Blockchain Forensics

Tracking Cybercrime, Crypto Theft and Digital Assets

Introduction: The Ledger That Never Lies and the People Behind the Addresses

Chapter 1: The Digital Crime Scene: Evidence in a Pseudonymous World

1. The Paradox of the Public Ledger
2. What Blockchain Forensics Is and Is Not
3. A Hierarchy of Evidence: From Facts to Attribution
4. The Investigator’s Mindset and Method
5. A Tour of the Terrain

Chapter 2: Distributed Ledgers, Data Structures and Consensus

1. Blocks, Chains and the Immutable Append-Only Log
2. Merkle Trees and Cryptographic Integrity
3. The UTXO Model and Transaction Structure
4. Nodes, Mempools and Propagation
5. Consensus Mechanisms and Finality
6. Why Data Structure Matters to the Investigator

Chapter 3: Cryptographic Foundations for the Investigator

1. Hash Functions: The Fingerprint of Data
2. Digital Signatures and Public-Key Cryptography
3. From Keys to Addresses: Derivation and Checksums
4. Cryptographic Verification in Forensics
5. Zero-Knowledge Proofs: A Preview

Chapter 4: Wallets, Keys, Accounts and the Pseudonymity Model

1. Two Models of Ownership: UTXO Versus Accounts
2. Wallet Architectures and Key Storage
3. Hierarchical Deterministic Wallets and Seed Phrases
4. Multi-Signature and Threshold Schemes
5. The Pseudonymity Model and Its Limits

Chapter 5: Bitcoin: Anatomy of a Chain of Evidence

1. Bitcoin Core and the Reference Node
2. The Script System and Address Types
3. Reading a Raw Bitcoin Transaction
4. The RPC Interface for Investigators
5. Bitcoin Data Sources and Explorers

Chapter 6: Ethereum and the Smart Contract Era

1. The Ethereum Account Model and the EVM
2. Transactions, Gas and Transaction Types
3. Smart Contracts and the Opcodes
4. Token Standards: ERC-20, ERC-721 and Beyond
5. Ethereum Clients, RPC and Data Sources

Chapter 7: The Multichain Landscape: Solana and Beyond

1. Solana: Accounts, Programs and Proof of History
2. Other Major Networks and Their Forensic Signatures
3. Comparing Forensic Characteristics Across Chains
4. The Multichain Investigation Challenge

Chapter 8: The Lifecycle of a Cryptocurrency Transaction

1. Creation and Signing
2. Propagation and the Mempool
3. Validation, Inclusion and Finality
4. Timestamps, Confirmation Depth and Reorg Risk
5. Reconstructing History from the Ledger

Chapter 9: Data Acquisition, Verification and Evidence Preservation

1. Sources of Blockchain Data: Nodes, APIs and Archives
2. Data Provenance and Reproducibility
3. Chain of Custody for Blockchain Evidence
4. Cryptographic Verification of Acquired Data
5. Evidence Preservation Workflows

Chapter 10: Building the Investigator’s Toolkit

1. Node Software and RPC Endpoints
2. Libraries and Programming Interfaces
3. Databases for Scale: SQL and Graph Stores
4. Visualization and Reporting Tools
5. Assembling a Complete Investigation Environment

Chapter 11: Transaction Graphs: Structure, Construction and Traversal

1. Graph Theory Fundamentals for Forensics
2. Two Kinds of Transaction Graphs
3. Building a Transaction Graph from Ledger Data
4. Traversal Algorithms for Fund Tracing
5. Graph Metrics and Structural Analysis

Chapter 12: Address Clustering, Wallet Attribution and Entity Identification

1. Heuristic One: Common Input Ownership
2. Heuristic Two: Change Address Detection
3. Probabilistic and Machine Learning Approaches
4. From Clusters to Entities: Attribution and Corroboration
5. Limits, False Positives and the Attribution Gap

Chapter 13: Fund Flow Reconstruction, Pattern Analysis and Behavioral Analytics

1. Follow the Bits: The Core Methodology
2. Behavioral and Temporal Analysis
3. Transaction Pattern Recognition
4. Anomaly Detection and Statistical Methods
5. Documenting the Flow: Structured Findings

Chapter 14: Obfuscation Techniques: Mixers, Privacy Coins and Evasion

1. Mixers and Tumblers: How They Work
2. CoinJoin and Collaborative Privacy
3. Privacy Coins: Monero, Zcash and Dash
4. Investigating Obfuscated Flows
5. When Obfuscation Fails: Breakthroughs and Limitations

Chapter 15: Theft, Ransomware and Phishing

1. The Anatomy of a Cryptocurrency Theft
2. Ransomware: From Encryption to Laundered Cash
3. Phishing and Social Engineering
4. Forensic Indicators of Theft Operations
5. Case Study: WannaCry and the Lazarus Group
6. Case Study: The Colonial Pipeline Payment Trail

Chapter 16: Exchange Hacks, Custodial Failures and Insider Threats

1. Exchange Architecture and Its Weak Points
2. Hot Wallet Attacks and Cold Wallet Breaches
3. Insider Threats and Custodial Failures
4. Case Study: The Rise and Fall of Mt. Gox
5. Case Study: The Ronin Bridge Hack
6. Investigating Custodial Compromises

Chapter 17: Fraud, Schemes and the Exploited Smart Contract

1. Investment Fraud and Ponzi Schemes on the Ledger
2. Honeypots, Rug Pulls and Fraudulent Tokens
3. Smart Contract Vulnerabilities as Crime Vectors
4. Case Study: The DAO and the First Hard Fork
5. Case Study: Poly Network and the Recovered Exploit
6. Case Study: The FTX Collapse and Off-Chain Fraud

Chapter 18: Money Laundering, Sanctions Evasion and Illicit Markets

1. The Stages of Laundering in Cryptocurrency
2. DeFi, Bridges and Modern Layering
3. Sanctions Evasion and State-Sponsored Crime
4. Darknet Markets: From Silk Road to the Present
5. Case Study: The Silk Road Investigation
6. The Regulatory Response: FATF, AML and the Travel Rule

Chapter 19: Bitcoin Forensics in Python: From RPC to Trace

1. Setting Up the Bitcoin Data Environment
2. Connecting to a Node and Retrieving Blocks
3. Decoding Raw Transactions in Python
4. Tracing Bitcoin Transfers: A Working Implementation
5. Error Handling, Rate Limiting and Robustness

Chapter 20: Graph Analysis and Visualization in Practice

1. Graph Databases for Blockchain Forensics
2. Building the Transaction Graph
3. Clustering in Code: Common-Input and Change-Address Clustering
4. Visualizing the Fund Flow
5. Detecting Anomalies in the Graph

Chapter 21: Ethereum, Tokens and Smart Contracts in Code

1. Setting Up the Ethereum Data Environment
2. Connecting to Ethereum Nodes and Public RPCs
3. Analyzing Transfers, Events and Logs
4. Token and DeFi Analysis in Python
5. Inspecting Smart Contracts: Bytecode and Source

Chapter 22: Building a Reusable Forensic Investigation Pipeline

1. Designing the Investigation Pipeline
2. Data Ingestion and Storage
3. Analysis Modules: Tracing, Clustering and Attribution
4. Report Generation and Evidence Packaging
5. Putting It All Together: A Complete Example

Chapter 23: The Future of Privacy: ZKPs, Account Abstraction and Beyond

1. Zero-Knowledge Proofs and Their Implications
2. Account Abstraction and the Changing Nature of Wallets
3. Cross-Chain Interoperability and the Fragmentation of the Data
4. Tokenization and the On-Chain Record of Real-World Assets
5. Decentralized Identity and the Erosion of the Pseudonym
6. The Evolving Privacy-Transparency Balance

Chapter 24: AI-Assisted Forensics and the Regulatory Horizon

1. Machine Learning and Anomaly Detection
2. Generative AI and the Forensic Workflow
3. The Regulatory Horizon: FATF, MiCA and Beyond
4. Preparing for the Next Decade of Blockchain Forensics

Conclusion: The Science and Practice of Blockchain Forensics

References