A ransomware attack, a fake message to the finance department or a fictitious investment platform. In each of these cases, the money can quickly reach the stock exchange, private wallet or other blockchain. However, data on the flow of funds remains in the public register. The problem begins when you have to read them properly and connect them to specific people and events.
The company falls victim to a cyber attack. Criminals take over access to its systems, encrypt data and demand a ransom in cryptocurrency. In another case, an accounting employee makes a transfer to the account indicated in the forged message, and the money is transferred to the cryptocurrency exchange after a while. Another victim buys digital assets through an investment platform that does not actually exist.
Each of these cases requires an investigation that goes beyond the traditional analysis of bank accounts. Stolen funds can be converted into cryptocurrencies, sent between multiple addresses, transferred to other blockchains, or directed to services that make it difficult to determine their further path.
$154 billion went to addresses linked to crime in 2025
However, this number requires proper context. Transactions deemed illegal by Chainalysis still accounted for less than 1%. the entire volume of cryptocurrency operations.
However, the growing value of such flows means more and more work for investigators, financial institutions and compliance teams.
The growing scale of the use of cryptocurrencies in fraud, money laundering and cyberattacks creates demand for a new group of specialists. These are specialists combining blockchain analysis with cybersecurity, OSINT, finance and law
– explains Michał Królik, cryptocurrency expert from Mediarecovery.
Not only the police, prosecutor’s office and tax services need such competences. Banks, fintechs, cryptocurrency exchanges, law firms, auditing companies and anti-money laundering teams are also increasingly looking for them.
Blockchain shows the flow of funds, but not the name of the owner
In many public blockchain networks, transaction history is public and analysable. However, the record itself does not automatically reveal who controls a given address or who actually ordered a specific transaction.
To determine this, blockchain data must be compared with information from other sources. The investigation may include bank accounts, cryptocurrency exchanges, non-custodial wallets, instant messaging, social media profiles, fake websites and infrastructure used in the cyberattack.
Analyzing just one of these elements rarely shows the full picture.
This is what the specialization known as deals with crypto investigationsi.e. conducting investigations regarding cryptocurrencies and the flow of digital assets. It combines blockchain analysis, cybersecurity, computer forensics, finance and OSINT, i.e. obtaining and combining information from publicly available sources.
Knowledge of regulations and procedures for securing and documenting material is also needed. Even a properly conducted technical analysis may have limited value if it has not been prepared in a way that allows it to be used in the proceedings.
What should a cryptocurrency investigation specialist be able to do?
Crypto investigator must operate in several areas at the same time. He should understand:
- operation of blockchains, wallets and cryptocurrency exchanges,
- methods of analyzing the flow of digital assets,
- cybersecurity and computer forensics,
- OSINT and ways of combining information from various sources,
- finance, AML regulations, sanctions and regulations of the cryptocurrency market,
- rules for documenting material for legal proceedings.
It is not enough to determine which addresses the funds moved between. The analyst must also understand the economic sense of the transaction, the possible source of money, and the role of entities appearing at subsequent stages of the flow.
The most difficult thing is not just tracing the transaction in the public register. The real challenge begins when you need to determine who controls individual portfolios, link flows to specific events and prepare an analysis that will be understandable to lawyers, financial institutions or law enforcement agencies
– says a cryptocurrency market expert.
Europe sees a competence gap
There are cybersecurity specialists, AML analysts, lawyers, OSINT experts and financial investigators on the market. However, there is still a lack of people who can combine these competencies in one procedure.
Another 83 percent indicated the need to develop knowledge regarding modern technologies, criminals’ methods of operation and advanced methods of conducting financial proceedings.
The number of programs developing some of these skills is gradually increasing. However, still few of them combine blockchain technology, law, finance, OSINT and cybersecurity and allow working on cases similar to real investigations.
Business also needs Crypto investigations
Banks and payment institutions must assess sources of funds and identify transactions that may be related to fraud, money laundering or sanctions circumvention. Similar competencies are needed by crypto asset service providers, including exchanges that monitor flows and conduct internal proceedings.
Blockchain analysis can also be used by law firms, insurers, and consulting and auditing companies. It is useful when investigating fraud, compliance checks, contractor verification or asset recovery attempts.
This also applies to companies that do not deal with cryptocurrencies on a daily basis. If a company falls victim to ransomware, extortion or investment fraud, quickly tracing the flow of money can increase the chances of securing it.
In practice, a crypto investigator can support the process of contractor verification, sanction risk assessment, analysis of the source of funds or assets, internal explanatory proceedings and legal actions aimed at securing and recovering assets.
– explains Michał Królik.
AI will help with analysis, but it will not replace an investigator
Analytical tools and artificial intelligence can speed up working with large amounts of data. However, they will not replace an expert assessment of the context, nor will they independently answer the most important question: what actually happened and who is responsible for the flow of funds.
Crypto investigations will probably not become a mass profession. However, everything indicates that the demand for a small group of highly qualified analysts will exceed their availability in the coming years.
Organizations that develop such competencies earlier will be able to respond faster to abuses, cooperate more efficiently with law enforcement agencies and increase the chances of securing assets. Public blockchain provides data, but only a well-documented analysis allows the trace left there to be used.
