What is crypto forensics?

Crypto forensics is the work of analyzing blockchain transactions to find out where crypto came from, where it went and who controls it. Because most blockchains record every transfer publicly, investigators can follow stolen or illicit funds from wallet to wallet, then connect those wallets to real-world identities using exchange records and other evidence.

How does blockchain forensics work?

Every transaction on a public blockchain like Bitcoin or Ethereum shows the sending address, the receiving address, the amount and the time. Anyone can view this with a blockchain explorer. The hard part is attribution: working out which addresses belong to the same person or to a known service such as an exchange.

Forensic tools group related addresses into clusters and label clusters linked to exchanges, scams, hackers or sanctioned groups. When stolen funds reach a regulated exchange, investigators can ask it, often through legal process, for the account holder's identity, since exchanges collect identity information from customers. TRM Labs, for example, runs a network that lets law enforcement flag suspicious addresses so participating exchanges are alerted in real time.

Who are crypto forensic investigators?

They include analysts at blockchain analytics firms such as Chainalysis and TRM Labs, investigators at police and tax agencies, and private forensic consultants hired by victims, companies or lawyers in cases such as fraud or divorce.

These firms also measure crime at scale. Chainalysis estimated that illicit addresses received at least $154 billion in 2025, a record, though still under 1% of on-chain volume. It attributed about $2 billion in thefts to North Korean-linked hackers, most of it from the roughly $1.5 billion Bybit hack in February 2025. TRM Labs put 2025 illicit volume at about $158 billion and hacking losses at $2.87 billion. Estimates differ because each firm uses its own methods.

Can tracing stolen crypto get it back?

Sometimes. In February 2022, the US Justice Department said agents followed funds stolen in the 2016 Bitfinex hack through the blockchain, then found the private keys in an online account during court-authorized searches. They seized more than 94,000 bitcoin, worth over $3.6 billion at the time. The suspects had tried to hide the trail with fake identities, automated transactions and chain hopping into other coins.

Recovery is less likely when funds pass through mixers, privacy coins, bridges or exchanges that do not cooperate. The FBI said reported crypto-related fraud losses reached a record of about $11.4 billion in 2025, and its Recovery Asset Team froze $679 million across all types of fraud it acted on. Speed matters, so victims are urged to report quickly. See what to do if you are scammed.

Be careful with anyone who promises guaranteed recovery for an upfront fee. No one can guarantee that traced funds will be returned, and fake recovery services are a common follow-up scam, as explained in what are crypto recovery scams.