Special Declaration: This article is an original work by Attorney Shao Shiwei. It represents only the personal views of the author and does not constitute legal consultation or legal advice on specific matters. For article reprints, legal consultations, or professional exchanges, please add: sswls66.
““I indeed organized and planned this project. I want to know how you found the mastermind behind it. Based on my understanding, it should be impossible for you to find me. What did you rely on?”？”
The above details were disclosed by the Xin County Public Security Bureau in handling the “12.04” virtual currency pyramid scheme case. During interrogation, Zhang, the suspect and ringleader of the pyramid scheme, asked the investigating officers this question with great confusion.
In his daily practice of handling criminal cases involving black and gray market industries and virtual currencies, Attorney Shao often encounters clients with similar questions. For instance, they may ask: “Attorney Shao, I was abroad when I engaged in these activities, and my upstream contacts were also abroad. We usually communicated via Telegram (TG), using self-destructing messages.Isn’t virtual currency trading anonymous? How could the public security organs arrest me?”？”
Therefore, today we will discuss,how public security organs trace virtual currency transactions and identify suspects in criminal cases involving virtual currencies.？
1
Virtual Currency Trading
Is It Truly Anonymous?
As one of the applications of blockchain technology, virtual currencies offer advantages such as decentralization, privacy protection, reduced transaction costs, and high returns. However, due to their degree of anonymity, they are often exploited by criminals as tools for money laundering and transactions related to black and gray market industries.
However, virtual currencies are not completely anonymous. While transaction processes are public on the chain, addresses are not directly linked to identities. Furthermore, because virtual currency exchanges must comply with Know Your Customer (KYC) and Anti-Money Laundering (AML) rules, it becomes easier for law enforcement agencies to trace transactions on the blockchain.
This is because there is a public, immutable ledger behind virtual currencies.Therefore, obtaining evidence of virtual currency transactions is actually quite favorable for public security organs.
2
How Do Public Security Organs Trace Crypto Flows
and Identify Suspects?
In earlier years, public security organs across various regions lacked understanding of cases involving cryptocurrencies, resulting in few cases being filed for investigation, leaving many victims without recourse.
However, as investigative units have deepened their understanding of virtual currencies, their capabilities in conducting on-chain data tracking and data analysis of virtual currency flows have continuously strengthened.Here is a brief introduction to several common methods:
1. On-Chain Address Association Analysis
By analyzing transaction graphs through blockchain explorers (such as Tronscan and OKLink), it is possible to identify Common Inputs and fund consolidation patterns between addresses. For example, if multiple addresses frequently transfer funds to the same target address, it can be inferred that they are controlled by the same entity.
Based on Attorney Shao’s experience in representing cases involving cryptocurrencies, virtual currencypyramid scheme crimes and cases of operating casinosoften utilize this analytical method.
In the aforementioned Liaocheng “12.04” virtual currency pyramid scheme case, the police discovered that the pyramid scheme platform generated multiple addresses via the TokenPocket wallet to consolidate funds, which ultimately flowed to a main address and were withdrawn through an exchange. By analyzing the transaction frequency and fund scale of these addresses, the masterminds were identified.
In several casino operation cases represented by Attorney Shao, the settlement process of profits between the casino and payment settlement personnel also used consolidated addresses as a breakthrough point to identify the individuals involved.
2. Obtaining Evidence of Exchange KYC Data
Currently, most mainstream virtual currency exchanges (such as Binance, OKX, and HTX) and digital wallet platforms (such as ImToken) publicly disclose their policies for cooperating with law enforcement on their official websites, including dedicated channels for cooperating with mainland China public security organs.
Law enforcement officers can send investigation request letters to exchanges via email, requesting the retrieval of suspects’ registration information, facial recognition photos, wealth management information, deposit and withdrawal transactions, wallet addresses for various currencies, fiat currency transactions, crypto-to-crypto transactions, contract trading records, login IPs, MAC addresses, and other device information.
Additionally, exchanges will freeze the virtual currencies in suspects’ accounts upon request from law enforcement agencies. The freezing period is one year, but law enforcement agencies may apply for an extension before expiration.
3. Tracking Transaction Fees (Gas Fees) and Transaction Hashes
Every successful virtual currency transaction requires the payment of Gas fees (such as TRX or ETH). Therefore, when tracing the wallet addresses where suspects received illicit funds, investigators can trace the records of suspects purchasing Gas fees from exchanges. For example, police analyzed the source of Gas fees for addresses involved in a case and discovered that TRX was purchased through a Binance account to pay the fees, thereby identifying the exchange account.
In virtual currency transactions, transaction hashes ensure the uniqueness and immutability of each transaction. The hash value generated for each transaction is unique. Transaction hashes reveal transaction details, such as the sender’s address, receiver’s address, transaction amount, and transaction fees.
Investigative personnel provide Gas fee transaction records and transaction hashes to virtual currency exchanges to obtain the suspects’ KYC information (such as passports, ID cards, email addresses, phone numbers, etc.).
4. Device Fingerprinting and IP Association
Investigative personnel associate the operational behaviors of multiple addresses through login IPs and device IDs (such as mobile IMEI and MAC addresses) from exchanges or wallets, thereby identifying targets.
For instance, in the MIT Hacker Brothers case, the FBI analyzed the VPN logs and device fingerprints used by the suspects, discovering that they logged into the same exchange account multiple times, which ultimately led to the identification of their physical location[i].
5. Cross-Chain Swaps and Mixer De-anonymization
Many suspects believe that conducting cross-chain transactions or using mixers allows them to better conceal their identities, but this is not the case.
Cross-Chain Tracking: Tracing fund transfer paths through transaction hashes of cross-chain bridges (e.g., Bitcoin to Ethereum).
Mixer Analysis: Using on-chain fingerprinting techniques (such as transaction timing and amount patterns) to identify input and output addresses of mixers (such as Tornado Cash).
For example, when the U.S. Department of Justice recovered the Colonial Pipeline ransom, it analyzed the hacker’s “chain-based money laundering” path and ultimately seized the private key of a critical address ending with the characters “dh77gls”[ii].
6. International Cooperation and Stablecoin Freezing
For stablecoins such as USDT, public security organs can request the issuer (such as Tether Limited) to freeze funds in addresses involved in cases. International cooperation can also be pursued.
For example, in a cross-border online gambling case solved by the Jingmen Police in Hubei Province, with involved transaction flows reaching 400 billion RMB (reported as the “First Virtual Currency Case in China”), it was reported that “since the platform settled all transactions using virtual currencies, the public security organs coordinated with the virtual currency issuing institution to freeze the relevant virtual currency accounts involved in the case.”
Another example is the theft case involving 55 million worth of Ethereum in Neijiang, Sichuan. It was reported that “to solve this case, the Sichuan police conducted 14 international cooperations with Singapore, the United States, and the Netherlands, developed a set of tactical methods for analyzing blockchain addresses in practice, retrieved data from overseas virtual currency exchanges more than 70 times, and traced over 20,000 blockchain addresses”[iii].
7. Reverse Tracing from Final Fiat Off-Ramping Flows
In most countries, virtual currencies held by suspects cannot be directly used for daily consumption. Therefore, black and gray market transactions always have an exit point, which is converting virtual currencies into fiat currency. Those who assist in converting to fiat currency become the breakthrough point for tracing the identities of upstream criminals.
8. Abnormal Transactions Triggering Risk Control
The reason many people’s bank cards are frozen is that frequent rapid inflow and outflow transactions trigger the bank’s risk control systems. The same principle applies in the world of Web3.
Generally, ordinary cryptocurrency traders keep funds on platforms for trading rather than frequently engaging in high-frequency, large-volume rapid inflows and outflows. Therefore, in the fact-finding process of crypto flow tracking, if an address exhibits rapid inflows and outflows of funds, it will be regarded as a suspicious address.
3
Conclusion
Criminals mistakenly believe that: virtual currency transactions are anonymous, so investigators cannot identify their true identities; virtual currency exchanges are all located abroad, making it difficult for domestic public security organs to investigate and collect evidence; and that cross-chain transactions and mixers make tracking impossible. Consequently, they engage in black and gray market transactions without restraint. However,thiswishful thinking will ultimately lead them into deeper predicaments.
Some clients, after being arrested, discuss with me how much they regret their actions. However, their regret is not for violating the law, but ratherfor not designing the transaction chain to be more obscure in the first place.
Facing such clients, sometimes I do not know what to say and can only respond with a sigh.
[i] Two MIT Graduate Hacker Brothers Arrested for Stealing $25 Million in Cryptocurrency in 12 Seconds http://note.f5.pm/go-240378.html
[ii] U.S. Department of Justice Seizes 63.7 Bitcoins Extorted by Hackers; Bitcoin Drops More Than 10% in a Single Day | Jiemian News https://m.jiemian.com/article/6209923.html
[iii] Breakthrough in the 55 Million Blockchain Asset Theft Case in Neijiang, Sichuan! https://xinjiapo.news/news/215601/
In-depth Investigation Leads Xin County Public Security Bureau to Successfully Solve the City’s First Major Virtual Currency Pyramid Scheme Case https://mp.weixin.qq.com/s/KduRfmY5hk8r6xLO5t_epQ
Recommended Reading
Can Judicially Frozen Virtual Currencies Be Enforced if the Party Refuses to Cooperate?
