Key considerations for law enforcement handling blockchain & cryptocurrency data

‍Why law enforcement needs to be able to spot crypto identifiers

As with any evolving financial technology, illicit actors are taking advantage of cryptocurrency as a means of perpetuating their crimes. 

Notable examples of where we can see crypto being used in crime are outlined below:

Fundamentally, all crypto-related crime is, at its core, financial crime – something which is not new. If one were to ask “where are you most likely to see crypto in financial crime?,” the short answer would be: everywhere.

Conducting on-chain investigations

While only some forms of crime can benefit from crypto, all forms of investigations stand to benefit from an understanding of crypto and on-chain data.

Ultimately, digital assets are a mechanism to move funds, and blockchain provides traceable data. Using blockchain intelligence tools can help to investigate known crimes and help identify suspect activity.

Blockchain intelligence has the power to support law enforcement by enabling investigators to:

• React real-time to incidents
• Proactively collect potential evidence
• Trace funds to off-ramps
• Provide support for seizures
• Identify criminals

What is blockchain tracing?

Blockchain tracing refers to tracking the source and destination of cryptocurrency transactions recorded on the currency’s blockchain (generally, a publicly available ledger of completed transactions between two or more cryptocurrency addresses.)

The investigative goal of “blockchain tracing,” generally, is to identify the actual controller of an otherwise pseudo-anonymous address. To do so, an investigator may be able to trace blockchain transactions and find counterparty exposure with an entity or individual that can provide the identity of the beneficial controller of an address. 

More simply, an investigator should follow the money to or from an entity that can provide real-world identity. Identified wallets could contain critical leads based on the source and destination of funds, including:

• Actor attribution
• A more complete picture of the actor’s assets
• Sources of funds
• Financial transactions on-chain and off-chain
• Other potential links to illicit activity

Without blockchain intelligence, leads are being left on the table 

With the use of cryptocurrency by illicit actors rising, it is more important than ever for law enforcement officials to be able to identify, report, and disrupt illicit virtual currency transactions and the actors conducting the transactions. 

Investigators run the risk of “leaving leads on the table” if they don’t “follow the money” on-chain when facing a case that involves cryptocurrency, subsequently presenting criminals with an opportunity to gain when faced with a situation where law enforcement can’t accurately assess the risk that a suspect poses due to not having a complete intelligence picture. 

Investigative examples

We took a look at three scenarios with different thematic threats where cryptocurrencies could be used by illicit actors and, if identified and analyzed properly, could provide an opportunity to advance an investigation.

1. Fraud

A member of the public has called the police after concerns about a vulnerable neighbor who is asking to borrow money. On speaking to the police, it is determined that the neighbor has been sending cryptocurrency to an address after promises of significant investment returns. 

On entering the address into TRM Tactical, the police are able to identify that this is a scam, and the person can be safeguarded from further financial abuse.

2. Child Sexual Abuse Materials (CSAM)

A registered sex offender is having a visit to see if they are complying with court orders in relation to their internet usage to prevent repeat offending. 

A cryptocurrency address is discovered on their computer. Entering this address on TRM Tactical shows that this is a deposit address to a CSAM marketplace, and the sex offender appears to be breaching their court order.

3. Drug trade

A suspicious vehicle is stopped and, during a search, a quantity of drugs, cash and cryptocurrency addresses are found. 

Entering the cryptocurrency addresses into TRM tactical shows a direct link to a known DarkNet Market, giving significant insights in the origin of the drugs.