Tracing cryptoassets: how far can blockchain analysis follow value and identify responsible actors?

Abstract

Public blockchains expose financial flows with a granularity uncommon in traditional systems. That transparency does not mean that tracing funds equals identifying people. Transaction tracing, clustering and attribution tagging can reconstruct paths and group addresses, but face limits created by mixers, CoinJoin, bridges, Layer 2, DEXs, privacy-enhancing technologies and the absence of ground truth. This article describes the current state of blockchain forensics and proposes a reporting approach that distinguishes observable trajectory, heuristic inference and corroborated identification.

Keywords: blockchain forensics; transaction tracing; clustering; mixers; bridges; cryptoassets.

1. Following value is not always following an individual “coin”

Bitcoin’s UTXO model enables explicit links among outputs. Account-based networks such as Ethereum require analysis of balance changes, contract calls and events. Token flows may be mediated by smart contracts; DeFi transactions can include swaps, loans and bridges in a single transaction.

There is therefore no universal tracing algorithm applicable in the same way to every blockchain.

2. The foundation: transaction graphs

Investigations often begin with known addresses, transactions or entities and build a graph in which nodes represent accounts/contracts/entities and edges represent transfers or interactions.

Graphs can answer where assets moved, whether they were dispersed or consolidated, which services received them, whether swaps occurred, whether a bridge was used and which addresses recur.

Visualization is useful, but conclusions must remain tied to the underlying data and transformation rules.

3. Clustering is powerful — and heuristic

In Bitcoin, the multi-input heuristic and change-address heuristics are foundational techniques. Modern research, however, emphasizes limitations caused by CoinJoin, wallet behavior, new transaction patterns and privacy techniques. 2024–2025 studies specifically discuss uncertainty and lack of ground truth in address clustering.[1][2]

A statement that “these addresses belong to one person” is much stronger than “these addresses were grouped under heuristic X.” Unless independently confirmed, the latter is usually the more defensible formulation.

4. Attribution tagging connects on-chain and off-chain evidence

An address can be linked to an entity through exchange records, public disclosure, seized devices, private keys, login logs, withdrawal records, business documents, prior investigations or analytics labels.

This stage is critical: the blockchain shows the flow; attribution links that flow to the real world.

Commercial analytics platforms can be valuable, but an expert should distinguish publicly reproducible ledger data from proprietary intelligence.

5. Mixers: obfuscation does not necessarily create perfect invisibility

Mixers attempt to weaken the link between incoming and outgoing transactions. Research presented at DFRWS EU 2025 identified operational patterns and scenarios in which partial knowledge can still support tracing; other work examined wallet fingerprinting against tumblers.[3][4]

These studies do not justify automatic deanonymization. They show that statistical and behavioral patterns can remain informative even under deliberate obfuscation.

6. Bridges and chain hopping changed the scale of the problem

Modern tracing cannot assume a single blockchain. Bridges, DEXs and Layer 2 networks add new execution and settlement layers.

Recent research has proposed transaction matching between EVM chains and cross-layer forensic frameworks.[5][6]

A cross-chain analysis may need to identify the bridge contract, understand lock/mint or burn/release mechanics, correlate amounts and time, identify relayers, normalize token decimals and distinguish native, wrapped and synthetic assets.

7. DEX swaps transform the object being traced

If ETH is swapped for USDC, the investigator is no longer following identical units but an economic transformation.

A DEX analysis may need to examine pools, aggregators, token in/out, net values, fees, slippage, internal calls and routing.

The meaning of “following value” should therefore be explicitly defined in the methodology.

8. Stablecoins and unhosted wallets

FATF devoted a 2026 report to stablecoins and peer-to-peer transactions involving unhosted wallets.[7] Such wallets do not remove on-chain traceability, but they may reduce the immediate availability of KYC information from an intermediary.

Investigators often seek points of contact with exchanges, issuers, payment processors, merchants, bridges or custodians. Centralized stablecoins may also generate relevant freeze, blacklist and redemption events.

9. DeFi complicates control and entity identification

FATF’s 2026 DeFi report emphasizes a functional, risk-based approach to identifying control.[8]

For forensic work, relevant questions include admin keys, multisig, timelocks, upgrade authority, front-end separation, DAO control and the implementation active at the relevant block.

Attributing an action to “the protocol” is not the same as identifying a person responsible for a specific transaction.

10. The major analytical error: confusing proximity with ownership

When assets pass through an address, control may change. Exchange deposit addresses, liquidity pools, bridge vaults, merchants and processors can break simple ownership assumptions.

Tracing should therefore identify changes in control domain. A deposit into an exchange may end what can be inferred purely on-chain and require off-chain records to continue attribution.

11. Expressing confidence in a forensic report

A practical vocabulary is:

• confirmed on-chain

  — transaction, amount, contract, block;

• corroborated off-chain

  — exchange account, document, seizure;

• high-consistency heuristic

  — established method supported by converging indicators;

• exploratory heuristic

  — useful investigative lead, not sufficient alone;

• indeterminate

  — available evidence does not support responsible attribution.

This prevents persuasive graphics from conveying more certainty than the method justifies.

12. Regulated intermediaries create off-chain correlation points

Across jurisdictions, virtual-asset service providers are increasingly subject to licensing or registration, AML/CFT controls, Travel Rule implementation and recordkeeping requirements. FATF's 2025–2026 implementation work shows why regulated intermediaries can become valuable off-chain correlation points for blockchain investigations.[9][10]

From a forensic perspective, increasing formalization of VASPs raises the importance of off-chain records, custody controls and audit trails that can be correlated with public blockchain data.

13. Conclusion

Blockchain forensics is powerful because it combines a verifiable ledger with graph analysis and external information. Its greatest risk is converting heuristic analysis into categorical assertion.

Tracing value, clustering addresses and identifying responsible actors are three distinct operations. The first can be purely on-chain. The second is often probabilistic. The third generally requires corroboration.

As mixers, bridges, DEXs, Layer 2 and DeFi increase complexity, premises, algorithms and confidence levels must become more explicit. The goal is not to produce the most impressive graph; it is to produce a reproducible conclusion proportionate to the evidence.

13A. Deterministic facts, heuristics, and external attribution

A tracing report should clearly separate deterministic on-chain relationships, heuristic relationships such as clustering, and external attribution supplied by exchanges or intelligence providers. This distinction makes uncertainty visible and reduces the risk of presenting proximity or a probabilistic cluster as ownership.

References

1. Atlam, H.F.; Ekuri, N.; Azad, M.A.; Lallie, H.S.

   Blockchain Forensics: A Systematic Literature Review…

   . 2024. https://doi.org/10.3390/electronics13173568

2. Improved Bitcoin simulation model and address heuristic method

   . 2025. https://doi.org/10.1016/j.fsidi.2025.301935

3. Tippe, P.; Deckers, C.

   Unmixing the mix

   . 2025. https://doi.org/10.1016/j.fsidi.2025.301876

4. Tumbling down the stairs…

   . 2025. https://www.sciencedirect.com/science/article/pii/S2666281725000083

5. Yan, T.; Huang, C.; Tessone, C.

   Tracing Cross-Chain Transactions Between EVM-Based Blockchains

   . 2025. https://doi.org/10.5195/ledger.2025.433

6. A Full-Node Blockchain Forensic Framework for Cross-Layer Virtual Asset Tracking

   . 2026. https://www.mdpi.com/2079-9292/15/17/3849

7. FATF.

   Targeted Report on Stablecoins and Unhosted Wallets

   . 2026. https://www.fatf-gafi.org/en/publications/Virtualassets/targeted-report-stablecoins-unhosted-wallets.html

8. FATF.

   Targeted Report on Regulatory Challenges from Decentralised Finance

   . 2026. https://www.fatf-gafi.org/en/publications/Virtualassets/targeted-report-decentralised-finance-2026.html

9. FATF. Seventh Targeted Update on Implementation of the FATF Standards on Virtual Assets/VASPs. 2026. https://www.fatf-gafi.org/en/publications/Fatfrecommendations/targeted-updated-virtualassets-vasps-2026.html

10. FATF. Virtual Assets: Targeted Update on Implementation of the FATF Standards. 2025. https://www.fatf-gafi.org/en/publications/Fatfrecommendations/targeted-update-virtual-assets-vasps-2025.html

Editorial note: clustering and attribution techniques must be documented and validated for the relevant network and period.