Blockchain forensics

A blockchain records every transfer with a timestamp, an amount and the sending and receiving addresses, but not a name. Blockchain forensics closes that gap with three steps: address clustering, which groups addresses that the same wallet software controls into one entity; heuristic analysis, which flags patterns typical of an exchange, a mixer or a known criminal service; and attribution, which ties a cluster to a real-world identity once it interacts with a licensed exchange, a payment processor or another point that collected identity documents. The Chainalysis 2026 Crypto Crime Report puts funds received by illicit addresses at more than 154 billion US dollars in the prior year, and states that sanctioned entities alone received 104 billion US dollars, a 694 percent increase over the year before.

A bank that offers crypto custody or accepts crypto-linked deposits under Germany's Geldwäschegesetz (GwG) has to know where a customer's crypto assets came from before it books them, the same duty it already carries for cash and wire transfers. KYC checks in Germany cover identity and beneficial ownership; a wallet's transaction history is the equivalent check for the funds themselves. A compliance team that cannot read a block explorer has to buy that judgment from someone else on every file, which is why banks, exchanges and crypto custodians increasingly train their own AML and fraud staff to read a transaction graph, not only buy a finished report.

The Bundeskriminalamt (BKA), Germany's federal police office, runs cybercrime and financial crime cases together with the Frankfurt public prosecutor's Zentralstelle zur Bekämpfung der Internetkriminalität (ZIT). The two agencies worked together with Dutch authorities to shut down the darknet exchange eXch and seize about 34 million euros in crypto assets and eight terabytes of forensic data. In the takedown of the Hydra Market, the BKA and ZIT took control of wallet keys holding roughly 25 million US dollars in bitcoin at the time. Europol coordinates the cross-border side of these cases, connecting national police forces with the blockchain analytics firms that supply the tracing software.

A transaction graph alone stops at a mixer, a cross-chain bridge or a wallet with no exchange history. From there, investigators combine the onchain trail with subpoenas to exchanges, IP and device data, and traditional financial records, the same layered approach a fraud case built entirely on wire transfers would use. A German court accepted this evidence style in a case where the regional court of Dresden ruled on the confiscation of bitcoin proceeds tied to a shut-down darknet marketplace, weighing blockchain records alongside conventional investigative material. Blockchain forensics narrows the search, but a conviction or a civil judgment still needs the same evidentiary chain courts have always required.

Finance Loop brings together compliance officers, fraud analysts and investigators who work with blockchain data. At When Banks Say 'No', a payments seminar at the NEXTOWER in Frankfurt, Dr. Julia Pfeil of Dentons spoke on payments governed by sanctions and anti-money laundering law, alongside a session on how blockchain forensics traces crypto flows in financial crime cases. Blockchain forensics belongs to the Risk & Compliance track at Finance Loop, next to KYC and crypto AML.

Blockchain analytics reads the public transaction record of a blockchain to group addresses by owner, spot patterns tied to exchanges or illicit services, and follow funds across transfers. Banks use it for onboarding and transaction monitoring, insurers and law firms use it to test a claim, and police forces use it to build a case file.

Yes, on a public blockchain such as Bitcoin or Ethereum every transfer is visible to anyone, which is why blockchain forensics can rebuild a fund's path years later. Tracing gets harder once funds pass through a mixer or a privacy-focused chain, but an exchange withdrawal or deposit at either end usually still ties the funds to an identity.

Banks use it during onboarding and ongoing monitoring under the GwG, insolvency administrators use it to locate a debtor's crypto assets, and law firms use it to support a civil claim. Police and prosecutors are one user group among several; they use forensics as authorities and are not obliged entities under the GwG. Section 2 of the GwG lists the obliged entities, such as banks and crypto service providers, that must run these checks as part of daily compliance work.