Bridging On-Chain Analysis, OSINT, and Digital Evidence

Guest Blogger: Matthew Stern

Cryptocurrency investigations are often described as the virtual equivalent of “following the money.” Public blockchains such as Bitcoin and Ethereum give investigators an unusual advantage: a transaction history that can be examined without first obtaining records from a financial institution.

But following the money is only the beginning.

Blockchain analysis and forensic tools can reveal asset movements between addresses and interactions with identifiable services. What these tools usually cannot establish by themselves is who controlled those funds, why they moved, or what happened outside the blockchain. That is where tracing must become part of a broader investigation.

Tracing Is Not the Same as Attribution

An address is not a person. Even when an analytics platform labels an address as belonging to a Virtual Asset Service Provider (VASP), such as an exchange, that label is a lead—not an identification of the person who controlled the funds.

Identifying an exchange deposit may give us somewhere to direct a records request. Identifying the account holder generally requires off-chain evidence, often including records from the VASP. Establishing who actually operated the account and who authorized a particular transfer may require further corroboration.

What Happened Before the Transaction?

Cryptocurrency transactions do not happen in a vacuum. In fraud and extortion cases, messages and payment instructions may explain what led someone to transfer funds. Those messages may contain contact details and other information that can be investigated off-chain.

When searching for hidden assets, such as in a high-profile divorce case, I would also ask how the cryptocurrency was acquired in the first place. Did the target receive the crypto assets from a third party or purchase them using fiat money? Were they purchased using funds from a known bank account controlled by the target? The crypto assets had to come from somewhere. I would look for evidence of how they were acquired—not just where they went next.

Open-source intelligence (OSINT) can add context: a publicly posted wallet address, a reused username, or a domain connected to a suspect website may link otherwise separate evidence.

An Exchange Is Sometimes Just the Beginning

Reaching a VASP or centralized exchange does not necessarily mean funds were converted to fiat currency. Trades, asset conversions, and transfers between customer accounts may be recorded on a custodial platform’s internal ledger, outside public view.

To understand what happened next, investigators need off-chain data from the VASP. The VASP will often require legal process, such as a subpoena or court order, before producing records. Available records may include account-registration details, approved devices, login history, trades, fiat and crypto deposits and withdrawals, and linked payment and bank accounts.

Even then, the investigation is often not finished. Those records may reveal that cryptocurrency was converted into another asset and withdrawn to an unfamiliar address. That address becomes a new starting point for blockchain analysis.

I think of this as moving between investigative layers. On-chain analysis leads to off-chain evidence, which may send us straight back to the blockchain.

Digital Evidence Can Connect the Pieces

A forensic examination of a device may uncover wallet files, transaction records, exchange logins, or communications that help connect addresses to a device and its user. Private keys, recovery phrases, or wallet backups may provide further evidence and should be promptly preserved and handled securely.

Context remains essential. A wallet address appearing on a device could belong to a third party or someone working with the owner of the device. Even access to a wallet does not, by itself, establish who authorized a particular historical transaction. For an address controlled by a single signing key, another person holding a copy of that key could also sign transactions.

The process also works in reverse: an address discovered on a device may reveal an entirely new financial trail. Blockchain analysis and digital forensics often complement each other.

Start With the Question, Not the Tool

Before opening an analytics platform, I prefer to ask: what am I actually trying to establish?

Identifying hidden assets, tracing a victim’s payment, and demonstrating control over an address are different questions. They may require different combinations of blockchain data, OSINT, provider records, and digital evidence.

The conclusion also needs to be defensible. Just like any investigation, it’s important to preserve the underlying evidence, document sources and methodology, and distinguish observed transactions from inferred relationships. Investigators should document contradictory findings and unresolved gaps.

For example: “Transaction [hash] shows 2.1 BTC sent to Address B, which Provider X labels as Exchange Y.” That records the transaction and the source of the attribution; it does not, by itself, establish who authorized the transfer.

A clear transaction graph is useful. An explanation of what it establishes, and what it does not, is more important.

The blockchain can show us where to look. The wider investigation helps us understand what happened before, during, and after the transaction, and what the evidence actually supports and what it does not.

About the author:

Matthew Stern is a cyber intelligence and blockchain forensics practitioner with more than seven years of experience in cryptocurrency investigations, asset tracing, OSINT, and financial crime investigations. He has founded and led international investigative firms supporting complex cross-border matters involving digital assets and cyber-enabled financial crime. Matthew holds an M.S. in Criminal Justice, with a concentration in Cybercrime Investigation & Cybersecurity, from Boston University. His research on sanctions-linked cryptocurrency networks has been published in the International Journal of Cybersecurity Intelligence & Cybercrime and received first place in Boston University’s 2026 White Hat Conference Student Paper Competition.