Blockchain tracing shows anonymity is not accountability

At a glance

What this is: This summit discussion argues that blockchain transparency has made cryptocurrency far more traceable than many users assumed, even as criminal accountability still depends on jurisdiction and enforcement reach.

Why it matters: It matters because identity and access teams should not confuse observability with control, especially when trust, attribution, and enforcement span human, machine, and financial systems.

By the numbers:

• Investigators identified 337 perpetrators worldwide and rescued 23 children in the Welcome to Video case.

👉 Read Bitwarden's summit discussion on blockchain tracing and crypto crime

Context

Blockchain is a public transaction ledger that can preserve a durable record of movement even when the people behind the wallets try to disappear. This discussion uses cryptocurrency tracing to show that attribution and enforcement are separate problems, and that visibility alone does not equal accountability in identity security or financial crime.

For IAM and governance teams, the useful parallel is straightforward: auditability can improve detection, but it does not by itself solve ownership, privilege, or offboarding. The same gap appears in NHI and human identity programmes when organizations can see activity but cannot reliably bind it to a responsible actor or act fast enough on the evidence.

Key questions

Q: How should security teams use traceability without mistaking it for control?

A: Use traceability as a detection and investigation layer, not as proof that risk has been reduced. A system can provide excellent audit evidence while still lacking the authority to revoke access, freeze value, or stop abuse. Teams should define the operational step that follows attribution so evidence turns into action.

Q: Why do visible transaction logs or access logs fail to create accountability on their own?

A: Because accountability requires more than a record. It needs jurisdiction, ownership, and a control path that can actually intervene. Logs can show who or what acted, but they do not by themselves bind that activity to a person or force a consequence. Governance fails when teams confuse recordkeeping with enforcement.

Q: What should identity teams learn from blockchain forensics?

A: They should learn that correlations matter more than single signals. A wallet, a service account, or an API key becomes more revealing when it is linked to exchange records, infrastructure, or lifecycle gaps. Good governance therefore focuses on reducing linkability and improving the ability to act on evidence.

Q: How do organisations know whether audit data is actually improving governance?

A: Audit data is helping only if it shortens the time from detection to containment, revocation, or decision. If teams can produce reports but cannot remediate the actor, the programme has observability without governance. The test is whether the evidence leads to a measurable response, not whether the dashboard looks complete.

Technical breakdown

How blockchain forensics turns transactions into evidence

Public blockchains create a persistent graph of transfers, which lets investigators cluster wallets, trace fund movement, and correlate that movement with off-chain evidence such as exchange records, seized infrastructure, or operational mistakes. The value is not that every wallet is named directly, but that repeated patterns, timing, and cash-out behaviour can be linked across cases. In practice, forensic analysis becomes a form of attribution engineering. It does not remove the need for legal process, intelligence work, or jurisdictional reach, but it can turn a seemingly anonymous payment system into a durable evidentiary trail.

Practical implication: build investigation playbooks that combine ledger analysis with identity, endpoint, and exchange evidence.

Why identifiability is not the same as accountability

A system can expose movement with high precision and still fail to produce consequences. That distinction matters because accountability depends on more than knowing where money went. It requires legal access, enforcement authority, operational disruption, and the ability to connect a transaction to a person, group, or infrastructure asset that can actually be acted on. The article’s central tension is that blockchain transparency improved attribution, but criminals in weak or hostile jurisdictions could still continue operating. For security leaders, this is the difference between visibility and control.

Practical implication: treat attribution data as one input to response, not as proof that the risk has been contained.

How criminal infrastructure leaks identity through operational mistakes

Many traced cases succeeded because operators made mistakes, reused infrastructure, moved funds through visible services, or mixed criminal and personal activity in ways that investigators could correlate. In crypto crime, the ledger is only one signal. The broader investigation often depends on linking wallet behaviour to hosting, communications, exchange onboarding, or device reuse. That is why criminal tradecraft frequently collapses under cross-source correlation rather than under the blockchain alone. The lesson for identity teams is that weak operational discipline creates its own identity trail.

Practical implication: assume adversaries can be deanonymised by cross-correlation and reduce the supporting signals they leave behind.

Threat narrative

Attacker objective: The objective is to move criminal proceeds or operational payments while preserving enough anonymity to avoid identification, seizure, or prosecution.

1. entry: criminals move value through Bitcoin or related wallets that appear detached from their real-world identities, creating an initial layer of operational anonymity.
2. escalation: investigators use blockchain analysis to cluster addresses, follow transfers across services, and correlate those movements with exchange records, infrastructure, and human mistakes.
3. impact: major criminal networks, including dark web marketplaces and ransomware-linked flows, are exposed, seized, or disrupted even when the underlying actors are harder to arrest.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• ASP.NET machine keys RCE attack — 3,000+ exposed ASP.NET machine keys enabled remote code execution.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Blockchain transparency proves that visibility and accountability are different control objectives. A ledger can expose movement with extraordinary fidelity, but consequence still depends on legal reach, operational disruption, and an actor who can be pinned to the activity. That distinction matters for identity programmes because many teams overestimate what observability alone can deliver. The practitioner conclusion is to treat traceability as evidence, not enforcement.

Identity programmes make the same mistake when they confuse audit logs with governance. Seeing activity from a service account, API key, or wallet-like credential does not mean the organisation can still govern the actor effectively. If ownership, offboarding, or revocation is unclear, the control surface may be visible while accountability has already decayed. The practitioner conclusion is to measure whether evidence translates into action, not whether evidence exists.

Crypto tracing is a reminder that operational mistakes create identity trails. Criminals did not lose because the blockchain was magical alone; they lost because infrastructure, exchange touchpoints, and human errors turned their supposedly hidden activity into a correlated evidence set. That same pattern appears in NHI environments when secrets, access paths, and lifecycle gaps are left adjacent enough to reconstruct. The practitioner conclusion is to reduce cross-correlation opportunities across the identity chain.

Traceability is becoming a governance requirement, not just an investigative capability. In modern identity security, teams need enough telemetry to reconstruct who or what acted, when, and through which control path. Without that, both human IAM and NHI oversight become arguments about suspicion rather than controlled response. The practitioner conclusion is to design for evidentiary completeness across identity estates.

From our research:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
• NHI Lifecycle Management Guide shows how provisioning, rotation, and offboarding reduce the evidence gaps that leave identity trails unresolved.

What this signals

Identity programmes need evidentiary depth, not just visibility. When a transaction or access path can be observed but not bound to an accountable actor, the programme is still vulnerable to delayed response and ambiguous ownership. The practical shift is toward tighter linkage between logs, lifecycle records, and revocation authority so evidence becomes operationally useful.

With 92% of organisations exposing NHIs to third parties, the real risk is not only access but correlation. Once external actors, integrations, and credentials are woven together, investigators and attackers alike can follow the same trail across systems. That means teams should limit reusable trust paths and make offboarding and revocation observable.

Traceability problems are becoming lifecycle problems. The organisations that can prove what happened fastest are usually the ones that know exactly who owns the credential, where it lives, and how it is retired. If that lifecycle is vague, the identity trail stays open long after the activity ends.

For practitioners

• Separate visibility from enforceability Map which parts of your identity stack can prove what happened and which parts can actually stop or revoke access. If the answer is only logging, your programme can investigate but not govern.
• Correlate identity evidence across systems Join logs from identity providers, secrets stores, workload platforms, and payment or transaction systems where relevant. Cross-correlation is what turns a trace into an attributable event.
• Reduce reusable operational trails Limit long-lived credentials, shared accounts, and repeated infrastructure patterns that create durable correlation points for investigators or adversaries alike. The more stable the trail, the easier it is to reconstruct activity.
• Define the point where evidence becomes response Document the threshold at which an observed identity event triggers containment, escalation, or legal review. A trace that is never acted on is only a historical record.

Key takeaways

• Blockchain analysis shows that anonymity can collapse under correlation even when the underlying ledger remains public.
• The evidence base is large, with multi-billion-dollar seizures and hundreds of identified perpetrators demonstrating the investigative power of tracing.
• Security teams should design governance so that attribution data leads to containment, revocation, or legal action, not just retrospective reporting.

Key terms

• Blockchain Forensics: Blockchain forensics is the practice of analysing public transaction ledgers to trace value movement, cluster related wallets, and connect on-chain activity to off-chain evidence. In security terms, it turns a visible payment graph into investigative evidence, but it does not automatically produce legal accountability or operational control.
• Accountability: Accountability is the ability to identify an actor and make that actor answer for an action through enforcement, containment, or formal consequences. In identity security, accountability depends on evidence, ownership, jurisdiction, and a control path that can actually intervene, not just on logging or attribution.
• Traceability: Traceability is the ability to follow an action, transfer, or access path across systems and time. It is stronger than simple visibility because it lets investigators reconstruct sequences, but traceability alone does not mean the organisation can revoke access, recover assets, or compel a response.
• Cross-Correlation: Cross-correlation is the process of linking signals from multiple sources to build a stronger picture of identity behaviour. In practice, it combines logs, infrastructure artefacts, lifecycle records, and external data so that one weak signal becomes a coherent and actionable event.

What's in the full article

Bitwarden's full article covers the contextual detail this post intentionally leaves at the level of governance and interpretation:

• The full summit discussion on how blockchain tracing techniques were used in landmark investigations and why investigators treated them as a forensic breakthrough.
• Additional examples from Silk Road, Mt. Gox, AlphaBay, and Welcome to Video that show how different criminal models exposed themselves differently.
• The privacy tension raised by universal traceability, including why the same tool that supports law enforcement also changes the threat model for ordinary users.
• The broader conversational context from the Bitwarden Open Source Security Summit fireside chat, including comments from Andy Greenberg and Paul Stringfellow.

👉 The full Bitwarden discussion covers the landmark cases, forensic techniques, and privacy trade-offs in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.