Crypto & Financial OSINT: Tracing Money on the Blockchain

Cryptocurrency has a reputation for being untraceable, and that reputation is mostly wrong. Most major blockchains are public ledgers: every transaction, amount, and timestamp is visible to anyone. What’s hidden is identity, not activity. That difference, pseudonymous rather than anonymous, is the entire basis of blockchain investigation, and it’s why following the money on-chain has become a standard skill for fraud investigators, compliance teams, and OSINT researchers.

Here’s how tracing actually works, what tools beginners can use for free, and the mistake that trips up even experienced analysts.

Why blockchains are traceable in the first place

A wallet address is a string of characters, not a name. But every transaction it makes is permanently recorded, and investigators can follow those records from address to address. The trail becomes useful when it touches something with a real-world identity, most often a regulated exchange, which collects identification from its customers. Estimates from one blockchain intelligence firm put illicit crypto transaction volume at roughly $45 billion in 2024, around 0.4% of total volume, a small share of the ecosystem but a large dollar amount, and enough that law enforcement, exchanges, banks, and payment providers now treat blockchain forensics as a standard capability rather than a specialist add-on.

The first mistake: confusing visibility with attribution

This is the point experienced practitioners repeat most. Open a block explorer and you’ll see addresses, amounts, timestamps, confirmations, and fees, and it’s easy to treat that transparency as certainty about who is behind them. It isn’t. A useful discipline from current OSINT practice is to write every blockchain finding in two layers: what the chain actually shows (this address sent this amount to that address at this time), and what you’re inferring about who controls those addresses and why. The first layer is fact. The second is a hypothesis that needs independent support. Labels on explorers, such as a tag pointing toward an exchange or a flagged address, can be helpful leads, but they aren’t proof.

Start by identifying what you’re looking at

In a real case, the starting point is often thin: one address, a transaction hash, maybe a screenshot from a victim. Before tracing anything, work out which blockchain you’re dealing with, because the address format tells you. Addresses beginning with 0x belong to Ethereum and similar chains and are checked in an Ethereum explorer such as Etherscan. Bitcoin addresses beginning with 1, 3, or bc1 need a Bitcoin explorer such as Blockchain.com or mempool.space. Other chains have their own explorers, such as Tronscan for Tron and Solscan for Solana. Checking the wrong chain is one of the most common beginner errors and produces an “address not found” that looks like a dead end.

A free starter toolkit

You don’t need an enterprise license to learn the basics:

Block explorers such as Etherscan, Blockchain.com, mempool.space, Tronscan, and Solscan show the raw ledger data: full transaction history, token transfers, and contract interactions. Mempool.space is especially useful for understanding Bitcoin transaction structure in depth.
Free or open tooling such as Arkham Intelligence, Breadcrumbs, and MetaSleuth adds visual graphing and address labeling on top of raw explorer data.
Maltego, covered in our OSINT toolkit post, has blockchain transforms that connect on-chain addresses to off-chain OSINT such as social media usernames, forum posts, and domain records. Its strength is correlation and visualization, not proprietary attribution.
Community scam databases such as Chainabuse collect victim reports of addresses tied to fraud, useful as leads to check against what you find.

The honest limitation of the free stack is attribution. Explorers can only label addresses they already know about, and they don’t have the exchange cooperation data that commercial platforms use.

What commercial platforms add

Commercial blockchain intelligence platforms such as Chainalysis, TRM Labs, Elliptic, and Crystal maintain large attribution datasets that link clusters of addresses to known entities, and they cover many chains at once. One 2026 platform comparison noted TRM Labs covering more than 77 blockchains with an emphasis on explainable risk scores, and Chainalysis seats starting around $10,000. That cost is one reason these tools are mostly used by law enforcement, exchanges, banks, and compliance teams, and one reason skilled investigators commonly combine several tools rather than relying on a single platform.

How a trace actually works

The workflow is a close cousin of the link analysis we covered earlier in this series:

Identify. Confirm the chain, the address, and the transaction, and record exactly what you started with.
Trace. Follow funds forward and backward from the starting point, noting amounts, timing, and how the funds split or merge.
Cluster. Group addresses that are likely controlled by the same party, based on patterns in how they transact.
Attribute. Look for the point where the trail touches something identifiable, such as a regulated exchange deposit, a public post listing the address, or a domain or username tied to it.
Document. Save screenshots, timestamps, and transaction hashes, and keep the observed facts separate from your inferences.

The hard parts of any trace are the points where funds change form or hop chains: cross-chain bridges, decentralized exchange swaps, and mixing services, all of which are designed to break a clean path. Investigators treat those as obstacles that require more evidence, not as endpoints.

Why exchanges are the chokepoint

Most illicit funds eventually need to be converted into ordinary money, and that usually means passing through an exchange that verifies its customers. That’s why a trace so often ends at an exchange deposit address: it’s where an anonymous trail meets an identified account. Investigators generally can’t see who owns the account, but law enforcement can request that information from the exchange, and exchanges can freeze funds when alerted quickly. Real-time collaboration networks between investigators, exchanges, and custodians have been built specifically to make that freezing faster, which is why speed matters so much when a theft is reported.

A real-world model: independent investigators

Blockchain tracing isn’t only done inside agencies. Independent researchers have become well known for tracing stolen funds and exposing scams by tracing fund flows across wallets and exchanges, clustering related addresses, and cross-referencing on-chain data with public records like domain registrations, court filings, and social media activity. That mix of on-chain forensics and traditional OSINT is exactly the combination this series has been building toward, and it’s what makes crypto investigation a natural extension of the skills in our posts on link analysis and the OSINT toolkit.

Using this responsibly

A few ground rules matter more here than in most OSINT work, because a wrong attribution can attach a fraud accusation to a real person:

Never publish an attribution you can’t support. A cluster of addresses and a plausible guess is not evidence of who is behind it.
Report rather than confront. If you find evidence of fraud, the right destination is law enforcement and the relevant exchange, not public accusations or direct contact with the suspected party.
Document to a standard. Investigators who expect their findings to be relied on keep dated screenshots, transaction hashes, and a clear record of method, since open-source analysis without documentation is hard to defend.
Stay within the law. Everything above uses public ledger data, not access to anyone’s accounts or private information.

If you’re a victim, not an investigator

Everything above is why speed matters after a scam:

Act immediately. Contact the exchange or platform you sent funds from, and report to the FBI’s IC3 (ic3.gov) and your national fraud reporting body.
Save everything. Keep transaction hashes, wallet addresses, chat logs, and screenshots.
Be very wary of “recovery” services. Fraudsters commonly target scam victims a second time by offering to recover lost crypto for an upfront fee. Blockchain tracing is real, but recovery isn’t guaranteed, and unsolicited offers are a red flag.
Assume it’s part of a bigger pattern. As covered in our posts on business email compromise and voice cloning, crypto payment requests are frequently the final step of an impersonation scam, and a callback verification would usually have stopped it.

The bottom line

Following money on a blockchain is more accessible than most people expect, and more limited than the hype suggests. The ledger is public, the tools to read it are largely free, and the real skill is discipline: confirm the chain, separate what the ledger shows from what you infer, look for where the trail meets a real-world identity, and document everything as if someone will challenge it. Start with a free explorer, trace a few public example transactions to learn how funds split and merge, and treat every attribution as a lead until independent evidence supports it.

This builds directly on our earlier posts on link analysis, the OSINT toolkit, and the human-in-the-loop problem, all worth reading alongside this one.