Investigating Cryptocurrencies

CHAPTER 12Finding Your Suspect

In this chapter, we will examine techniques you can use to track and, hopefully, locate your suspect. We discussed clustering addresses and following transactions in Chapter 10, “Following the Money,” but how can you identify a resource on a blockchain that is identifiable so that you are able—with the proper legal authorities or using open-source techniques—to obtain information on a suspect? This chapter will teach you about IP address tracing as well as its limitations, tracking to a service provider such as a currency exchange, and searching on the so-called dark web using Tor.

When investigating movement of funds on a cryptocurrency, it is easy to hit a dead end. Even with the techniques discussed in this chapter, there will be times when you will need to be patient and just watch and wait for coins to move to a traceable end point, such as a trader or exchange.

Tracing an IP Address

I sat in a presentation in 2017 where the law enforcement specialist in Bitcoin presented, among other things, a number of possible security vulnerabilities and methods for identifying users on the blockchain. Included in this list was a review of the “traceability of the IP addresses found on the Bitcoin blockchain.” It was one of those uncomfortable moments when you are willing someone to stop talking because they are very wrong in what they are saying, and you feel rather embarrassed for them. Simply put, the Bitcoin blockchain does not record any IP addresses. ...