Cryptocurrency Intelligence (CRYPTINT): Intelligence Discipline Guide

Public blockchains keep a permanent, complete record of every transfer. The hard part was never the data. It is knowing which addresses belong together, and who touches fiat.

What Cryptocurrency Intelligence is as a discipline

Cryptocurrency intelligence is the analysis of transactions on public distributed ledgers to trace value, attribute addresses and understand illicit flows. It works directly from chain data such as transactions, inputs and outputs, balances, token transfers and smart contract calls, enriched with clustering heuristics, service attribution and off-chain evidence including extortion notes, marketplace postings, court filings and exchange disclosures. Analysts follow value from a known starting point, identify intermediating services, and establish where funds enter or leave the regulated financial system.

Sub-methods differ by ledger model. Unspent-output chains support co-spend clustering and change-output identification, while account-based chains require contract-aware tracing through tokens, bridges and decentralised exchanges. Further methods cover mixer and privacy-tool analysis, cross-chain bridge tracing, and temporal and value-pattern correlation. Maturity moves from single-address lookup, through maintained attribution sets and reproducible clustering, to monitored watchlists that alert whenever tracked funds move.

Why it matters

This discipline answers where the money went and who can be lawfully compelled to say who owns it. Blockchain data is complete and immutable, so unlike conventional payment records it cannot be selectively disclosed or destroyed. Tracing establishes the cash-out point, meaning the exchange, processor or over-the-counter desk, which is the actionable node where legal process applies. It quantifies ransomware and fraud proceeds, links apparently separate incidents through shared wallets, and underpins asset recovery.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Transaction graphs from a seed address showing hop sequence, amounts, timing and consolidation or fan-out patterns
• Address clusters derived from common-input-ownership and change heuristics, grouping addresses under a single controlling entity
• Service attribution identifying deposit addresses at exchanges, payment processors, gambling platforms and mixing services
• Peel chains and structured transfers designed to fragment value below monitoring thresholds while preserving most of it
• Mixer, coinjoin and privacy-protocol usage, including deposit and withdrawal timing correlation around the service window
• Cross-chain bridge and swap activity moving value between ledgers, with matched amounts and timestamps on either side
• Smart contract interactions revealing token approvals, drainer contracts, lending positions and decentralised exchange routing
• Reused addresses published in extortion notes, scam sites, forum profiles or donation appeals, linking wallets to personas

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• Blockchain explorers — Blockchair, Etherscan and mempool.space give full transaction, address and contract history without a licence
• Blockscout — Open-source multi-chain explorer with contract decoding, token transfer detail and API access
• OFAC SDN list — Designated cryptocurrency addresses, the authoritative sanctions reference for wallet screening obligations
• Chainabuse — Crowd-reported addresses linked to scams, extortion and fraud, useful as a corroborating starting point
• GraphSense — Open-source clustering and tracing toolkit giving reproducible analysis without commercial dependency
• Ransomware payment trackers — Ransomwhere and similar projects curate extortion payment addresses with incident attribution
• DOJ forfeiture complaints — Court filings that publish evidenced address attributions and disclose the tracing methodology used
• Commercial tracing platforms — Chainalysis, TRM and Elliptic license large attribution sets covering exchange deposit addresses at scale

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Establish the seed — Record where the address came from, whether ransom note, victim payment or exchange record. Provenance governs everything downstream.
2. Characterise the address — Determine chain, address type, first and last activity, balance history, and whether it belongs to a service or an individual.
3. Cluster carefully — Apply co-spend and change heuristics, labelling each as heuristic rather than fact and noting the ledger model limits explicitly.
4. Trace in both directions — Follow funds forward toward cash-out and backward toward source, recording every hop with transaction hash, amount and timestamp.
5. Find regulated touchpoints — Flag deposits at exchanges and processors subject to customer identification duties, since those are where legal process can act.
6. Corroborate off chain — Tie addresses to personas, incidents and entities using published notes, forum posts, filings, victim reports and court records.
7. Preserve and monitor — Hash and archive the evidence chain, then set alerts on tracked addresses so dormant funds trigger notification the moment they move.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

• Cyber Crime
• Ransomware
• Dark Web Intel
• Kidnap, Hostage & Extortion
• Financial Crime
• Anti-Money Laundering

Operates on these data points

• Cryptocurrency Address — Blockchain wallet address for receiving or sending crypto assets.
• Onion / Hidden Service — A Tor hidden service address on the dark web.
• Person / Name — A named individual — the subject of identity resolution and profiling.
• IP Address — Internet Protocol address identifying a device or server on a network.
• Domain Name — Human-readable address that maps to IP infrastructure via DNS.
• Password / Credential — An exposed password or credential pair from leaks or dumps.
• Data Breach — A known data breach or leak incident with exposed records.
• Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
• Messaging Handle — An identity on a messaging platform (Telegram, Signal, Discord) used for coordination and sales.
• Bank Account / IBAN — A bank account identifier (IBAN, SWIFT/BIC, routing + account) central to financial tracing.

Related disciplines

• Accounting Intelligence — Financial Statements and Accounting Analysis
• Corporate Intelligence — Understanding Companies, Structure, and Control
• Economic Intelligence — Economic Conditions, Trade, and Market Signals
• Financial Intelligence — Following Value Through the Financial System
• Sanctions Intelligence — Screening, Designations, and Evasion Detection

Inside the platform: where Cryptocurrency Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• discipline.php?d=CRYPTINT — Discipline hub
• source-catalog.php?disc=CRYPTINT — Source catalogue filtered to this discipline
• blockchain.php — Cryptocurrency Address profile
• ioc-type.php?t=onion — Onion / Hidden Service profile
• search.php — Person / Name profile
• ip-profile.php — IP Address profile
• url-profile.php — Domain Name profile
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Export STIX/MISP
• Correlate Infrastructure
• Run Alert Rules
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Establish the seed is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Cluster carefully turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Preserve and monitor feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Cryptocurrency Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence practitioners use blockchain analysis mainly in counter-threat finance and force protection contexts: tracing ransom payments made by or against supported networks, following procurement of dual-use goods paid in cryptocurrency, and understanding how proscribed groups in an operating area move value. The authority is limited and the product is analytic, since seizure and account action are law enforcement and Treasury functions. Output feeds threat finance assessments, targeting nominations through the proper legal chain, and advice to commanders on contractor payment risk. Constraint: de-anonymisation of an address to a named person runs through legal process against a regulated exchange, not through a defence analyst assertion, and unattributed clusters must be reported as clusters.

🕵 National intelligence

National services treat public ledgers as an unusual open source: complete, permanent and machine readable, but pseudonymous. Requirements typically concern sanctions evasion, proliferation financing, state-sponsored theft and ransom flows. The analytic method is clustering and service attribution against chain data, fused with sensitive collection and with information obtained by partner agencies from regulated intermediaries. Because the chain layer is unclassified and the attribution layer often is not, products are written so the address-level findings can be released to industry and partners while the identity resolution stays protected. Handling also reflects that publishing a cluster teaches the adversary which heuristics work, which is a real collection cost.

👮 Law enforcement

Investigators use blockchain analysis to trace proceeds, identify off-ramps and support restraint and forfeiture. Chain evidence is unusually strong because it is publicly verifiable and immutable, but it is pseudonymous, so the case turns on attribution. That runs through legal process: production orders and mutual legal assistance requests to exchanges, custodians and payment processors for know your customer records, and warrants for devices holding wallets or seed phrases. Clustering heuristics must be explained and defended in court, so record the tool, its version, the heuristic applied and the confidence, and be prepared to demonstrate the transaction path independently from a public explorer.

🔍 Private investigation and corporate security

Corporate practitioners use blockchain analysis for ransomware incident support, exchange counterparty risk, fraud recovery and sanctions compliance on digital asset exposure. The lawful method is analysis of public chain data plus licensed commercial attribution. A private actor cannot compel an exchange to disclose an account holder, cannot seize funds, and must not attempt to interfere with wallets or infrastructure. Where a payment to a sanctioned entity is in prospect, the matter is a legal and regulatory decision requiring licence consideration, not an analyst call. Findings are typically used to support a law enforcement referral, an insurance claim or a civil recovery action with a specialist firm.

📰 Journalism and OSINT media

Journalists use chain analysis to evidence stories about ransom payments, sanctions evasion, fraud schemes and illicit markets, with the advantage that readers can independently verify transactions on a public explorer. The verification standard is to publish the transaction identifiers and let the reader check, while being explicit that address clustering is an inference with a stated confidence, not a fact. Do not name an individual as the controller of an address without evidence independent of the clustering, since heuristic errors are common. Protect sources who supplied off-chain identity information, apply a public interest test to naming, and give right of reply.

🌍 NGO, humanitarian and human rights

Accountability and humanitarian organisations use chain analysis to document financing of armed groups, sanctions circumvention and fraud against aid programmes, and defensively to check that donations and payments do not touch designated addresses. Victim-centred practice applies in extortion and scam cases, where the people who lost funds are often approached again by recovery frauds, so publication of victim addresses can cause direct harm. Documentation is built for onward use by regulators and courts. Duty of care matters because tracing funds of armed or state-linked actors attracts attention, and analysts working on such cases should not be publicly identified.

🎓 University and research

Researchers treat public ledgers as a complete transaction dataset for studying clustering heuristic accuracy, market structure, mixer effectiveness, illicit flow estimation and the economics of ransomware. Reproducibility is achievable to an unusual degree because the underlying data is public and permanent, so publish the block range, the parsing code and the attribution set used. Ethics review applies because addresses can be linked to identifiable people, and research should not attempt de-anonymisation of individuals outside an approved protocol. Be explicit about heuristic error rates rather than presenting clusters as ground truth, and prefer open tooling so that others can reproduce the attribution rather than trusting a vendor label.

Playbook: working Cryptocurrency Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Establish the seed and the question

Start from a verified seed: a ransom address from an extortion note, a scam address reported by a victim, a designated address published by a sanctions authority, or an address recovered from a seized device. Record how the seed was obtained, because a mistyped or misattributed seed invalidates everything downstream. Define what the trace must establish, typically the destination of funds, the off-ramp used, or the linkage between two actors. A good output is a seed record with provenance and a written objective. Stop when the seed is verified against at least one independent source and the objective is specific.

Phase 2 — Identify the chain and the asset

Determine exactly which ledger, which asset and which address format you are working with, since the same string can be valid on multiple chains and token transfers behave differently from native transfers. Understand the transaction model, because unspent output chains and account-based chains require entirely different tracing logic. Note whether privacy features, layer two systems or bridges are involved. A good output is a technical scoping note naming the chain, asset, address format and any protocol features that will constrain the trace. Stop when the analyst can explain how value moves on this chain without reference to a tool abstraction.

Phase 3 — Retrieve and verify raw transaction data

Pull the transaction history from a public explorer or a node you control, and verify a sample independently against a second explorer, because vendor views can lag or mislabel. Record block heights and timestamps rather than only wall-clock dates. Preserve the raw data with retrieval times, since blocks are immutable but interfaces and labels are not. A good output is a preserved transaction set that a reviewer can reproduce from public data alone. Stop when the transaction history around the seed is complete and independently confirmed.

Phase 4 — Cluster addresses with stated heuristics

Group addresses likely under common control using explicitly named heuristics: common input ownership on unspent output chains, change address identification, deposit address reuse patterns, and behavioural or timing signatures. Record which heuristic produced each grouping and what its known failure modes are, because coinjoin and shared custodial wallets break common input ownership. Never present a cluster as a fact. A good output is a cluster with per-heuristic provenance and a confidence rating. Stop when additional heuristics no longer add members that survive review, or the cluster reaches a service boundary.

Phase 5 — Attribute services, not people

Determine which clusters belong to services rather than individuals: exchanges, custodial wallets, mixers, gambling sites, payment processors and bridges. Service attribution comes from published deposit addresses, documented behavioural patterns, sanctions notices and open research. This is the layer where chain analysis is most reliable and most useful, because knowing that funds reached a regulated exchange tells you where legal process should be directed. A good output is a path annotated with service identifications and their evidence. Stop when every significant hop is either identified as a service, identified as a personal cluster, or explicitly unknown.

Phase 6 — Trace flows and quantify

Follow value forward to off-ramps and backward to sources, applying a consistent tracing convention such as first in first out or proportional attribution, and stating which you used because different conventions give different answers. Quantify amounts in native units and in fiat at the transaction time, using a documented price source. Track where flows split, merge, pass through mixers or cross bridges, and record the loss of confidence at each such point. A good output is a quantified flow diagram with a convention statement. Stop when funds reach a service, a designated address, or a point where confidence has degraded below usefulness.

Phase 7 — Handle obfuscation honestly

When flows enter a mixer, a privacy protocol, a chain hop or a high-volume exchange, state plainly what can and cannot be said afterwards. Some obfuscation is defeatable through timing and amount correlation with stated confidence; some is not, and asserting continuity through it is how chain evidence gets destroyed under cross-examination. Document the point of entry, the observable exits, and the basis of any correlation claim. A good output is an explicit confidence break in the narrative. Stop the forward trace where the honest answer is that continuity cannot be established.

Phase 8 — Route identity through legal process

Where the trace reaches a regulated intermediary, identity attribution proceeds through formal legal process against that intermediary: a production order, a subpoena, or a mutual legal assistance request for know your customer records, deposit mappings and account activity. This is the only reliable route from address to person. Private parties refer to law enforcement rather than approaching the exchange themselves. A good output is a properly framed request naming the deposit addresses, the time window and the records sought. Stop when the request is served and tracked, or the referral has been made.

Phase 9 — Screen for sanctions and designation

Check every counterparty address and service against published designated addresses and sanctioned entities, since designations now list specific addresses as well as entities. A payment touching a designated address creates immediate legal consequences for anyone in the chain, including a victim organisation considering a ransom payment. Escalate any match to legal and compliance immediately rather than continuing the analysis. A good output is a screening record covering every address on the traced path with dispositions. Stop when the screening is complete and any match has been escalated with the supporting transaction detail.

Phase 10 — Preserve evidence for court

Build the evidence pack so an independent expert can reproduce it: transaction identifiers, block heights, the tool and version used, the heuristics applied and their configuration, the price source and the tracing convention. Include the raw data and a narrative that explains the inference chain in plain language. Anticipate challenge on clustering and be able to demonstrate the core path using a public explorer without proprietary tooling. A good output is a pack that survives an expert opposing report. Stop when every asserted step can be independently verified from public data plus the disclosed methodology.

Phase 11 — Support recovery and disruption

Convert findings into action through the right channel: notify exchanges holding identified deposits so they can freeze under their own compliance obligations where the law allows, support restraint and forfeiture applications, feed sanctions nominations to the designating authority, and provide victim notification. Track outcomes, because the measure of the capability is funds restrained or actors identified, not addresses labelled. A good output is a documented notification with a reference and a tracked result. Stop when the action route is exhausted or the recovery decision has been formally taken.

Phase 12 — Maintain the attribution base

Service attributions decay as exchanges change deposit schemes, mixers are seized and new bridges appear. Maintain the attribution set with dates, re-verify high-value attributions periodically, and record when a label was correct at the time but is no longer. Monitor designated addresses for new activity and monitor known clusters for movement, since dormant proceeds moving is often the trigger for an enforcement opportunity. A good output is a dated attribution set with a revision history. Stop maintaining a cluster only when the associated case is formally closed.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
Blockchair	Open	Multi-chain block explorer with transaction, address and block search across several major ledgers and export capability.	Independent verification of transaction paths retrieved from another explorer or a commercial tracing tool.
Etherscan	Registration	Explorer for account-based chain activity including token transfers, contract interactions, internal transactions and address labelling.	Traces token and contract flows where value moves through smart contracts rather than simple transfers.
mempool.space	Open	Explorer and mempool visualisation for unspent output chain activity including fee behaviour and transaction structure.	Examines transaction construction, fee patterns and change behaviour that inform clustering heuristics.
GraphSense	Open	Open source cryptoasset analytics platform providing address clustering, tagging and flow analysis over public ledger data.	Reproducible clustering and flow analysis whose heuristics can be inspected and defended, unlike proprietary tooling.
OFAC specially designated nationals list	Open	United States designation list which now includes specific digital currency addresses attributed to designated persons and services.	Screens every address on a traced path for designation, which changes the legal position immediately.
OpenSanctions	Open	Consolidated multi-source sanctions and enforcement data with entity resolution, including cryptocurrency address attributes where published.	Screens counterparties and services against designations from multiple authorities in one query.
FinCEN	Open	United States financial intelligence unit publishing advisories, alerts and guidance on virtual asset service providers and ransomware payments.	Establishes reporting obligations and typologies for ransomware and virtual asset laundering activity.
Financial Action Task Force	Open	Standard setter publishing recommendations and guidance on virtual assets, including the travel rule and service provider obligations.	Frames what records a regulated intermediary should hold, which shapes how legal process is drafted.
Chainalysis	Licensed	Commercial blockchain analytics platform with proprietary clustering, service attribution and investigative case tooling.	Large attribution set and investigative workflow, used with awareness that the heuristics are not open to inspection.
Elliptic	Licensed	Commercial analytics provider offering address screening, transaction risk scoring and entity attribution across multiple chains.	Sanctions and risk screening of counterparties in compliance workflows and incident response.
TRM Labs	Licensed	Commercial blockchain intelligence platform covering tracing, screening and cross-chain flow analysis with investigative tooling.	Cross-chain tracing where funds bridge between ledgers and single-chain explorers lose continuity.
abuse.ch	Open	Operator of open threat data projects covering malware families, command infrastructure and distribution, including ransomware families.	Links a ransom address to the malware family and campaign that generated it, supporting actor attribution.
Internet Crime Complaint Center	Open	United States reporting channel and public reporting on cyber-enabled fraud, ransomware and virtual currency investment fraud.	Reporting route for victims and a source of typology and loss context for extortion and scam tracing.
Europol	Open	European law enforcement agency publishing operational results including mixer and exchange seizures and darknet market takedowns.	Confirms which services have been seized or disrupted, which changes attribution and the value of a trace.
UK Financial Conduct Authority	Open	United Kingdom regulator publishing registration status of cryptoasset businesses and warnings about unregistered firms.	Establishes whether a service in the flow is a regulated intermediary subject to United Kingdom legal process.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Cryptocurrency Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• Public block explorers — Free, authoritative view of transactions verifiable by anyone including a court. Limitation: no clustering, so multi-address analysis is manual and slow.
• GraphSense — Open clustering and flow analysis whose heuristics can be inspected and reproduced. Limitation: attribution tag coverage is far smaller than commercial platforms.
• Commercial tracing platforms — Large attribution sets, cross-chain tracing and investigative case management. Limitation: proprietary heuristics cannot be independently validated and are attacked in court.
• Self-hosted full nodes — Independent, complete source of chain data with no third party dependency or query logging. Limitation: substantial storage and indexing effort for historical analysis.
• Address screening APIs — Automated checks of counterparties against designation and risk datasets at transaction time. Limitation: risk scores are vendor opinions, not legal determinations.
• Graph visualisation tooling — Renders flows and clusters for analysts and for court presentation. Limitation: visual density persuades regardless of evidential strength, encouraging overclaiming.
• Historical price data services — Convert native amounts to fiat at transaction time for quantification. Limitation: exchange rate source choice materially changes totals and must be disclosed.
• Case management with evidence hashing — Preserves raw transaction data, tool versions and analyst decisions for disclosure. Limitation: only defensible if methodology is recorded contemporaneously, not reconstructed.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Export STIX/MISP — Streams the selection in CTI standard formats for sharing with partners and ISACs.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Run Alert Rules — Evaluates saved rules against new data so a first sighting raises a notification rather than waiting for review.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Name the heuristic behind every cluster. Common input ownership fails on coinjoin and on shared custodial wallets, and a cluster presented without its heuristic and failure modes will not survive expert challenge in court.
• The reliable output of chain analysis is service identification, not personal identification. Knowing funds reached a specific regulated exchange is what makes legal process possible, and that is where the investigative value actually sits.
• State your tracing convention. First in first out, last in first out and proportional attribution give materially different answers on the same flow, and an undeclared convention is an undisclosed assumption in your quantification.
• Record a confidence break at every mixer, bridge and high-volume exchange. Asserting continuity through obfuscation is the single most common way chain evidence is destroyed, and an honest break strengthens the rest of the report.
• Verify the seed address independently before tracing. Extortion notes are transcribed by victims under stress, addresses are visually similar, and an entire investigation built on a mistyped seed produces confident nonsense.
• Publishing clusters teaches adversaries which heuristics work. Weigh the disruption value of publication against the collection cost, particularly where the technique depends on an operational habit that is cheap to change.
• Quantify in native units first and fiat second, with the price source and timestamp stated. Volatility means a single flow can be reported with a threefold difference in value depending on an undisclosed choice.
• Attribution labels have a shelf life. Exchange deposit schemes change, services are seized and rebranded, and a label that was correct two years ago can be actively misleading now unless it carries a date.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Cryptocurrency Intelligence is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of traced flows that reach an identified regulated service where legal process can be directed, rather than terminating in an unattributed cluster.
• Value of funds restrained, frozen or recovered as a result of notifications and referrals, rather than the value of funds merely traced.
• Median time from receipt of a verified seed address to a notification reaching the exchange or law enforcement body that can act.
• Share of clustering assertions in issued products that carry a named heuristic and a stated confidence rather than being presented as fact.
• Number of chain findings successfully challenged by an opposing expert, tracked with the reason for each.
• Percentage of traced paths fully screened against designation lists before the product is issued, which should be one hundred percent.
• Rate at which service attributions are found to be out of date on periodic re-verification, indicating attribution base health.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Presenting clustering heuristics as ownership facts, when co-spend and change heuristics fail against modern wallets and coinjoin
• Attributing an exchange hot wallet or shared deposit address to a counterparty, which misreads the direction of the entire flow
• Ignoring that value moves inside custodial services without any on-chain transaction, silently breaking the visible trail
• Assuming mixer or privacy-coin use ends the trace, when timing, amount and behavioural correlation often still narrows the field
• Confusing token transfer events with real value movement, especially with spam airdrops and address-poisoning transactions
• Publishing address attributions naming individuals without evidentiary support, which is defamatory and tips off the subject

Legal and ethical considerations

Reading public ledgers is lawful and unrestricted, but attribution touches personal data and financial privacy, so processing requires a lawful basis and disciplined minimisation. Sanctions screening against designated addresses is mandatory for regulated entities and carries strict liability. Interacting with traced funds, including dust and test transactions, may constitute facilitating money laundering and will alert the subject. Compelling the identity behind a deposit address requires legal process against the exchange rather than self-help. Preserve raw chain data and methodology for evidentiary challenge.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Cryptocurrency Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 data points, 6 mission domains, 5 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Can blockchain analysis identify a person?

Not on its own. Chain analysis establishes that value moved between addresses and, with clustering, that addresses are probably under common control. Linking a cluster to a named person requires off-chain evidence: know your customer records held by an exchange, a device seized under warrant containing the wallet or seed, a payment mapping from a merchant, or an admission. The correct route to that evidence is legal process against the regulated intermediary, which is why service attribution matters more than address labelling. Reports that name individuals from chain data alone are unsafe and have failed in court.

Are funds through a mixer permanently untraceable?

Not always, but continuity claims must be made carefully. Some mixing implementations leak through timing correlation, distinctive amounts, fee behaviour or user error such as reusing an address on both sides, and some mixers have been seized with their records recovered, which retrospectively resolves historical flows. What you cannot do is assert continuity by assumption. Document the entry, document the candidate exits, state the correlation basis and the confidence, and treat the mixer as a confidence break unless you have a specific evidenced link. Note also that using certain designated mixers is itself a sanctions issue.

Should a victim organisation pay a ransom?

That is a legal, regulatory and executive decision, not an analyst one, and it must include a sanctions check before anything else. If the receiving address or the associated actor is designated, payment may be unlawful regardless of circumstances and can expose the payer and any intermediary to enforcement. Several jurisdictions require reporting of ransomware payments. The analyst contribution is to screen the address, identify the associated actor and family, assess whether the actor has a history of honouring decryption, and preserve the payment path for later recovery efforts. Advise, screen and document; do not recommend.

How do I handle funds crossing to another chain?

Identify the bridge or the service used and treat the crossing as a discrete analytic step rather than a continuous flow. Some bridges emit paired events that allow a defensible link between the deposit on one chain and the withdrawal on the other; centralised exchange crossings usually do not, because the internal ledger is off chain and only legal process reveals the mapping. Record the amount, timing and bridge contract, state the basis for any linkage claim, and reduce confidence accordingly. Cross-chain continuity asserted without paired event evidence is one of the weakest claims in this discipline.

What records should I ask an exchange for?

Through the appropriate legal instrument, ask for the account or accounts associated with the specific deposit addresses in a defined time window, the customer identification and verification records, the account opening details including addresses, telephone numbers and identity documents, the internal transaction history including fiat off-ramps and bank details, login and device records with addresses and timestamps, and any suspicious activity reporting relating to the account. Specify addresses rather than asking for a name, since the exchange maps deposit addresses to accounts. Include a preservation request first if the process will take time, because retention periods are finite.

Is open tooling good enough or do I need a commercial platform?

For evidential work, open and public tooling has a real advantage: transaction paths verifiable on a public explorer and heuristics that can be inspected and reproduced survive challenge far better than a vendor label an expert cannot examine. Commercial platforms bring much larger attribution sets, cross-chain coverage and speed, which matters for screening and for triage at scale. The practical answer in serious cases is to use commercial tooling to find the path and then reproduce the core of it with public data and documented heuristics, so the evidence does not depend on a proprietary assertion.

How long should I keep tracing a flow?

Until it reaches an actionable point or until confidence degrades below usefulness, and no further. Actionable points are a regulated service where legal process can be directed, a designated address, a merchant or a fiat off-ramp. Confidence degrades at mixers, at high-volume exchange hot wallets where your funds merge with everyone elses, and after enough splits that any individual output represents a trivial share. Continuing past that point generates diagrams rather than intelligence. Record where you stopped and why, since that statement is itself useful to whoever picks the case up later.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• FATF Recommendation 15 and the associated virtual asset guidance, including the travel rule, which govern what records regulated intermediaries must hold.
• OFAC sanctions regulations including designation of specific digital currency addresses, which govern the legality of transacting with a traced counterparty.
• The EU Markets in Cryptoassets Regulation and the transfer of funds regulation, which govern service provider obligations and payer information in the European Union.
• The UK Money Laundering Regulations 2017 and Financial Conduct Authority cryptoasset registration, which govern which firms are subject to United Kingdom process.
• ISO/IEC 27037 on digital evidence handling, which governs preservation of wallets, seed material and chain extracts seized from devices.
• The Budapest Convention on Cybercrime, which governs cross-border preservation and production requests to foreign intermediaries.
• The UN Convention against Transnational Organized Crime, which governs mutual legal assistance and asset confiscation cooperation.
• ICD 203 analytic standards, which govern expression of confidence where clustering and attribution are inferential rather than observed.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. Specially Designated Nationals list including digital currency addresses — US Office of Foreign Assets Control. Authoritative designation list naming sanctioned persons, services and addresses
2. Virtual assets guidance and the travel rule — Financial Action Task Force. International standards for virtual asset service provider obligations and record keeping
3. Advisories on ransomware and virtual currency — Financial Crimes Enforcement Network. Typologies and reporting obligations for ransomware payments and laundering
4. GraphSense analytics platform — GraphSense. Open source clustering and flow analysis over public ledger data
5. Multi-chain block explorer — Blockchair. Public explorer supporting independent verification of transaction paths
6. Cryptoasset firm registration — UK Financial Conduct Authority. Register of cryptoasset businesses subject to United Kingdom anti-money laundering supervision
7. Internet Crime Report — Internet Crime Complaint Center. Annual reporting on ransomware and virtual currency fraud losses and typologies
8. Operational announcements on darknet and mixer disruptions — Europol. Record of service seizures that change attribution and tracing outcomes
9. OpenSanctions datasets — OpenSanctions. Consolidated designation data including published cryptocurrency address attributes

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: traces seed to cash-out with clustering provenance, sanctions screening and movement alerting. Explore the platform, or browse the rest of the library by following any tag above.