Blockchains are pseudonymous, not anonymous — every transaction is public and permanent. Here's how forensics firms actually turn that transparency into traced, and often frozen, stolen funds.
Selin AydinSecurity Editor · Crypto security, custody, exploits and smart-contract risk
Blockchains are pseudonymous rather than anonymous: addresses are not names, but every transaction is public and permanent. Investigators cluster addresses using common-input ownership, change detection and exchange deposit sweeps, then combine that with off-chain records. Mixers and cross-chain hops degrade confidence but rarely end the trail, which usually stops at a regulated exchange where identity records exist.
On-chain forensics is the discipline of following stolen or illicit funds across a public ledger from the moment they leave a victim's wallet to the point they either get frozen, cashed out, or vanish into a dead end — and it has become a genuine speciality with dedicated firms, court-admissible methodology, and a real track record, not the guesswork it's sometimes dismissed as. Every Bitcoin and Ethereum transaction is permanently recorded and publicly visible; the anonymity attackers rely on comes entirely from the difficulty of linking wallet addresses to real-world identities, and that's precisely the link forensics investigators spend their time trying to establish.
The foundational technique is address clustering, built on a simple observation known as the common-input-ownership heuristic: when a Bitcoin transaction spends from multiple input addresses simultaneously, those addresses almost certainly belong to the same wallet, because a transaction can only be constructed by whoever holds the private keys for every input it spends from. Chain a large enough number of these observations together and thousands of individually pseudonymous addresses collapse into a much smaller number of real-world entities — a specific exchange's hot wallet, a specific mixing service, a specific attacker's wallet cluster. Change-address detection sharpens this further: most transactions send leftover value back to a fresh address controlled by the sender, and heuristics based on address reuse patterns, output structure, and timing let investigators identify which output in a transaction is the genuine payment and which is just change returning to the sender, further tightening the cluster.
Once stolen funds hit a mixing service, the trail gets genuinely harder, not impossible. Tornado Cash, before US sanctions effectively shut down its front end in 2022, worked by pooling deposits of fixed denominations from many users and letting any depositor withdraw an equivalent amount to a fresh address, breaking the direct on-chain link between deposit and withdrawal. Investigators counter this primarily through timing and amount correlation — a deposit of exactly 100 ETH followed by a series of withdrawals summing to close to 100 ETH within a tight time window is a probabilistic link, not a certainty, and this is genuinely where forensics shifts from deterministic tracing to statistical inference. Coinjoin-based Bitcoin mixing works on a similar batching principle and is subject to the same class of counter-analysis, plus a further wrinkle: poorly implemented coinjoins with inconsistent output amounts or timing can sometimes be partially unwound by an attentive analyst, which is why serious money-laundering operations invest in mixers with careful, uniform output construction specifically to defeat this kind of analysis.
A classic laundering pattern investigators watch for is the peel chain: an attacker moves the full stolen balance through a long sequence of addresses, peeling off a small amount at each hop to cash out while the bulk keeps moving, making the trail look like ordinary transactional noise rather than one entity methodically laundering funds. Tools like Chainalysis Reactor and TRM Labs' forensics suite are built to visualise exactly this kind of chain automatically, flagging clusters, mixer interactions, and known illicit addresses across the entire transaction graph rather than requiring an analyst to trace hop by hop manually — a database of previously identified addresses, tagged from past investigations, sanctions lists, and known exchange deposit addresses, is what actually makes automated tracing at scale possible.
The point where pseudonymity most reliably fails is the off-ramp. Centralised exchanges with functioning KYC requirements know exactly who controls the account depositing funds, and when a forensics firm or law enforcement identifies stolen funds flowing into a known exchange deposit address, a subpoena or a direct request to the exchange's compliance team can unmask the identity behind the wallet entirely. This is precisely why sophisticated attackers avoid regulated exchanges for cash-out and instead favour peer-to-peer over-the-counter desks, non-KYC exchanges operating in permissive jurisdictions, or increasingly, DeFi-native laundering routes that never touch a centralised custodian at all — the North Korean Lazarus Group's handling of Ronin Bridge and other stolen funds has shown a marked shift over recent years towards exactly these harder-to-subpoena venues as exchange compliance has tightened.
Modern laundering rarely stays on one chain. Funds stolen on Ethereum routinely get bridged to Bitcoin, or swapped through cross-chain DEX aggregators, specifically because each hop across a bridge forces investigators to re-establish the link from scratch on a different ledger with a different address format and a different set of forensics tooling maturity. Bridges that rely on wrapped assets and liquidity pools rather than a simple locked-and-minted 1:1 relationship make this worse, because funds can genuinely commingle with legitimate liquidity in a pool before being withdrawn elsewhere, breaking the clean one-to-one input-output link that clustering heuristics depend on. Investigators increasingly need to be fluent across multiple chains' forensics tooling simultaneously rather than specialising in just Bitcoin or just Ethereum, which has raised the skill bar for the field considerably over the past few years.
One development that has changed the calculus for attackers is the growing ability to freeze stolen assets before they're ever cashed out, without needing an identity or an arrest first. Centralised stablecoin issuers like Circle and Tether hold the technical ability to blacklist specific addresses at the smart-contract level, freezing USDC or USDT held there regardless of who controls the private key, and forensics firms now routinely feed real-time tracing directly into these freeze requests — the 2022 recovery of a large portion of the Ronin Bridge exploit proceeds relied partly on exactly this, with exchanges and issuers freezing tagged funds the moment they were flagged in transit, before the attacker could complete a cash-out. This turns forensics from a purely investigative, after-the-fact discipline into something closer to real-time interdiction, provided the stolen asset passes through a chokepoint an issuer or exchange actually controls.
The 2016 Bitfinex hack, in which roughly 120,000 BTC was stolen, sat largely dormant for over five years before US authorities recovered a substantial portion of it in 2022 — not primarily through breaking any cryptographic scheme, but through years of patient clustering, monitoring for movement, and eventually identifying the individuals who controlled the wallets once they began attempting to launder portions of the funds through exchange accounts tied to real identities. It's a genuinely instructive case precisely because the funds sat untouched for so long: on-chain forensics doesn't require an attacker to make an immediate mistake, it just requires that they eventually try to spend or cash out, at which point years-old clustering work becomes immediately actionable.
None of this is infallible, and it's worth being honest about the limits. Genuinely privacy-preserving assets like Monero, which obscures sender, receiver, and amount by default using ring signatures and stealth addresses, remain largely resistant to the clustering and timing techniques that work on transparent chains like Bitcoin and Ethereum — which is precisely why funds from several major exchange hacks have been observed being swapped into Monero specifically as a laundering step, even at a poor exchange rate, because the loss on the swap is cheaper than the risk of getting traced. Well-run, high-volume mixers with careful output uniformity, cross-chain hops through venues with weak forensics tooling, and simple patience — letting funds sit dormant for years before moving — remain genuinely effective countermeasures. Forensics has gotten dramatically better since Bitcoin's early days, but it is a probabilistic discipline working against increasingly sophisticated adversaries, not a magic decoder ring that guarantees every theft gets solved.
Every crypto trade happens through one of two fundamentally different plumbing systems. Understanding the DEX vs. CEX trade-offs — custody, liquidity, execution, cost — matters more than picking a side.
Price tells you what the market thinks. On-chain metrics tell you what's actually happening underneath it. Here's a starter toolkit for reading network health directly from the ledger.
Cross-chain bridges move billions between blockchains every week — and have lost billions more to exploits. Here's how the plumbing actually works and how to size up the risk before you use one.