CRYPTOCURRENCY AND BLOCKCHAIN FORENSIC TRACING From Wallet to Perpetrator: The Technical, Methodological and Legal Dimensions of On-Chain Analysis Review Article Blockchain Forensics • On-Chain Tracing • Clustering • Mixer • Money Laundering • Crypto Asset • Chain of Custody ABSTRACT The pseudonymity offered by crypto assets has made them a preferred instrument in acts such as laundering criminal proceeds, ransomware, fraud and sanctions evasion. Conversely, the public and immutable ledger structure of most blockchains creates a forensic traceability absent from traditional financial systems. This article examines the tracing of crypto-asset transactions by digital forensic methods along three axes: (i) the forensic foundations of the blockchain and the methodology of on-chain analysis (clustering, the common-input-ownership heuristic, attribution and graph-based tracing); (ii) the mixers, cross-chain bridges, privacy coins and layering techniques offenders use to conceal their trail; and (iii) the evidential value of the findings, the preservation of the chain of custody and their standing under Turkish law and international regulation. Drawing on 2025 data, the scale of the illicit crypto economy is discussed and the February 2025 Bybit heist examined as a concrete case. In the Turkish context, the crypto-asset service provider regime introduced by Law No. 7518, MASAK obligations and the framework of Article 282 of the Turkish Penal Code are assessed, and methodological recommendations for expert-witness practice offered. The study establishes that on-chain analysis is a powerful investigative tool, but becomes reliable courtroom evidence only when combined with off-chain identity data and when the chain of custody is rigorously preserved.
Keywords: blockchain forensics, on-chain tracing, clustering, common-input-ownership heuristic, mixer, money laundering, crypto asset, chain of custody, MASAK, Bybit. ABSTRACT The pseudonymity offered by crypto assets has made them a preferred instrument for money laundering, ransomware, fraud and sanctions evasion. Conversely, the public and immutable ledger structure of most blockchains creates a forensic traceability that is absent in traditional financial systems. This article examines the forensic tracing of crypto-asset transactions along three axes: (i) the forensic foundations of the blockchain and the methodology of on-chain analysis (clustering, the common-input-ownership heuristic, attribution and graph-based tracing); (ii) the obfuscation techniques used by offenders, including mixers, cross-chain bridges, privacy coins and layering; and (iii) the evidentiary value of the findings, the preservation of the chain of custody, and their standing under Turkish law and international regulation. Drawing on 2025 data, the scale of the illicit crypto economy is discussed and the February 2025 Bybit heist is analysed as a concrete case. In the Turkish context, the cryptoasset service provider regime introduced by Law No. 7518, the obligations under the Financial Crimes Investigation Board (MASAK) and the framework of Article 282 of the Turkish Penal Code are evaluated, and methodological recommendations for expert-witness practice are provided. The study concludes that on-chain analysis is a powerful investigative tool, but becomes reliable courtroom evidence only when combined with off-chain identity data and when the chain of custody is rigorously preserved.
Keywords: blockchain forensics, on-chain tracing, clustering, common-input-ownership heuristic, mixer, money laundering, crypto asset, chain of custody, MASAK, Bybit. 1. Introduction When crypto assets emerged with the work that formed the conceptual foundation of Bitcoin in 2008 (Nakamoto, 2008), they carried the promise of value transfer without the need for a central authority. The technical counterpart of that promise is that transactions are recorded not with an intermediary institution but in a ledger held jointly by a distributed network and linked cryptographically. In the time since, crypto assets have become both a legitimate investment and payment instrument and a channel used for moving, concealing and laundering criminal proceeds. This dual character creates a distinctive tension for the digital forensics discipline: while criminals turn to these instruments in search of anonymity, the same system's transparent ledger architecture offers a traceability difficult to obtain in traditional banking. The widespread public perception that 'cryptocurrency is completely anonymous' does not match the technical reality. In Bitcoin and similar open-ledger networks every transaction is recorded permanently and publicly; although user identities are not directly visible, the relationships between addresses and transactions can be analysed. For this reason the literature uses the more accurate concept of pseudonymity: identity is concealed behind a pseudonym (an address), but the link between the pseudonym and the real identity can be established with sufficient data and method. The pioneering work of Meiklejohn et al. (2013) showed experimentally that Bitcoin transactions can be clustered and connected to real-world actors, laying the foundations of modern blockchain forensics.
The scale of the illicit crypto economy has grown rapidly in recent years. According to the 2026 report of the blockchain analytics firm Chainalysis, the total amount received by illicit addresses in 2025 reached at least USD 154 billion, roughly 162% up on the previous year (Chainalysis, 2026). The same report notes that 84% of illicit volume now takes place through stablecoins and that the value received by sanctioned actors rose by 694% year on year. Even so, the share of illicit transactions in total crypto transaction volume remains below 1%; the problem matters less for its proportional size than for its absolute volume and the nature of the offending. This picture has made blockchain forensics an indispensable competence for law enforcement, prosecutors, regulators and private sector compliance units. But the use of on-chain data in investigations and trials is not limited to technical skill alone; the findings must be collected lawfully, their integrity preserved and their presentation before a court made intelligible. In Türkiye, Law No. 7518, published in the Official Gazette of 2 July 2024, brought crypto-asset service providers under regulation and moved them closer to the status of financial institutions under MASAK legislation; this development significantly changes the legal ground of forensic tracing practice.
The remainder of the article is organised as follows. Section 2 addresses the forensically significant building blocks of the blockchain and the concept of pseudonymity. Section 3 examines the methodology of on-chain analysis; Section 4 the concealment techniques used by offenders. Section 5 analyses the Bybit heist as a case study; Section 6 gives an overview of the illicit economy of 2025. Section 7 concerns the chain of custody and the forensic process, Section 8 the legal framework and Section 9 the Turkish context. Section 10 covers challenges and recommendations, Section 11 the conclusion. Throughout, no reference is made to any real investigation file or person; only technical and legal awareness is intended, on the basis of publicly available reports and academic sources. 2. The Forensic Foundations of the Blockchain and Pseudonymity To understand blockchain forensics one must first grasp which traces this technology produces from a forensic standpoint. A blockchain is a data structure ordering transactions chronologically and linking each block to the previous one with a cryptographic hash. That linkage makes retrospective alteration of the ledger practically impossible; when the content of a block is changed, the hashes of all subsequent blocks become invalid. This property is critical forensically: the ledger's immutability means that a transaction once recorded cannot subsequently be falsified, which provides a natural guarantee of evidential integrity.
2.1. Address, Transaction and Ledger Structure In a crypto-asset system, users transact not with their real identities but through addresses based on public key cryptography. An address is, roughly, an alphanumeric string derived from the user's private key representing a destination to which funds can be sent. Transactions define value transfers between those addresses and are written to the ledger once verified by the network. That a user is not limited to a single address but can generate hundreds or even thousands is a phenomenon that both complicates and enriches forensic analysis, because the connections between those addresses carry valuable signals.
Two basic accounting models directly affect the forensic approach. The UTXO model used by Bitcoin (Unspent Transaction Output) treats each piece of funds as a separate 'output'; a transaction consumes previous outputs as inputs and produces new outputs. This structure allows funds to be traced almost like marked banknotes and is a forensic advantage. The account model used by Ethereum, by contrast, is a structure in which each address holds a balance and smart contracts run; here funds mingle within balances and direct 'piece' tracing is not as clear as in UTXO. Table 1 summarises a forensic comparison of the two models. Table 1. A Comparison of the UTXO and Account Models for Forensic Tracing Feature UTXO Model (Bitcoin) Account Model (Ethereum) Basic unit Unspent output (coin piece) Address balance Fund tracing Piece-based, high clarity Balance-based, mingling risk Common input ownership (CIOH) Clustering heuristic strong CIOH weak; contract analysis required Smart contracts Limited (Script) Comprehensive; DeFi, bridges, mixers Forensic difficulty Low–moderate Moderate–high (contract interaction) Note. Compiled on the basis of Nakamoto (2008) and Meiklejohn et al. (2013). 2.2. The Pseudonymity Fallacy The reason blockchain forensics exists is that crypto assets are not anonymous but pseudonymous. The real person behind an address is not directly visible; but the address appears openly in a permanent ledger accessible from anywhere in the world. This allows two kinds of link to be established. First, on-chain links: transaction relationships between addresses, common spending patterns and timing traces. Second, off-chain links: connecting an address to an exchange account, an IP address, a KYC (Know Your Customer) record or a public forum. The ultimate power of forensic tracing lies in the capacity to combine these two layers.
The most critical point in unravelling pseudonymity is that most users sooner or later come into contact with a centralised service (an exchange, a payment provider, an ATM). An offender wishing ultimately to convert criminal proceeds into spendable fiat currency must pass through a KYC procedure at a regulated crypto-asset service provider. That exit point (off-ramp) is forensically the weakest link in the chain: it is where the on-chain trail meets a real identity. Experienced analysts therefore focus tracing not merely on 'where the funds went' but on 'through which regulated gate the funds entered and left the system'. 2.3. The Hash Chain, Immutability and Evidential Integrity At the foundation of the blockchain's forensic value lies the cryptographic hash chain linking blocks. Each block contains a digest of its own transactions (a Merkle root) and the digest of the previous block; that structure turns the ledger's history into an almost sealed chain. Once a transaction has been written to the ledger and enough blocks have been added on top of it, retrospectively altering that transaction would require recomputing all subsequent blocks, which is practically impossible on a distributed network. Forensically, this property turns the guarantee of 'non-alteration' — which requires great effort with traditional digital evidence — into a guarantee inherent in the protocol.
But that guarantee applies only to the ledger itself, not to the interpretations the analyst draws from it. While the immutability of a transaction hash is beyond dispute, an attribution inference of the form 'this address belongs to this person' depends entirely on the analyst's method and data source. That distinction is of vital importance for expert-witness work: while the ledger's raw data is objective and verifiable, the attribution and clustering results derived from that data are probabilistic and must be supported by a defensible methodology. A good report separates these two layers — immutable raw data and interpretive inference — with care. 3. On-Chain Analysis Methodology On-chain analysis is the set of methods converting the raw data in the public ledger into meaningful, actor-linked intelligence. The process generally proceeds in five stages: data collection, clustering, attribution, tracing and visualisation. Figure 1 shows a typical forensic tracing workflow.
Figure 1. The On-Chain Forensic Tracing Workflow (2025) 3.1. Data Collection and Ledger Access The first step of any forensic analysis is access to reliable and complete data. There are two basic routes to blockchain data. The first is for the analyst to hold a direct copy of the ledger through a full node they run themselves and verify transactions at source; this method provides the highest confidence and independence because it requires trusting no third party. The second is to make use of the ready-made interfaces offered by third-party data providers and analytics platforms; this method is faster and more practical but involves implicit trust in the provider's data integrity. In the context of examining and reporting, verifying critical findings as far as possible at source — through an independent node or by comparing several providers — strengthens the report. Another matter requiring attention at the data collection stage is determining the precise temporal and structural boundaries of the phenomenon examined. Which block range, which addresses and which transactions fall within the scope of the examination must be defined clearly at the outset. That scope definition both ensures the reproducibility of the examination and prevents the risk of subsequent 'scope creep' (the unjustified widening of the analysis). Good practice requires recording the transaction hash and block height underpinning each finding; an independent expert can then reach the same conclusion from the same data. 3.2. Clustering and the Common Input Ownership Heuristic Clustering is the technique of inferring that different addresses belong to the same real-world actor (a person, exchange or service). The strongest and most widespread clustering method is known as the Common Input Ownership Heuristic (CIOH). The logic of this heuristic is simple: if more than one address is used as an input in a transaction, it is likely that a single party controls all of them, because each input must be signed with its private key for the transaction to be valid. Hundreds of addresses can thereby be combined under a single wallet cluster. CIOH is extremely effective in UTXO-based Bitcoin in particular; but transactions such as CoinJoin, which deliberately combine the inputs of multiple users, are designed to mislead this heuristic.
The second important heuristic is called change detection. If the amount sent in a transaction is smaller than the sum of the inputs, the difference generally returns to a new 'change address' belonging to the sender. By determining which output is the change, the analyst can expand the wallet cluster. These inferences are probabilistic; they carry a risk of false positives, and the assumption and margin of error underpinning each heuristic must therefore be stated explicitly in the report. The performance of clustering methods varies by heuristic; Table 2 summarises the measured performance of typical mixer detection methods. Table 2. A Comparative Performance of Mixer Detection Methods Method Precision Recall Implementation Note Machine learning based 93% 89% Feature rich; requires labelled data Common input (CIOH) 88% 79% Strong in UTXO; weakens with CoinJoin Equal amount matching 82% 75% Simple; high false positive risk Note. Compiled on the basis of comparative academic measurements. Values may vary by data set.
3.3. Attribution and Graph-Based Tracing Clustering separates addresses into anonymous groups, but does not say to whom those groups belong. Attribution fills that gap. Attribution is the process of linking a cluster of addresses to a known entity — an exchange, a mixer, a ransomware group, a wallet on a sanctions list. Attribution sources are varied: data obtained from exchanges through legal process, public forum and social media posts, intelligence gathered from darknet marketplaces, honeypot transactions and law enforcement cooperation. Commercial analytics platforms (Chainalysis, TRM Labs, Elliptic) are built on vast databases of billions of labelled addresses, and this collective intelligence, which a lone forensic analyst could not access, forms the backbone of tracing.
Graph analysis conducted over labelled clusters models and visualises the flow of funds from one actor to another. Each address is represented as a node and each transaction as an edge, and the fund flow is traced across that graph forwards (where the funds went) or backwards (where the funds came from). During tracing the analyst starts from a 'dirty' source and maps all the intermediate stops the funds pass through — exchanges, bridges, mixers — attempting to reach the final exit point. These visualisations are invaluable both for the investigation team's grasp of the situation and for presenting a complex flow intelligibly before a court; a good forensic report must indeed combine technical accuracy with visual simplicity. Table 3. A Comparison of the Principal Blockchain Forensic Analysis Platforms Platform Distinguishing Feature Typical User Chainalysis (Reactor/KYT) Broad attribution database, compliance integration Law enforcement, exchange compliance unit TRM Labs Cross-chain tracing, sanctions screening Law enforcement, regulator Elliptic Risk scoring, DeFi coverage Financial institution, compliance Open source (e.g. GraphSense) Transparent, auditable method Academia, expert witness Note. Compiled on the basis of the platforms' public documentation. The comparison is not promotional.
3.4. Behavioural and Temporal Heuristics Beyond structural heuristics (CIOH, change detection), modern forensic analysis also makes use of actors' behavioural and temporal traces. Users unknowingly leave patterns of their own: the time zones in which they transact, preferred fee levels, the characteristic transaction structures produced by particular wallet software and habits of address reuse. For example, the hours in which transactions concentrate may point to a geographical time zone; the input ordering of a particular wallet client can be used to distinguish clusters from one another. Although these behavioural fingerprints do not give a definitive result on their own, they increase attribution strength when combined with other signals.
Temporal analysis also plays a critical role in penetrating concealment layers such as mixers and bridges. Between funds entering a mixer and leaving shortly afterwards in similar amounts, timing correlation allows a probabilistic link to be established. Likewise, funds entering one side of a cross-chain bridge and leaving the other can be matched by overlap in time and amount. Such correlation analyses produce a strong indication rather than definitive proof; the person examining and reporting must therefore characterise the finding as 'highly probable' rather than 'certain' and show the temporal data underpinning it in the report. 4. Concealment and Laundering Techniques The offender's aim is to break the link between the on-chain trail and their real identity. The techniques developed for that purpose work on a logic similar to the three-stage model of classic money laundering — placement, layering and integration — but reinforced with cryptographic tools. This section addresses the principal concealment methods and their forensic countermeasures.
4.1. Mixers (Tumblers) A mixer or tumbler is a service that pools the funds of many users and redistributes them, blurring the link between input and output addresses. Centralised mixers require trust in an operator, and that operator constitutes a weak link. Decentralised mixers, by contrast, run on smart contracts; the best known is Tornado Cash, which runs on Ethereum and uses zero-knowledge proofs. Tornado Cash was placed on the US Treasury's sanctions list in 2022, and in subsequent years the scope and legal basis of that listing have been contested before the courts. Mixers do not technically erase the trail entirely; entry and exit timing, amount patterns and pool size can be used for probabilistic matching. CoinJoin-based wallets (e.g. Wasabi) deliberately mislead the CIOH heuristic by combining the transactions of multiple users into a single large transaction. Because such transactions invalidate the common input ownership assumption, the analyst must resort to additional signals (amount analysis, subset sums, timestamps) to separate the participants. Post-mixer tracing is one of the most difficult areas of forensic analysis and generally produces probabilistic rather than definitive results; that uncertainty must be stated honestly in the examination report. 4.2. Cross-Chain Bridges and Chain-Hopping The second major technique complicating tracing is moving funds from one blockchain to another (chain-hopping). Cross-chain bridges and decentralised exchange protocols allow funds to be transferred rapidly from Bitcoin to Ethereum and from there to another network. Each transition requires the analyst to work with a different ledger structure and often a different analytical tool; the trail can break at the 'seams' between networks. One of the most important developments in modern forensic platforms is precisely this cross-chain tracing capability: matching funds entering a bridge contract with funds leaving on the other side through timing and amount correlation. Without that capability, chain-hopping remains an effective layer of concealment.
4.3. Privacy Coins Unlike the open ledgers of Bitcoin and Ethereum, some crypto assets build privacy into their design at protocol level. Monero uses ring signatures, stealth addresses and confidential transaction amounts (RingCT) to conceal sender, recipient and amount by default, which largely renders on-chain analysis inoperative. Zcash offers 'shielded' transactions based on zero-knowledge proofs, but the fact that most users prefer transparent transactions creates a forensic opportunity. Such privacy coins constitute the limits of forensic tracing; in these cases an investigation must rely on off-chain evidence (seized devices, exchange records, operational errors) rather than on-chain data. 4.4. Layering and the Peel Chain Offenders do not settle for a single technique; they combine several methods in successive layers. In the pattern known as a peel chain, a large amount is passed through a series of successive addresses with a small piece 'peeled off' at each step; the main mass moves on while small pieces are distributed to exchanges. This aims both to avoid attention by splitting the amount and to exhaust the analyst by lengthening the trail. Layering reaches its height in complex scenarios where mixers, bridges and peel chains are used together. Even so, none of these techniques removes the ledger's immutability; with sufficient resources, the right tools and off-chain data, a significant proportion of the layers can be unravelled. The Bybit case in the next section makes concrete both the sophisticated use of these techniques and the limits forensic tracing reaches. 4.5. DeFi, NFTs and New On-Chain Laundering Surfaces The growth of the Decentralised Finance (DeFi) ecosystem has opened new surfaces for laundering. Decentralised exchanges (DEX), liquidity pools, lending protocols and automated market makers allow funds to be converted rapidly from one asset to another without giving identity to an intermediary. An offender can blur the trail by converting a stolen asset into different tokens across several protocols. Similarly, digital assets whose value is subjective and easily inflated — NFTs, for instance — can be used to conceal value transfer through wash trading. These new surfaces require the forensic analyst to be able to analyse not merely simple transfers but smart contract interactions. Yet DeFi's transparency is also a forensic opportunity. Most decentralised protocols carry out their transactions on the open ledger and through auditable smart contracts, which means that every interaction — a swap, entry into a pool, borrowing — leaves a permanent trace. Unlike the classic system in which a central intermediary inevitably collects identity, DeFi collects no identity but records every step. For an experienced analyst, therefore, DeFi is not a place where the trail is lost but a rich data source in which the trail can be followed when smart contract logic is read correctly. What is decisive is the capacity of the tool and the analyst to analyse interactions at contract level.
5. Case Study: The Bybit Heist (February 2025) On 21 February 2025 the Dubai-based crypto exchange Bybit suffered the largest single digital heist in crypto history with the theft of roughly USD 1.5 billion in Ethereum (ETH). The US Federal Bureau of Investigation (FBI) formally attributed the incident on 26 February 2025 to the North Korea-linked Lazarus group (FBI, 2025). This case is a laboratory illustrating both the power and the limits of modern blockchain forensics, in terms of both the technical method of the attack and the laundering chain that followed. The origin of the attack lay not directly on the blockchain but in the human and supply chain layer. According to reports, a file containing malware was delivered to a DevOps engineer through LinkedIn under the guise of a fake job offer; by that route the attackers infiltrated the development environment of Safe{Wallet}, the multi-signature wallet infrastructure used by Bybit. During a routine update on 19 February, malicious code was injected into the signing interface; the officials approving the signature thus believed they were approving a legitimate transaction while in fact signing one permitting the transfer of funds to addresses under the attackers' control. The funds were emptied within roughly 23 minutes. This detail underlines an important forensic lesson: however powerful on-chain tracing may be, the root cause of a breach is most often an off-chain social engineering or supply chain attack.
The laundering of the stolen funds is almost a showcase of the techniques described in Section 4. The attackers first distributed the funds across a large number of intermediate wallets; then passed them through Tornado Cash, Wasabi Wallet, Railgun and various mixers; and finally moved the funds from network to network with cross-chain swap and bridge protocols such as THORChain, eXch, Lombard, LiFi, Stargate and SunSwap (TRM Labs, 2025). Figure 3 offers a simplified schematic of that layered laundering chain. Blockchain intelligence firms traced a significant proportion of the funds in real time, alerting exchanges and securing the freezing of some assets; but according to reports roughly 28% of the stolen amount became untraceable because of the layered concealment. Figure 3. The Layered Laundering Chain in the Bybit Heist (2025) The attribution dimension of the case is also instructive. The infrastructure, laundering patterns and recurring operational habits used by North Korea-linked groups in crypto heists have been documented in detail by blockchain analysts over the years. In the Bybit incident too, attribution rested not on a single transaction but on the intersection of the wallet clusters used with previous attacks, the characteristic signature of the laundering method and the convergence of independent intelligence sources. This shows that the most robust form of forensic attribution is built when many independent layers of evidence point to the same conclusion. The FBI's public announcement and the independent analyses of blockchain intelligence firms confirmed one another in this way, reinforcing the credibility of the attribution.
The forensic lessons of the Bybit case are multi-layered. First, although blockchain forensics does not prevent an attack, it can trace the offender's trail in real time afterwards and block a significant proportion of the laundering; that is a speed almost impossible in traditional finance. Second, when concealment techniques are used in layers by a well-resourced state-sponsored actor, some of the funds can become permanently untraceable; on-chain analysis is powerful but not absolute. Third, the attribution process — linking an incident to a particular actor — rests not only on on-chain patterns but also on address clusters intersecting with previous attacks, the infrastructure used and intelligence cooperation. That integrated approach is the methodological stance a person examining and reporting should also adopt. 6. The Illicit Crypto Economy in 2025 Beyond individual cases, an overall picture of the illicit crypto economy guides the setting of forensic priorities. According to Chainalysis's 2026 report, the total value received by illicit addresses in 2025 reached at least USD 154 billion, a striking increase on the revised 2024 figure of roughly USD 57.2 billion (Chainalysis, 2026). Figure 2 shows the distribution of that volume across the principal categories. Figure 2. Illicit Crypto Volume by Category in 2025 The most striking aspect of the data is that the rise stems largely from sanctions evasion: the value received by sanctioned actors rose roughly 694% year on year to about USD 104 billion. That is followed by an estimated USD 17 billion in fraud and scam activity, roughly USD 3.4 billion in funds stolen through hacks and around USD 820 million in ransomware payments. It is also noted that state-sponsored groups associated with actors on sanctions lists — the North Korea-linked Lazarus group in particular — stole roughly USD 2 billion in 2025. This picture shows that crypto crime has acquired a geopolitical, state-sponsored dimension rather than remaining a matter of individual fraud.
Another structural transformation is that the share of stablecoins in illicit volume has reached 84%. Offenders prefer value-preserving stablecoins to the highly volatile Bitcoin; but that preference also carries a forensic opportunity: the principal stablecoin issuers are centralised and can freeze particular addresses on legal request. Indeed in 2025 that freezing mechanism was effective in recovering some of the stolen funds. This shows that forensic strategy must be pursued not only through technical tracing but also through legal cooperation with issuers and exchanges. Table 4. The Principal Illicit Categories and Forensic Starting Points Category Forensic Starting Point Priority Method Ransomware Ransom payment address Backward cluster inference from the payment Exchange/protocol hack Stolen fund exit transaction Real-time tracing + freezing Investment fraud Victim payment addresses Identification of the collection wallet and off-ramp Darknet market Marketplace escrow address Payment flow and user clustering Sanctions evasion Contact with a listed wallet Sanctions screening + cross-chain tracing Note. Compiled on the basis of Chainalysis (2026) and Europol (2024) typologies. The ransomware economy is one of the most mature application areas of crypto forensics. Because ransom payments are made almost entirely in crypto assets, payment addresses form the starting point of the investigation; from those addresses the wallet cluster of the group receiving the payment, the mixers it uses and its final exit points can be mapped. According to 2025 data, ransom payments amounted to roughly USD 820 million; but the real significance lies in tracing those payments to expose the infrastructure of the ransom ecosystem. Blockchain analysis can reveal the 'ransomware-as-a-service' model behind a ransom campaign, the profit sharing between affiliates and the group's operational infrastructure. Darknet marketplaces are also a constant target of crypto forensics. These marketplaces are platforms where drugs, stolen data and illicit services are bought and sold with crypto assets; tracing payment flows allows both marketplace operators and heavy users to be identified. Historically, blockchain tracing has played a decisive role in bringing down the largest darknet operations. These experiences reinforce a common lesson: while criminals act on an assumption of anonymity, the ledger's permanent memory often allows the trail to be followed even years later. The deterrent effect of crypto crime feeds precisely on that delayed but permanent traceability. 7. The Chain of Custody and the Forensic Process Whether the findings produced by on-chain analysis can be used in an investigation file and in court depends on following a process consistent with the basic principles of digital forensics. Technical accuracy is necessary but not sufficient; the finding must have been collected lawfully, its integrity preserved and be reproducible.
7.1. Seizure and Taking Control of the Wallet Seizing crypto assets requires different technique from traditional seizure. Control of the asset lies not in a physical object but in the private key or the recovery seed phrase from which it derives. When a device (computer, phone, hardware wallet) is seized, the forensic team's priority is therefore to obtain lawfully the key material required to move the asset to a secure wallet under law enforcement control. If the key cannot be obtained, the asset cannot be seized even if its existence is established; this is a fundamental difference from traditional seizure. Documenting the state of the wallet (balance, address list, transaction history) meticulously at the moment of seizure is critical for subsequent analysis. 7.2. Evidential Integrity and Chain of Custody At the heart of the forensic process lie the concepts of chain of custody and integrity. Although on-chain data is public and immutable, which inferences the analyst drew from that data and by what method must be documented. Good practice requires the transactions and blocks examined to be identified precisely by block height and transaction hash, the tools used and their versions to be recorded, and the analysis to be reproducible by an independent expert from the same data. A cryptographic hash of seized digital evidence (wallet files, device images) should be taken and every transfer recorded from the moment of seizure. That rigour ensures the technical finding survives if the report is challenged in court. 7.3. Reporting A blockchain forensic report must satisfy three audiences at once: the technical expert, the lawyer and the judge. It must therefore balance the technical defensibility of the method with intelligibility for the non-technical reader. A good report ties each assertion to a specific transaction hash; states explicitly the uncertainty of probabilistic inferences (clustering, change detection); and discusses the reliability of attribution sources. The author of the report must understand and state transparently the heuristics on which a commercial analytics tool rests and its possible sources of error, rather than passing on its result unquestioned. Otherwise a report that appears technically correct but is methodologically questionable can rightly be refuted by the defence. 7.4. Confiscation and Asset Recovery One of the ultimate aims of the forensic process is the confiscation of crypto assets obtained through crime, recovering the economic gain from the offender. This has both a punitive and a deterrent function, since the logic of economic crime rests on the gain being retainable. Two technical preconditions stand out in the confiscation of crypto assets: the lawful identification and definition of the asset (in which address, how much) and access to the key material needed for actual seizure. Where the key cannot be obtained, the asset may not be physically movable even with a court order; in that case the asset remains 'frozen' at the relevant address but inaccessible. Timing is critical in asset recovery. Stolen funds reaching a centralised service provider (exchange, stablecoin issuer) can be frozen on legal request; but that window of opportunity is often limited to hours. Effective recovery therefore requires the coordination of real-time tracing with rapid legal intervention. Internationally, the recovery of assets in different jurisdictions rests on mutual legal assistance agreements and on increasingly developed international cooperation networks.
7.5. Automation, Artificial Intelligence and Human Oversight The volume and complexity of blockchain forensics make automation essential. Since examining millions of transactions by hand is impossible, clustering, risk scoring and pattern recognition functions are increasingly delegated to machine learning and artificial intelligence models. These tools can detect subtle patterns a human analyst might miss and scan large data sets within seconds. But the speed automation brings carries a responsibility: a risk score or cluster suggestion produced by a model is not a final truth but a hypothesis the human expert must verify.
In a forensic context, accepting the output of a 'black box' artificial intelligence unquestioned is a serious methodological risk, because the defence can rightly question how the model reached its decision. Good practice therefore requires automated tools to produce explainable results and every critical finding to be justified by a human expert. Artificial intelligence does not replace the forensic analyst; it is a tool extending their capacity while leaving final judgement and responsibility with the human. What is answerable before a court is not the model but the person who examines and signs the report; that person must therefore understand and be able to defend every result the tool produces. 8. The Legal Framework The outputs of blockchain forensics acquire meaning only within a suitable legal framework. This section addresses the subject first under Turkish law and then in terms of international regulation.
8.1. Turkish Law: Law No. 7518, MASAK and Article 282 of the Turkish Penal Code The most important regulation concerning crypto assets in Türkiye is Law No. 7518, published in the Official Gazette of 2 July 2024. Amending Capital Markets Law No. 6362, this Law defines a crypto asset as 'an intangible asset that can be created and stored electronically using distributed ledger technology or a similar technology, distributed over digital networks and capable of expressing value or a right'. The Law brought crypto-asset service providers (KVHS) under the supervision and licensing regime of the Capital Markets Board (SPK) (Law No. 7518, 2024). The most critical transformation for forensic tracing is that KVHS are made obliged parties under MASAK (Financial Crimes Investigation Board) legislation and thereby moved closer to the status of financial institutions. That status places KVHS in the same class as banks and payment institutions in terms of know-your-customer (KYC), suspicious transaction reporting and record-keeping obligations. In practice this creates a legal infrastructure facilitating access to a real identity at the exit point (off-ramp) of on-chain analysis: the person behind funds entering a Turkish KVHS becomes identifiable on legal request.
In criminal law terms, laundering criminal proceeds through crypto assets constitutes the offence of 'laundering assets derived from crime' under Article 282 of the Turkish Penal Code. The penalty for that offence is imprisonment from three to seven years and a judicial fine of up to twenty thousand days. The use of a crypto asset as the instrument does not change the character of the offence; but proof, unlike in classic laundering, requires blockchain forensics. Seizure, search and examination must be carried out in accordance with the relevant provisions of the Code of Criminal Procedure (particularly Article 134 on search and seizure in computers); otherwise the evidence obtained may be deemed unlawful. 8.2. International Regulation: FATF, MiCA and Sanctions Internationally, the Travel Rule introduced by the Financial Action Task Force (FATF) is decisive. That rule requires identifying information on the sender and recipient to be shared between service providers for crypto transfers above a given threshold, bringing crypto transfers closer to the traceability standard of traditional wire transfers (FATF, 2021). In the European Union the MiCA (Markets in Crypto-Assets) regulation governs crypto-asset markets comprehensively, imposing licensing and compliance obligations on service providers (EU MiCA, 2023). These regulations strengthen the institutional infrastructure needed for on-chain analysis to be combined with off-chain identity data.
The sanctions regime is also playing an increasingly central role. The addition by the US Treasury's Office of Foreign Assets Control (OFAC) of particular wallet addresses and even of a mixer protocol (Tornado Cash) to its sanctions list has opened important legal debates about the applicability of sanctions to code and protocols. For the forensic analyst and expert witness, this means assessing not only whether funds are 'criminal proceeds' but also whether they have come into contact with 'a sanctioned address'. Sanctions screening has become a standard function of modern blockchain analytics platforms. 8.3. International Cooperation and the Standard of Attribution The borderless nature of crypto assets requires the forensic process too to be international by nature. Funds traced in a Turkish investigation can reach exchanges, bridges and service providers in different jurisdictions within minutes. An effective investigation therefore rests on mutual legal assistance treaties (MLATs), direct law enforcement cooperation networks and increasingly developed international crypto-asset recovery mechanisms. But the classic speed of those processes is slow compared with the speed at which crypto funds move; that asymmetry increases the importance of pre-established rapid notification channels and of operational cooperation maintained with exchanges.
Another critical aspect of the international dimension is the standard of attribution. Linking an attack or a fund flow to a particular actor — a state-sponsored group, for example — rests not only on on-chain patterns but on the joint assessment of the infrastructure used, address clusters intersecting with previous incidents and independent intelligence sources. That integrated approach to attribution prevents the errors hasty conclusions based on a single signal can cause. For the person examining, the principle to adopt is clear: attribution must be made with the degree of certainty stated explicitly and the layers of evidence on which it rests shown transparently; an unverified inference must never be presented as a definitive finding.
9. The Turkish Context and Practice Türkiye is one of the countries with intensive crypto-asset use, which increases both the risk of illicit use and the need for forensic tracing. The licensing and MASAK regime introduced by Law No. 7518 has raised the compliance capacity of domestic exchanges, which in turn facilitates identification at domestic off-ramp points. But offenders try to evade that oversight using foreign exchanges, peer-to-peer (P2P) transactions and decentralised platforms, which makes international forensic cooperation essential. In practice, Turkish investigating authorities encounter three kinds of difficulty in blockchain forensics. The first is capacity: on-chain analysis requires specialised tools and trained experts, and that capacity must be spread within law enforcement and the judiciary. The second is data access: obtaining data from foreign exchanges depends on mutual legal assistance (MLAT) processes and takes time, whereas crypto funds move within minutes. The third is legal characterisation: characterising a crypto asset as property requires a careful approach as regards the legal basis for seizure and confiscation. The approach recommended against these difficulties is an interdisciplinary investigation model in which technical and legal expertise are pursued together. In examination and reporting practice, the analyst should be expected not merely to present the output of a commercial tool but to prepare a reproducible report setting out explicitly the heuristics used, attribution sources and margins of uncertainty. Moreover, rapid and lawful data sharing channels established with domestic KVHS are decisive for exploiting the time window critical to freezing funds.
Another structural advantage for Türkiye is the large domestic service provider ecosystem arising from the prevalence of crypto-asset use. Together with the compliance obligations introduced by Law No. 7518, that ecosystem means that a significant proportion of off-ramp transactions taking place domestically are on record. When an effective investigation model combines those domestic records — KYC data, suspicious transaction reports, transaction logs — with on-chain tracing, the probability of reaching the offender's real identity increases markedly. What is critical is that the bridge between those two data layers can be built lawfully and rapidly. Training and capacity building are the most urgent need in the Turkish context. Blockchain forensics is a hybrid expertise requiring both technical depth and legal judgement; spreading that expertise at the level of judges, prosecutors and law enforcement directly affects the quality of justice. Strengthening the institution of expert witnessing in this field — training expert witnesses who are competent, methodologically transparent and independent — both reduces the risk of erroneous attribution and enables technical findings to carry the weight they deserve in court. The value of a forensic report is measured less by the power of the tool it uses than by the methodological rigour of the expert using it. On the other hand, the inclusion in today's expert witness mechanism of commercially motivated firms as institutional expert witnesses casts a shadow over the principle of independence by bringing commercial concerns to the fore. 9.1. A Representative Investigation Scenario To make the concepts concrete, let us consider a wholly representative scenario making no reference to a real file. A victim of investment fraud states that they sent a quantity of stablecoin to a wallet on the promise of high returns and subsequently lost access. The starting point of the investigation is the destination address to which the victim made payment. The analyst first clusters that address and the addresses sharing common inputs with it to determine the offender's collection wallet; then, by identifying other victim payments entering that cluster, reveals the true scale of the fraud.
In the second stage the analyst traces how the collected funds were laundered. Part of the funds is seen to have been transferred to a mixer and part moved to another network through a cross-chain bridge. While the post-mixer trail becomes probabilistic, the funds passing through the bridge are recaptured on the other network by timing and amount correlation. Finally some of the funds are found to have reached the deposit address of a regulated exchange. That exit point is the key link of the investigation: a lawful request directed to the exchange can reveal the KYC record — the real identity — behind that deposit address.
In the third stage all these findings are combined in a forensic report. The report documents each step with the relevant transaction hash; states explicitly the probabilistic nature of the clustering and change inferences; expresses honestly the margin of uncertainty of the post-mixer trail; and characterises separately, as off-chain evidence, the off-chain link established with the exchange record. This scenario illustrates the article's main thesis: on-chain analysis provides a powerful start, but the result reaches its full value before a court only when combined with off-chain identity data and when the chain of custody is preserved. It must be stressed that this scenario is purely illustrative and relates to no real file or person.
10. Challenges, Limits and Recommendations Blockchain forensics is a powerful discipline; but its limits must be acknowledged honestly. The following points summarise the field's principal challenges and the associated recommendations: • Probabilistic inference: heuristics such as clustering and change detection are probabilistic rather than definitive; margins of error and assumptions must be stated explicitly in the report. • Privacy coins: on-chain analysis is largely inoperative on protocol-level private networks such as Monero; in those cases one must turn to off-chain evidence. • Cross-chain escape: chain-hopping can break the trail between networks; tools without cross-chain tracing capability fall short.
• Attribution risk: linking a cluster to a particular person remains speculative without off-chain verification; erroneous attribution is a serious source of forensic error. • Speed asymmetry: while funds move within minutes, legal request processes take days; pre-established channels with exchanges are needed for rapid intervention. • Tool dependence: blind trust in commercial platforms weakens methodological transparency; auditable, open methods should be preferred wherever possible. The common denominator of these recommendations is the combination of technical competence with legal rigour and methodological transparency. On-chain analysis is not a 'magic wand' on its own; but combined with off-chain data and a sound chain of custody it is one of the most effective tools in the fight against contemporary economic crime.
11. Conclusion The pseudonymity offered by crypto assets was long perceived as a refuge for offenders. Yet as this article has shown, the open and immutable ledger structure of most blockchains offers a traceability difficult to obtain in the traditional financial system. On-chain analysis — through clustering, attribution and graph-based tracing — can link anonymous addresses to real-world actors and can produce significant results even in the face of concealment techniques such as mixers, bridges and layering. Even so, the power of on-chain analysis is not absolute. As the Bybit case shows, a well-resourced actor can render part of the funds permanently untraceable with layered concealment; and privacy coins constitute the natural limit of the analysis. Blockchain forensics therefore reaches its full value when combined with off-chain identity data — exchange records, seized devices, operational errors. For Türkiye, the licensing and MASAK regime established by Law No. 7518 strengthens the legal infrastructure making that combination possible; but practical problems such as capacity, data access and speed asymmetry await resolution.
Another pattern this article sets out is the continuous race between technology and regulation. Each new concealment technique — decentralised mixers, cross-chain bridges, privacy coins — triggers the development of forensic methods and legal instruments, and that development in turn drives offenders towards new techniques. What is decisive in that cycle is having not a static tool set but an approach that continually learns and updates its method. The future of crypto forensics is moving towards AI-assisted pattern recognition, integrated cross-chain tracing and an ever closer integration of regulatory data with on-chain intelligence, which reinforces the field's interdisciplinary character. Ultimately, the value of blockchain forensics before a court depends as much on methodological transparency and the rigorous preservation of the chain of custody as on technical accuracy. From that standpoint, the task of the person preparing the report is to set out a complex technical reality, without hiding its uncertainties, with a clarity the lawyer and the judge can understand. When that balance is struck, the immutable memory of the open ledger becomes one of the most reliable witnesses of justice.
References Chainalysis. (2026). The 2026 crypto crime report. Chainalysis Inc. https://www.chainalysis.com/ Elliptic. (2025). Typologies report: Crypto-asset laundering and cross-chain crime. Elliptic Ltd.
European Union. (2023). Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA). Official Journal of the European Union.
Federal Bureau of Investigation. (2025, February 26). Public service announcement: North Korea responsible for the Bybit hack. FBI.
Financial Action Task Force. (2021). Updated guidance for a risk-based approach to virtual assets and virtual asset service providers. FATF.
Meiklejohn, S., Pomarole, M., Jordan, G., Levchenko, K., McCoy, D., Voelker, G. M., & Savage, S. (2013). A fistful of Bitcoins: Characterizing payments among men with no names. Proceedings of the 2013 Internet Measurement Conference, 127–140. https://doi.org/10.1145/2504730.2504747 Möser, M., Böhme, R., & Breuker, D. (2013). An inquiry into money laundering tools in the Bitcoin ecosystem. 2013 APWG eCrime Researchers Summit, 1–14. https://doi.org/10.1109/eCRS.2013.6805780 Nakamoto, S. (2008). Bitcoin: A peer-to-peer electronic cash system. https://bitcoin.org/bitcoin.pdf TRM Labs. (2025). The Bybit hack: Following North Korea's largest exploit. TRM Labs Inc. https://www.trmlabs.com/ Law No. 7518 Amending the Capital Markets Law. (2024, 2 July). Resmî Gazete (No. 32590).
Turkish Penal Code No. 5237. (2004). Resmî Gazete (No. 25611). (Art. 282, laundering assets derived from crime).
Code of Criminal Procedure No. 5271. (2004). Resmî Gazete (No. 25673). (Art. 134, search, copying and seizure in computers).
Financial Crimes Investigation Board (MASAK). (2025). Guide to obligations for crypto-asset service providers. Ministry of Treasury and Finance.
Capital Markets Board (SPK). (2025). Secondary regulations concerning crypto-asset service providers. SPK.
U.S. Department of the Treasury, Office of Foreign Assets Control. (2022). Sanctions designation of Tornado Cash. OFAC.
Europol. (2024). Cryptocurrencies: Tracing the evolution of criminal finances (IOCTA spotlight report). European Union Agency for Law Enforcement Cooperation. Androulaki, E., Karame, G. O., Roeschlin, M., Scherer, T., & Capkun, S. (2013). Evaluating user privacy in Bitcoin. Financial Cryptography and Data Security, 34–51. https://doi.org/10.1007/978-3-642-39884-1_4 Chainalysis. (2025). The landscape of seizable crypto assets in 2025. Chainalysis Inc. Wilson Center. (2025). The Bybit heist: What happened and what now?. Woodrow Wilson International Center for Scholars.
Capital Markets Law No. 6362. (2012). Resmî Gazete (No. 28513).
