2.4 Blockchain Transactions, Cryptocurrency Tracing & Digital Asset Investigations

2.4 Blockchain Transactions, Cryptocurrency Tracing & Digital Asset Investigations

Cryptocurrencies and decentralized ledgers have emerged as the primary payment rail for ransomware extortions, dark web marketplaces, money laundering syndicates, and sanctions evasion. While threat actors often assume that blockchain assets provide absolute anonymity, the fundamental architecture of public distributed ledgers is pseudonymous and immutable. Every transaction is permanently recorded across thousands of distributed nodes.

For the forensic investigator, tracing digital assets requires understanding the mathematical mechanics of distributed consensus, differentiating between transaction ledger architectures, detecting mixing and anonymization attempts, extracting cryptographic artifacts from suspect host endpoints, and applying clustering heuristics to follow illicit funds to centralized Virtual Asset Service Providers (VASPs).

---

Distributed Ledger Mechanics & Block Architecture

A blockchain is an append-only, distributed ledger composed of sequentially linked cryptographic blocks. Each block consists of two primary structures: the Block Header and the Transaction List.

+--------------------------------------------------------------------------------+
|                           BITCOIN BLOCK HEADER STRUCTURE                       |
+-------------------+------------+-----------------------------------------------+
| Field             | Size       | Forensic Significance                         |
+-------------------+------------+-----------------------------------------------+
| Version           | 4 Bytes    | Block format rules and protocol updates       |
| Previous Block    | 32 Bytes   | SHA-256 hash of parent block; links the chain |
| Merkle Root       | 32 Bytes   | Cryptographic hash tree of all transactions   |
| Timestamp         | 4 Bytes    | Unix epoch time; verifies sequence integrity  |
| Target (nBits)    | 4 Bytes    | Encoded proof-of-work difficulty threshold    |
| Nonce             | 4 Bytes    | 32-bit counter altered to solve block hash    |
+-------------------+------------+-----------------------------------------------+

The Merkle Tree

Transactions within a block are organized into a binary cryptographic hash tree (Merkle Tree). Each transaction ID ($Tx_1, Tx_2$) is hashed: $H_A = \text{SHA256}(\text{SHA256}(Tx_1))$. Adjacent hashes are concatenated and hashed pairwise until a single 32-byte hash remains: the Merkle Root. If a single bit in any transaction is modified, the Merkle Root changes, invalidating the block header hash and breaking the cryptographic chain.

---

Transaction Ledger Models: UTXO vs. Account/Balance

Cryptocurrencies handle value transfer using two fundamentally distinct architectural models:

+--------------------------------------------------------------------------------+
|                 UTXO MODEL (Bitcoin) vs. ACCOUNT MODEL (Ethereum)              |
+--------------------------------------------------------------------------------+
|  UTXO Model (Bitcoin, Litecoin, Dogecoin)                                      |
|  - No global account balance; state consists of unspent transaction outputs.   |
|  - Analogous to physical currency bills: outputs must be spent in full.        |
|  - Sends change back to newly generated change addresses.                      |
+--------------------------------------------------------------------------------+
|  Account / Balance Model (Ethereum, Solana, Avalanche)                         |
|  - Global state database tracks account balances and contract storage.         |
|  - Analogous to traditional bank accounts: debits sender, credits receiver.    |
|  - Tracks sequential account 'nonce' to prevent transaction replay attacks.    |
+--------------------------------------------------------------------------------+

Change Address Mechanics & Peeling Chains

In the UTXO model, outputs are indivisible. If an address controls a 5.0 BTC UTXO and wishes to transfer 1.2 BTC to a vendor, the transaction must consume the entire 5.0 BTC input. It produces two outputs:

1. Payment Output: 1.2 BTC sent to the vendor address.
2. Change Output: 3.799 BTC sent back to a newly generated change address owned by the sender's wallet.
3. Miner Fee: The remaining difference (0.001 BTC) is claimed by the mining pool.

When money launderers move funds through an automated series of payments, this behavior forms a Peeling Chain. At each hop, a small payment is "peeled" off (e.g., to a prepaid debit card, exchange, or mixer), while the bulk of the funds is routed to a fresh internal change address, continuing through dozens of iterations.

---

Bitcoin Script & Address Architecture

Bitcoin addresses represent cryptographic locking scripts defined in the Forth-like, stack-based language Bitcoin Script:

• P2PKH (Pay-to-Public-Key-Hash): Legacy format. Addresses begin with 1 (e.g., 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa). Locking script requires proving ownership of the public key whose SHA-256 and RIPEMD-160 hash matches the address.
• P2SH (Pay-to-Script-Hash): Standardized under BIP 16. Addresses begin with 3. Used for Multi-Signature (Multisig) wallets. Funds are locked to a script hash; the spender must reveal the redeem script and corresponding signatures upon spending.
• P2WPKH / P2WSH (Native Segregated Witness / SegWit): Standardized under BIP 141. Addresses begin with bc1q (Bech32 encoding). Moves cryptographic signature data (witness) out of the base serialization block into a separate structure, resolving transaction malleability and reducing fees.
• P2TR (Taproot): Standardized under BIP 341/342. Addresses begin with bc1p (Bech32m encoding). Utilizes Schnorr Signatures and Merkelized Alternative Script Trees (MAST). Makes complex multi-signature smart contracts appear indistinguishable from standard single-signature transactions on the public ledger.

---

Anonymization Techniques: Mixers, Tumblers & Privacy Coins

To break the public transaction link between illicit origins and fiat off-ramps, criminals employ several obfuscation methodologies:

+-----------------------------------------------------------------------------+
|                        MIXING & PRIVACY MECHANISMS                          |
+-----------------------------------------------------------------------------+
| 1. Centralized Tumblers (Custodial)                                         |
| - User deposits dirty funds -> Service pools funds -> Sends clean coins to  |
|   new address minus fee. (Vulnerable to server seizure and internal logs)  |
+-----------------------------------------------------------------------------+
| 2. CoinJoin (Decentralized UTXO Mixing - Wasabi / Samourai)                 |
| - Multiple users combine inputs into a single multi-party transaction with  |
|   identical output denominations, breaking common input ownership rules.    |
+-----------------------------------------------------------------------------+
| 3. Smart Contract Mixers (Tornado Cash on Ethereum)                         |
| - Users deposit fixed tokens into smart contract, receiving a secret note.  |
| - Funds are withdrawn to a clean address using zk-SNARK zero-knowledge      |
|   proofs, cryptographically breaking the deposit-withdrawal link.          |
+-----------------------------------------------------------------------------+
| 4. Privacy Coins (Monero / Zcash)                                           |
| - Monero (XMR): Default privacy via Ring Signatures (sender), Stealth       |
|   Addresses (receiver), and RingCT / Bulletproofs (transaction amounts).     |
| - Zcash (ZEC): Optional privacy via shielded pools (z-addresses) via SNARKs.|
+-----------------------------------------------------------------------------+

The Monero (CryptoNote) Privacy Triad

Monero (XMR) represents the most common privacy coin encountered in cybercrime investigations due to its mandatory, un-switchable privacy architecture:

1. Ring Signatures (Obfuscating the Sender): When a transaction is spent, the true output is mixed with $N-1$ decoy outputs past-mined from the blockchain (current ring size is 16). Cryptographic math proves that one member of the ring authorized the transaction, without revealing which one. Monero generates a unique Key Image for each spent output to prevent double-spending without revealing the underlying coin.
2. Stealth Addresses (Obfuscating the Recipient): Every transaction generates a unique, one-time destination address ($P$) derived from the recipient's public view key ($A$) and public spend key ($B$) using Diffie-Hellman exchange: $P = H_s(rA)G + B$. The recipient's true public wallet address never appears on the blockchain.
3. RingCT & Bulletproofs (Obfuscating Amounts): Transaction values are concealed using Pedersen Commitments. Bulletproofs (non-interactive zero-knowledge range proofs) mathematically prove that transaction input sums equal output sums without disclosing the numerical values.

---

Forensic Recovery of Cryptocurrency Wallet Artifacts

When searching seized computer systems or mobile devices, investigators must target specific cryptographic wallet structures:

1. Bitcoin Core & Desktop Wallets

• Artifact: wallet.dat
• Path: %APPDATA%\Bitcoin\wallet.dat (Windows) or ~/.bitcoin/wallet.dat (Linux).
• Structure: Berkeley DB or SQLite database containing encrypted master private keys, public address pairs, and transaction labels. The master key is typically encrypted with AES-256-CBC using an iteration-strengthened key derived via SHA-512.

2. Hierarchical Deterministic (HD) Wallets (BIP 32 / BIP 39 / BIP 44)

Modern wallets eliminate the need to back up individual private keys. Instead, they derive an infinite tree of keypairs from a single master seed:

• BIP 39 Mnemonic Seed Phrase: A 12-, 18-, or 24-word sequence chosen from a standardized dictionary of 2,048 English words. The words represent 128 to 256 bits of entropy plus a checksum. The mnemonic is hashed using PBKDF2-HMAC-SHA512 (2,048 iterations) with the salt mnemonic + [optional passphrase] to generate a 512-bit master seed.
• BIP 44 Derivation Path: Standardized tree derivation string: m / purpose' / coin_type' / account' / change / address_index.
  • m/44'/0'/0'/0/0: First Bitcoin receiving address.
  • m/44'/60'/0'/0/0: First Ethereum address.

[!WARNING] If an investigator discovers a handwritten 12- or 24-word mnemonic phrase in a suspect's notebook or text file, that phrase is the wallet. Anyone in possession of the BIP 39 seed can recreate the private keys and sweep the entire balance from any computer on Earth. Secure mnemonic phrases immediately in an evidence safe.

3. Browser Extension Wallets (MetaMask)

MetaMask stores encrypted wallet vaults inside Google Chrome's LevelDB storage:

• Path: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
• Vault Structure: A JSON string containing data (ciphertext), iv (Initialization Vector), and salt. The vault is encrypted with AES-GCM-256 using a key derived from the user's password via PBKDF2 (10,000 iterations).

# Extract vault ciphertext from LevelDB files
python3 metamask_vault_extractor.py ".../Local Extension Settings/nkbihfbeogaeaoehlefnkodbefgpgknn"

# Recover password using Hashcat (Mode 26600 - MetaMask Vault)
hashcat -m 26600 -a 0 metamask_hash.txt /usr/share/wordlists/rockyou.txt -r rules/best64.rule

---

Blockchain Analysis & Clustering Heuristics

Blockchain forensics platforms (Chainalysis Reactor, Elliptic, TRM Labs) reconstruct financial flows by applying deterministic clustering heuristics to link pseudonymous addresses to real-world entities:

+-----------------------------------------------------------------------------+
|                        BLOCKCHAIN CLUSTERING HEURISTICS                     |
+-----------------------------------------------------------------------------+
| 1. Common Input Ownership Heuristic (Multi-Input Heuristic)                 |
| - If Transaction X consumes Input A and Input B simultaneously, Address A   |
|   and Address B are presumed to be owned by the same entity.                |
+-----------------------------------------------------------------------------+
| 2. Change Address Heuristics                                                |
| - Address format matching: If Input is P2WPKH (bc1q) and Output 1 is P2PKH  |
|   while Output 2 is P2WPKH, Output 2 is likely the change address.          |
| - Peeling Chains: Round payment amounts sent to merchant; fractional,       |
|   un-rounded amounts sent to change address.                                |
+-----------------------------------------------------------------------------+
| 3. Co-Spending & Re-use Heuristics                                          |
| - Re-using the same change output in subsequent sweeps merges clusters.     |
+-----------------------------------------------------------------------------+

De-Anonymization and Exchange Subpoenas

Once an investigator clusters a threat actor's transactions and follows the peeling chain, the funds typically terminate at a Virtual Asset Service Provider (VASP)—such as a centralized cryptocurrency exchange (Binance, Coinbase, Kraken):

1. Identify VASP Deposit Address: High-volume clustering identifies addresses belonging to known exchange deposit hot-wallets.
2. Legal Process (Subpoena / 18 U.S.C. § 2703(d) / MLAT): The investigator serves legal process on the compliance department of the exchange, requesting:
   • Customer Know Your Customer (KYC) identity documentation (government ID, passport photo, proof of address).
   • Access logs (source IP addresses, user-agent strings, login timestamps).
   • Linked banking records (wire transfers, routing numbers, beneficiary account names).