Traditional financial intelligence plus cryptocurrency wallet and transaction tracing.
Money leaves a trail that's often more reliable than any social media profile, precisely because financial systems are built around verification and record-keeping. This chapter covers two related but distinct areas: traditional financial intelligence, and cryptocurrency tracing, which has its own tooling and its own myths to unlearn.
Several institutions maintain the public and semi-public records that financial-intelligence work draws on. Government-run Financial Intelligence Units (FIUs) exist in most countries to collect and analyze suspicious-transaction reports. The Financial Action Task Force (FATF) sets international anti-money-laundering standards and publishes country-level risk assessments. In the US, FinCEN (the Financial Crimes Enforcement Network) and the Office of Foreign Assets Control (OFAC) are the two names you'll run into constantly — OFAC in particular maintains the Specially Designated Nationals (SDN) list, a public, searchable database of individuals, entities, and (increasingly) specific cryptocurrency wallet addresses that US persons are prohibited from transacting with under sanctions law.
Useful financial identifiers to recognize: an IBAN encodes a country code and bank identifier; a SWIFT/BIC code identifies a specific bank for international transfers; a VAT number ties a business to a specific EU tax jurisdiction and is often searchable in public VAT-validation registries; company registration numbers filed with a national business registry (Companies House in the UK, similar bodies elsewhere) link a business entity to its filed officers and ownership — a core technique we build on in Chapter 12's corporate due-diligence work.
Negative news screening — systematically searching a subject's name alongside terms like "fraud," "sanctioned," "indicted," or "money laundering" across news archives — is standard practice before any significant financial relationship or hire, and is exactly the kind of dorking-plus-name-variant technique covered in Chapters 3 and 4.
A blockchain is a public, append-only ledger of every transaction ever made on that network — for the major cryptocurrencies (Bitcoin, Ethereum), this ledger is completely open and searchable by anyone, which is the single most important fact for an investigator: cryptocurrency is not anonymous by default, it's pseudonymous. Every transaction is permanently visible; what's hidden is only the real-world identity behind a wallet address, and that link is very often recoverable.
A wallet holds the private keys controlling funds at one or more addresses; a wallet address is the public identifier funds are sent to. Mining/staking is how new transactions get verified and added to the ledger, depending on the network's consensus mechanism. Not all cryptocurrencies work the same way for tracing purposes: Bitcoin and Ethereum are fully transparent by design. Monero (XMR) and similar "privacy coins" use cryptographic techniques specifically designed to break the public traceability that makes Bitcoin tracing possible — when a target uses Monero rather than Bitcoin, that choice is itself a meaningful signal about their sophistication and intent.
The obvious application is following the proceeds of crime — ransomware payments, darknet marketplace sales (Chapter 8), and fraud all typically get paid in crypto specifically because attackers believe it's untraceable. It usually isn't, for two structural reasons covered below: exchange KYC requirements and blockchain clustering analysis. Beyond crime, tracing is also core due-diligence work: verifying that a counterparty in a business deal isn't tied to a sanctioned wallet, or confirming whether a company's claimed crypto holdings actually exist on-chain.
A public block explorer (a free website that lets you browse any blockchain's transaction history — one exists for essentially every major cryptocurrency) is your starting point for any address. Paste in a wallet address and you immediately see its full transaction history, current balance, and every address it has ever sent to or received from. From there, the core technique is clustering: heuristically grouping addresses that are very likely controlled by the same person or entity, based on patterns like multiple addresses being used as inputs to the same transaction (a strong signal they're controlled by one wallet).
The single most important structural weakness in "anonymous" crypto crime is this: at some point, criminal proceeds almost always need to be converted back into usable fiat currency, and that conversion happens at a regulated exchange. Exchanges operating legally are required to perform KYC (Know Your Customer) identity verification on their users. So the investigative goal is very often not to identify a person directly from a wallet address, but to trace the flow of funds until they land at a known exchange's deposit address — at which point law enforcement (not you, as an OSINT researcher) can subpoena that exchange for the KYC identity behind the account.
Some investigations start from a single transaction of interest (a specific ransom payment, say) rather than a wallet or a person — from there you follow the funds forward through however many "hops" and mixing services the launderer used, watching for the point where funds converge into a single cluster or hit a known exchange address.
Non-fungible tokens are traceable with the same on-chain transparency as the underlying cryptocurrency they're traded on (usually Ethereum) — every mint, sale, and transfer is public. The investigative angles that show up most often: wash trading (an owner selling to themselves across linked wallets to fake a price history), phishing schemes that trick holders into signing malicious transactions, and straightforward Ponzi-style "rug pulls." Tracing an NFT by wallet address works the same as any other crypto tracing; tracing by the image itself uses the reverse-image techniques from Chapter 6, since stolen or plagiarized NFT art is common.
Everything above treats blockchain as a way of moving and tracing money. But the core property that makes crypto tracing possible — a public, tamper-evident, timestamped ledger — has legitimate uses that have nothing to do with currency at all, and these are starting to show up as evidence or verification points in investigations that have nothing to do with financial crime.
Document and record timestamping. Some services let you take a document, compute a hash of it, and record that hash on a public blockchain at a specific moment — without ever putting the document's actual contents on-chain. Because blockchain entries are timestamped and effectively tamper-evident once recorded, this creates a way to later prove that a specific version of a document existed by a certain date, or that a file hasn't been altered since it was hashed. That's directly relevant if you're investigating a claim about when a document was created, or whether a version now being presented is the same as an earlier one.
Supply-chain and provenance tracking. Some industries — luxury goods, and some food and pharmaceutical supply chains — use blockchain-based systems to record a product's chain of custody as it moves from manufacturer to retailer. Where this is in use, it can be a genuine verification point when investigating counterfeit goods or supply-chain fraud claims. Coverage varies enormously by industry and company, though, and isn't something you can assume exists.
Decentralized identifiers (DIDs). An emerging, not-yet-mainstream standard for identity credentials that live on a blockchain rather than inside one company's database. Worth knowing the concept exists, since it may show up more often in identity-verification contexts as adoption grows — but it isn't standard investigative infrastructure today.
Treat all three of these honestly as an emerging, unevenly-adopted area — this is "recognize it if you encounter it," not "expect to use this as a routine tool." The specific services and standards in this space are new and change quickly.
For exercise 2, the point is to viscerally understand that "the blockchain is public" isn't a slogan — you should be able to see literally every transaction that address has ever been part of, with no login or special access. That's the fact that makes cryptocurrency tracing possible at all, and it's worth experiencing directly rather than just reading about it. For exercise 4, a strong answer is precise about the limit: a timestamping service can prove a document existed in a specific form by a specific date — it cannot prove the document's contents are true, or that whoever hashed it was authorized to do so.