncertainty.
Conclusion: build the evidence chain in layers
A cyber-enabled financial theft should be analyzed as an evidence-linked event chain: compromise and access, the theft and its authorization, on-chain movement, potential laundering indicators, and human attribution and intent. These layers inform one another, but none should be silently substituted for another.
Blockchain transparency can improve observability and tracing. It does not make ownership, identity or intent self-proving. Those conclusions usually depend on off-chain records, controlled acquisition, corroboration, tested alternatives and legally appropriate access to evidence across borders.
For counsel and investigations professionals, the practical question is whether the proposed narrative can survive separation into documented fact, allegation, inference, hypothesis and unresolved gap. Where a matter depends on disputed digital facts, an independent technical assessment can help test the reconstruction, the provenance of the underlying records and the limits of the conclusions before those conclusions are relied upon.
If a matter depends on disputed digital facts, contact IVIDENTIA to discuss whether an independent technical assessment could help test the incident reconstruction, funds-flow analysis, attribution assumptions and evidentiary limitations.
Sources
- United States v. Approximately 225,364,961 USDT — Verified Complaint for Forfeiture in Rem
- United States Files Civil Forfeiture Complaint Against $225M in Funds Involved in Cryptocurrency Investment Fraud Money Laundering
- United States Files Complaint to Forfeit 280 Cryptocurrency Accounts Tied to Hacks of Two Exchanges by North Korean Actors
- United States Files Complaint to Forfeit 280 Cryptocurrency Accounts — Complaint PDF
- Qakbot Forfeiture Complaint
- Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe
- SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management
- Best Practices for Digital Evidence Collection
- Tech Notes on Cryptocurrency
- StopRansomware Guide
- Federal Government Cybersecurity Incident and Vulnerability Response Playbooks
- Virtual Assets Red Flag Indicators of Money Laundering and Terrorist Financing
- Second Additional Protocol to the Convention on Cybercrime
- Electronic evidence in criminal proceedings
- SIRIUS Project — Facilitating cross-border access to electronic evidence
