Crypto forensics for institutions: tracing digital-asset activity to a defensible standard

Digital-asset investigations attract two opposite misconceptions. The first is that public ledgers are anonymous and therefore untraceable. The second, more common among people who have seen one good visualisation, is that tracing is a solved problem and the graph tells you who did it. Both are wrong in ways that cost institutions money.

What is true is narrower and more useful. On a public ledger, the movement of value is recorded permanently and can be reconstructed with certainty years later. Who controlled the endpoints is not recorded at all. Investigation is the work of establishing the second thing to a standard that will survive challenge, using the first thing plus evidence that does not live on the chain.

When an institution needs this

• Internal fraud or misappropriation where funds left the organisation through a digital-asset route.
• A counterparty dispute where the settlement path is contested.
• Sanctions or financial crime exposure discovered in a customer or supplier relationship.
• Pre-transaction diligence on a business that holds or moves digital assets.
• A regulatory request that requires the institution to demonstrate it understands its own exposure.
• Insolvency and recovery work where assets must be located before they can be claimed.

In each of these, the deliverable is not a diagram. It is a written conclusion that a decision-maker can act on and that will be tested by somebody with an interest in defeating it.

Tracing: the reconstructable half

Reconstructing flow across a public ledger is deterministic. Given a starting point, the path of value forward and backward is a matter of reading records that cannot be altered. Complexity arrives through volume, through automated splitting designed to exhaust an analyst, and through movement between chains.

Techniques designed to break the trail change the cost and the confidence rather than the possibility. Mixing services, chain-hopping through bridges and privacy-preserving protocols all introduce genuine uncertainty, and honest reporting distinguishes a traced path from an inferred one. What frequently rescues a matter is that funds eventually need to become spendable money, and that conversion happens inside a regulated institution.

Attribution: the contestable half

Attribution is the claim that a particular person or entity controlled a particular address at a particular time. It is built from several independent classes of evidence, and its strength depends on how many of them agree.

1. 01

   Behavioural clustering

   Spending patterns that imply common control of multiple addresses. Strong when consistent over time, and the basis of most commercial attribution data.

2. 02

   Service fingerprints

   Transaction structures characteristic of a specific platform. Useful for identifying which service is involved, rarely sufficient to name an individual.

3. 03

   Records from regulated entities

   Account holder identity obtained through lawful process. The strongest single class, and the reason the perimeter matters so much.

4. 04

   Off-chain artefacts

   Devices, correspondence, invoices, screenshots and interviews. Frequently what converts a plausible cluster into an established fact.

5. 05

   A signed message

   A demonstration of control over the private key. The highest standard available, and where cooperation exists it should always be requested.

Commercial attribution datasets are valuable and should be used. They should not be treated as ground truth. Labels are produced by heuristics that change between versions, and a conclusion that rests entirely on a third-party label is a conclusion whose basis your institution cannot explain. Record which version produced a label and when.

Evidence discipline from the first query

The most common cause of a weakened matter is not analytical error. It is that the first two weeks of work were done informally, and by the time the matter became serious the early steps could not be reproduced. Assume from the outset that every query may need to be explained.

1. Record the tool and version, the data snapshot date and the exact query parameters for every step.
2. Preserve raw exports unmodified alongside working copies, with hashes.
3. Keep a contemporaneous log of decisions and reasoning, including the lines of enquiry abandoned.
4. Maintain chain of custody for anything obtained from a third party.
5. Separate observation from inference in the written record, so a reader can see which is which.
6. Note the date any attribution dataset was consulted, because labels change.

This is also the argument for running investigations inside your own environment. When an investigation depends on a hosted platform whose data and versions change outside your control, reproducibility becomes a commercial negotiation. Where the matter is likely to be contested, deploy the capability where the matter lives.

Reporting that holds up

A defensible report separates what is recorded on the ledger, what is inferred from behaviour, and what was established from evidence outside the chain. It states the confidence attached to each attribution and what would change it. It explains what was not established as clearly as what was.

That last point is counterintuitive under pressure, because an institution wants a conclusion. But a report that quietly overstates attribution is worse than one that documents a gap, because the overstatement will be found by the party with the most incentive to look, and its discovery discredits the parts that were sound.

The regulatory context, briefly

For South African institutions, two regimes usually apply at once and are often confused. Crypto assets are a financial product under the FAIS Act, so providers offering advice or intermediary services require FSCA licensing. Separately, crypto asset service providers are accountable institutions under the Financial Intelligence Centre Act, carrying customer due diligence, record-keeping and reporting duties to the FIC. FATF standards on virtual assets, including the requirement to transmit originator and beneficiary information, shape what is expected operationally.

For an institution that is not itself a service provider, the practical consequence is that your counterparties are supervised. That is useful in an investigation: a supervised counterparty has records, an obligation to keep them, and a regulator that can be engaged where cooperation is not forthcoming.