Crypto Tracing for Journalists

1. Why following crypto is now a reporting skill

Cryptocurrency turns up in more stories every year — fraud and scams, ransomware, sanctions evasion, political donations, and the finances of people who would rather their money movements stayed private. The instinct that crypto is untraceable is mostly wrong: the major public blockchains, including Bitcoin and Ethereum, are open ledgers where every transaction is permanently visible to anyone with a web browser.

That transparency is a gift to reporters, but it comes with a trap. The ledger shows how value moved between addresses; it does not, on its own, show who controls those addresses. The entire discipline of crypto tracing lives in that gap — following flows across the chain, identifying the points where the pseudonymous world touches the identified one, and being rigorous about what can and cannot be proven.

This guide is methodological. It explains how to read the chain, what obfuscation techniques you will run into, and where the responsible limits of a journalist's attribution lie. It is not a manual for moving money undetected.

2. When crypto tracing matters most

• 1Verifying whether a claimed cryptocurrency payment, donation or ransom actually took place, on which chain, and when.
• 2Following funds from a scam, hack or fraud to the point where they enter or leave an exchange.
• 3Testing a subject’s public claims about crypto holdings or transfers against the visible on-chain record.
• 4Understanding the money behind a project, token or platform that is central to a story.
• 5Corroborating a leak, tip or law-enforcement account against the independent evidence of the blockchain itself.
• 6Contextualising a court case or regulatory action that turns on cryptocurrency transactions.

3. Free block explorers and the analytics sector

4. Public blockchains as transparent ledgers

A public blockchain is a shared record of transactions that is replicated across many computers and, in practice, cannot be quietly altered after the fact. On chains like Bitcoin and Ethereum, each transaction records the addresses involved, the amount, and a timestamp, and the whole history is open to inspection. This is the opposite of the closed ledgers held by a bank, where only the institution and the regulator can see the flow.

The crucial word is pseudonymous, not anonymous. An address is a long string of characters, not a name, but because the ledger is permanent, every transaction associated with that address is visible forever. If an address is ever linked to a real identity — through an exchange, a public post, or other evidence — that link can retrospectively illuminate its entire history. Tracing exploits exactly this property.

5. Following transactions and clustering addresses

6. Chain-hopping, mixers and privacy coins

Several techniques exist to frustrate tracing, and recognising them matters because their presence is often itself a signal worth noting rather than a dead end. Chain-hopping moves value between different cryptocurrencies or blockchains — for example converting one asset into another — so that a continuous trail on a single chain is broken into segments that are harder to join up.

Mixers, or tumblers, pool funds from many users and redistribute them so that the link between where money came from and where it went is obscured. Privacy coins are cryptocurrencies engineered to hide transaction details such as amounts or the parties involved, rather than exposing them on an open ledger. A journalist's job is not to defeat these systems but to observe when they appear in a story: funds routed through a mixer or swapped into a privacy coin is a reportable fact and a recognised red flag, even where the trail beyond it cannot be followed with free tools.

7. Exchanges, on/off-ramps and KYC choke points

The point at which cryptocurrency is converted to or from conventional money — an on-ramp or off-ramp — is usually an exchange, and regulated exchanges are required to perform customer due diligence, commonly called Know Your Customer (KYC) and anti-money-laundering checks. This means that when funds move onto or off an exchange, there is, somewhere in that business's records, an identity attached to the account.

These choke points are why crypto is far from untraceable in practice: pseudonymous on-chain activity frequently touches an identified account at some stage. The critical caveat for reporters is access. Those KYC records sit with the exchange and are obtainable only through legal process by law enforcement, not by a journalist. You can identify that a flow reached a particular exchange; you generally cannot lawfully obtain the name behind the account. Treat the choke point as a lead and a question to put to authorities, not as a name you can publish.

8. How law enforcement and analytics firms trace funds

Professional tracing combines the open ledger with resources a newsroom rarely has. Blockchain analytics firms — Chainalysis and Elliptic are two commonly cited sector examples — maintain large datasets that label addresses linked to exchanges, services, and known criminal incidents, and they apply clustering at scale to attribute activity to entities. Law enforcement and financial-crime compliance teams license these tools.

Investigators also have powers a reporter does not: they can serve legal demands on exchanges for customer records, seize devices, and combine on-chain evidence with traditional financial and communications data. Understanding this ecosystem helps a journalist calibrate their own claims. It is legitimate to report that funds moved in a certain way on-chain, and to report what authorities or named experts have concluded; it is not legitimate to present the confidence level of a licensed analytics investigation as though it were achievable from a free explorer alone.

9. The limits of attribution: an address is not a person

The single most important discipline in crypto reporting is separating what the chain proves from what you have inferred. The ledger reliably shows that value moved between addresses at a given time. It does not show who controls an address, why the transfer happened, or whether the person you suspect was actually at the keyboard.

• ⚠Clustering that links addresses to a single entity is probabilistic, and different tools reach different conclusions.
• ⚠Custodial addresses held by exchanges or services represent many users at once, not one individual.
• ⚠A person can transact through an address they do not personally control, or have their address used without their knowledge.
• ⚠Attribution built on a leak or a single disclosure inherits whatever errors that source contained.
• ⚠On-chain evidence shows movement, never motive; intent must be established off-chain.

10. Legal and ethical risks of publishing addresses

Where a wallet address can be tied to an identifiable living person, it can constitute personal data, engaging UK data-protection law and the public-interest and proportionality considerations that go with it. There are also defamation risks if an attribution is wrong, and real-world safety risks if publishing an address exposes someone to harassment, extortion or worse. Publishing an address can additionally enable jigsaw identification, allowing others to link the person to further activity.

None of this prohibits crypto reporting in the public interest; it disciplines it. Ask whether the address itself needs to be published or whether the finding can be described without it, whether the attribution is strong enough to defend, and whether publication is proportionate to the story's public interest. As with any serious allegation, put your specific, evidenced findings to the subject and reflect their response before publishing.

11. Verification checklist

• I have confirmed every transaction and address exists on-chain using a public block explorer.
• I have recorded each hop, hash and address so the trail can be reconstructed and reviewed.
• I have distinguished clearly between what the ledger proves and what I have inferred.
• I have identified any mixers, chain-hops or privacy coins in the flow and reported them as facts, not guesses.
• I have treated exchange choke points as leads for authorities, not as identities I can publish.
• I have corroborated any attribution to a person with independent off-chain evidence.
• I have considered the data-protection, defamation and safety implications of publishing any address.
• I have put my specific findings to the subject and reflected their response.

Jargon glossary

Frequently asked questions