TL;DR: Illicit crypto transactions totalled $40.9 billion in 2024, while many law enforcement agencies still lack the tooling and workflows to investigate blockchain-linked crime effectively, according to Chainalysis. The operational gap is less about visibility into the ledger and more about converting transaction data into accountable investigative action.
At a glance
What this is: Chainalysis argues that blockchain intelligence helps law enforcement move from visible crypto transaction data to usable investigative workflows, even as illicit activity still represents a substantial criminal use case.
Why it matters: For identity and security teams, the key lesson is that visibility alone does not create control: investigations still depend on evidence handling, attribution, and operational readiness.
By the numbers:
- In 2024, transactions linked to illicit activity totaled $40.9 billion.
Context
Blockchain investigation is the process of tracing, correlating, and documenting crypto transactions so they can support an evidentiary workflow. The governance gap in this space is not the absence of data, but the lack of mature processes that turn transaction visibility into accountable investigative action.
For law enforcement, crypto creates a familiar security problem in a new operational form: evidence is public, but interpretation is hard, and attribution is rarely straightforward. That makes blockchain intelligence relevant not only to financial crime teams, but also to identity, fraud, and cyber investigators who need to connect wallets, infrastructure, and human actors.
Key questions
Q: Where does blockchain intelligence fail in crypto investigations?
A: It fails when teams stop at tracing and never establish attribution, evidence thresholds, or case handling discipline. Public blockchain data can show movement, but it does not by itself prove who controlled the wallets or whether the output is admissible. Mature investigations turn traces into defensible findings through review, corroboration, and documented decision-making.
Q: Why does attribution methodology matter so much in blockchain investigations?
A: Attribution methodology matters because a wrong wallet link can send investigators down the wrong path, weaken a case, or create wrongful enforcement risk. Public ledger analysis is only as reliable as the heuristics, safeguards, and review process behind it. Courts and investigators need to see whether the method is reproducible, conservative, and supported by evidence rather than opaque pattern matching.
Q: What signs show a blockchain intelligence process is working?
A: A working process produces consistent case notes, repeatable tracing logic, documented confidence levels, and clear escalation outcomes. If analysts cannot explain how a wallet relationship was inferred, or if similar cases produce different conclusions without a reason, the process is weak. Investigative quality should be visible in governance, not just in the software interface.
Q: How should agencies organise access to crypto investigation cases?
A: Agencies should assign access by role, case stage, and jurisdiction, then remove permissions when the case closes. Investigative systems need the same least-privilege discipline as any sensitive enterprise platform because evidence, identities, and partner data all become audit concerns. Case access should be reviewable and time-bounded.
Technical breakdown
How blockchain intelligence turns public ledger data into usable evidence
Public blockchains provide transaction history, but raw ledger data rarely answers investigative questions on its own. Blockchain intelligence platforms cluster addresses, trace fund flows, infer likely service relationships, and surface patterns such as peel chains, mixers, and exchange touchpoints. The value is in reducing investigative ambiguity, not in removing the need for analyst judgment. Investigators still need provenance, corroboration, and chain-of-custody discipline before a transaction trail becomes evidentially useful.
Practical implication: build investigative workflows that preserve traceability from first alert to case file, not just transaction visibility.
Why crypto crime investigations depend on attribution, not just tracing
Tracing money is only the first layer. Investigations become effective when analysts can associate wallets, infrastructure, or service accounts with real-world entities through exchange records, open-source intelligence, subpoenas, and cross-case pattern matching. This is where governance matters: the same address graph can support intelligence, compliance, or prosecution depending on the quality of attribution controls and case handling. In practice, weak attribution is what turns blockchain visibility into noise.
Practical implication: treat attribution quality as an investigative control, with review standards and evidence thresholds.
What makes law enforcement blockchain workflows different from enterprise monitoring
Enterprise security teams often optimize for detection speed, while law enforcement must optimize for evidentiary reliability, repeatability, and legal defensibility. That means tooling has to support structured reporting, collaboration, and audit trails, not only alerting. The article also surfaces an identity angle: investigators are trying to connect non-human transaction artifacts, such as wallet addresses and exchange accounts, to human or organisational actors. Without disciplined identity resolution, the case remains technically visible but operationally unresolved.
Practical implication: separate detection tooling from investigative workflow design, and require evidence-grade output from both.
Threat narrative
Attacker objective: The objective is to move illicit value through crypto rails while reducing the chance that investigators can attribute or disrupt the activity in time.
- Entry occurs when illicit proceeds move through blockchain transactions that are publicly visible but operationally opaque to investigators.
- Escalation happens when criminals layer services, multiple wallets, and laundering patterns to break simple transaction tracing.
- Impact is realised when agencies cannot reliably convert blockchain visibility into attribution, disruption, or admissible case evidence.
Breaches seen in the wild
- Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Blockchain visibility is not investigative maturity: public ledgers create more data, not more certainty. The operational gap is the absence of repeatable workflows that convert traces into evidence, decisions, and accountable action. For law enforcement and financial crime teams, the real control problem is investigative governance, not data availability.
Identity resolution is the hidden control layer in crypto investigations: wallets and addresses are only useful when they can be tied back to real entities with defensible confidence. That makes attribution a governance discipline, not a pure analytics exercise. The organisations that treat attribution standards as part of case management will be better placed to scale investigations.
Crypto crime investigation is now an identity problem as much as a financial one: criminal activity moves across wallets, exchanges, accounts, and services that behave like non-human identities in operational terms. That means the same rigor used for machine identity inventory, access lineage, and auditability starts to matter in blockchain intelligence workflows as well. Practitioners should align investigative tooling with identity and evidence controls, not only transaction tracing.
Blockchain intelligence will increasingly shape the boundary between compliance and enforcement: the same transaction graph can support fraud detection, sanctions enforcement, AML, and criminal investigation. That convergence raises the bar for data quality, retention, and escalation criteria. Teams that do not define those boundaries clearly will struggle to turn blockchain data into a reliable operational asset.
Crypto investigations are becoming a test of operational resilience: agencies that cannot ingest, correlate, and escalate blockchain evidence quickly will leave longer dwell time for laundering and cash-out. The article points to a broader market reality: security and law enforcement tooling is moving from visibility-first to workflow-first. Practitioners should evaluate whether their current stack supports that shift.
What this signals
Blockchain intelligence changes the operating model more than the data model: agencies already have access to transaction history, but they often lack the investigative workflow to turn that history into action. The next maturity step is not broader visibility, but better evidence handling, attribution discipline, and escalation logic.
The same operational lesson applies across fraud, sanctions, AML, and cyber investigations: visibility without governance produces interesting graphs, not defensible outcomes. Practitioners should focus on case quality, not just detection volume.
For practitioners
- Define investigative evidence thresholds Set explicit rules for when a traced wallet relationship is strong enough to support escalation, seizure requests, or case closure.
- Standardise attribution review Require second-level review for wallet clustering, service attribution, and cross-case correlation before findings enter a case file.
- Preserve chain-of-custody metadata Capture timestamps, source artifacts, analyst actions, and export history so blockchain intelligence remains defensible in court or audit.
- Separate detection from case management Use one workflow to surface suspicious crypto activity and another to manage evidence, approvals, and investigative status.
Key takeaways
- Crypto crime investigations fail when teams can trace funds but cannot operationalise attribution or evidence handling.
- The article's $40.9 billion figure shows that illicit activity remains a large and persistent use case for blockchain intelligence.
- Law enforcement and security teams need workflows that preserve chain of custody and support defensible investigative decisions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | RS.CO-02 — Incident Analysis | Investigative workflows depend on converting analysis into coordinated response actions. |
| GV.OV-01 — Oversight of the Cybersecurity Risk Management Strategy | The article is fundamentally about governance gaps in turning visibility into accountable investigations. | |
| Recommendation — Use RS.CO-02 to structure how blockchain findings move from analysis into coordinated case action. Apply GV.OV-01 to define who owns investigative quality, escalation, and evidence standards. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Blockchain intelligence outputs need review, correlation, and reporting discipline to be useful. |
| AU-10 — Non-repudiation | Case handling depends on defensible records that support later attribution and prosecution. | |
| Recommendation — Use AU-6 to formalise review and reporting of blockchain-derived investigative evidence. Apply AU-10 to preserve non-repudiable records for blockchain investigative decisions. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The article's evidence-handling challenge maps to managing logs and investigative records. |
| Recommendation — Use CIS-8 to retain and review blockchain investigation records with consistent handling rules. | ||
Key terms
- Blockchain Intelligence: Blockchain intelligence is the use of analytics and enrichment data to trace cryptocurrency transactions, identify entities, and connect wallet activity to real-world behaviour. It supports investigations, but it does not replace case management, evidentiary discipline, or trained analysis.
- Attribution: Attribution is the ability to prove which identity performed a specific action, through which systems, and with what outcome. In agentic environments, attribution must span APIs, services, and workflow steps, because isolated logs are rarely enough to reconstruct decision chains or support audit and incident response.
- Chain of custody: A documented record that preserves the integrity of evidence from the moment an event is detected through investigation and response. In identity and data protection workflows, it helps prove what happened, when it happened, and which actor or session was involved.
- Wallet clustering: The practice of grouping wallets that likely belong to the same actor based on transaction behaviour, timing, or shared service use. It helps investigators move from isolated addresses to behavioural patterns, which is often necessary to detect fraud, laundering, or coordinated market activity.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org