TL;DR: Cryptocurrency investigations are now intersecting with law enforcement, consumer protection, and AML/CTF enforcement as agencies seek better blockchain analysis tools, according to Chainalysis. The real issue is governance maturity: investigative capability matters less if identity, access, and case-handling controls lag behind the pace of crypto-enabled crime.
At a glance
What this is: This is a Chainalysis survey insight article showing that public sector crypto investigations are straining against a broader readiness gap across law enforcement, regulation, and compliance functions.
Why it matters: It matters because identity, access, evidence handling, and inter-agency governance all shape whether investigation teams can turn blockchain analysis into defensible action.
By the numbers:
- 300 public sector employees from 183 agencies shared their thoughts on cryptocurrency.
- Chainalysis says its 2020 Crypto Crime report was featured in the Wall Street Journal, The New York Times, Forbes, Fortune, and Bloomberg.
Context
Cryptocurrency investigations sit at the junction of financial crime, law enforcement, and compliance operations. The governance challenge is not simply whether agencies can trace transactions, but whether they can operationalise evidence, access, and coordination fast enough to keep pace with crypto-enabled crime.
For public sector teams, the identity angle appears in case handling, privileged access to investigative data, and the controls surrounding shared tooling and evidence workflows. The article frames that gap as a readiness issue, which is a typical problem for agencies building crypto capability across distributed teams.
Key questions
Q: What breaks when public sector crypto investigations lack case-scoped access?
A: When investigators use broad or shared access, evidence handling becomes harder to attribute, review, and defend. That weakens chain-of-custody and increases the chance that sensitive case material is exported, altered, or seen by the wrong people. Case-scoped access keeps investigative actions tied to a specific matter and a specific accountable user.
Q: Why do cryptocurrency cases create governance problems for public sector teams?
A: Crypto cases cross law enforcement, compliance, and consumer protection workflows, so the same evidence may need different retention, disclosure, and escalation rules. If teams do not align those rules in advance, operational speed drops and defensibility suffers. The governance problem is not just technical tracing, but coordination across multiple accountability models.
Q: What are the signs that crypto investigation access controls are too loose?
A: Common warning signs include pooled analyst accounts, ad hoc exports of case data, unclear approval paths for privileged actions, and poor visibility into who touched which artefact. Those symptoms usually mean the investigation stack has grown faster than the controls around it. In practice, the audit trail becomes harder to trust before the case is finished.
Q: Should agencies treat blockchain analytics as a stand-alone capability?
A: No. Blockchain analytics is valuable, but it only works as part of a broader operating model that includes identity governance, evidence handling, and cross-team coordination. Agencies that isolate the tool from those controls often end up with useful data that is difficult to operationalise. The better approach is to design the process around defensible use, not just data visibility.
Technical breakdown
Why blockchain analysis is only one part of investigation readiness
Blockchain analysis can identify transaction patterns, cluster addresses, and surface suspicious flows, but it does not by itself create an investigation-ready capability. Public sector teams still need chain-of-custody discipline, role-based access to case data, auditable collaboration, and clear handoffs between analysts, investigators, and legal stakeholders. In practice, the technical value of the tooling depends on governance around who can see what, when evidence is preserved, and how results are translated into admissible case material.
Practical implication: treat blockchain analysis as one control layer inside a larger investigative operating model, not as the operating model itself.
How crypto cases stress access control and case handling
Crypto investigations often span multiple agencies, jurisdictions, and specialist teams, which makes privileged access and evidence sharing harder to govern. If case systems rely on broad shared accounts, informal exports, or ad hoc access grants, the investigation trail becomes difficult to defend and easier to misuse. This is where identity governance matters: permissions must be scoped to the case, access should be time-bound, and investigative actions should be attributable to named users rather than pooled credentials.
Practical implication: use case-scoped access and attributable accounts so investigative actions remain traceable end to end.
Why public sector crypto work intersects with AML and consumer protection
The article makes clear that cryptocurrency is no longer relevant only to specialist cyber or fraud teams. It intersects with AML/CTF enforcement, consumer protection, and broader crime response, which means the investigative stack has to serve more than one policy objective. That expands the governance burden because the same evidence may support multiple workflows, each with different retention, disclosure, and review requirements. Agencies that treat crypto work as a narrow technical function will miss those downstream obligations.
Practical implication: align investigation workflows with the regulatory and evidentiary uses of the case, not just the technical trace.
Threat narrative
Attacker objective: The objective is to move illicit value or conceal criminal activity in ways that outpace public sector investigative and compliance controls.
- Entry occurs through cryptocurrency-related criminal activity that creates the investigative need, including scams, laundering, and other crypto-enabled offenses.
- Escalation happens when agencies need to coordinate across tools, jurisdictions, and teams without a mature access or case-handling model.
- Impact is delayed or weakened enforcement, with slower case closure and reduced confidence in the evidence trail.
Breaches seen in the wild
- Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Readiness gap is the right lens for public sector crypto investigations: the limiting factor is not whether agencies can access blockchain data, but whether they can govern that capability across access, evidence handling, and inter-agency collaboration. Crypto cases fail operationally when specialist analysis is not wrapped in identity and workflow controls. The practitioner takeaway is to measure investigation maturity, not just tool coverage.
Investigation governance now depends on attributable access: pooled accounts, informal exports, and broad privileges undermine defensible case work even when the analytical content is strong. This is an identity problem as much as an intelligence problem, because investigators need case-scoped access and auditability to preserve trust in the record. The practitioner takeaway is to make accountability part of the investigation design.
Cryptocurrency investigations expose governance debt across adjacent functions: law enforcement, consumer protection, and AML/CTF teams each impose different evidence, retention, and escalation requirements. A programme that treats crypto tracing as a standalone skill set will struggle when those obligations collide. The practitioner takeaway is to build operating models that connect crypto analytics to the controls surrounding disclosure, review, and retention.
Public sector crypto capability is becoming a cross-domain identity and access issue: the more agencies share data, tools, and cases, the more they need disciplined identity lifecycle management for analysts, contractors, and partner organisations. That includes offboarding, time-bound access, and reviewable privileged activity. The practitioner takeaway is to govern the human and non-human access paths around the investigation stack together.
Operational maturity will increasingly be judged by evidentiary resilience: agencies that cannot show who accessed what, when, and why will struggle to turn blockchain analysis into action that survives scrutiny. The named concept here is investigation readiness debt, meaning the gap between analytical capability and the governance needed to use it confidently. The practitioner takeaway is to close the governance gap before scaling the toolset.
What this signals
Investigation readiness debt: the real gap is between being able to trace crypto transactions and being able to use that tracing safely inside public sector workflows. As crypto cases move across agencies, governance has to cover access, evidence handling, and offboarding together or the operational burden grows faster than the investigative value.
The public sector should expect crypto investigations to become more identity-sensitive, not less. Case-scoped permissions, attributable analyst activity, and tightly controlled partner access will matter more as agencies share tools and outputs across law enforcement, compliance, and consumer protection work.
For practitioners
- Define case-scoped access models Limit blockchain investigation systems to named users, case-specific permissions, and explicit approval paths for elevated access. This reduces the risk that broad analyst access turns into uncontrolled evidence handling.
- Separate analytical access from evidentiary custody Ensure the people who trace transactions are not automatically the people who can alter, export, or dispose of evidence. That separation preserves chain-of-custody and makes reviews easier to defend.
- Time-bound partner and contractor access Set expiry dates on access for external analysts, shared service teams, and temporary case support staff. Public sector investigations often stall when offboarding is informal and stale access lingers.
- Standardise audit trails across investigation tools Record who queried wallet data, who exported case artefacts, and who approved escalations. Consistent logs make cross-agency collaboration safer and post-case review more reliable.
- Map crypto workflows to AML and consumer protection obligations Document which investigative outputs feed law enforcement, regulatory action, or consumer redress so retention, disclosure, and review steps match the downstream use of the evidence.
Key takeaways
- Public sector cryptocurrency investigations are being limited by governance maturity as much as by analytical capability.
- The article shows a broad readiness problem across law enforcement, AML/CTF enforcement, and consumer protection workflows.
- Agencies need case-scoped access, auditable evidence handling, and disciplined offboarding if they want crypto tracing to hold up operationally.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Public sector investigation access depends on tightly scoped permissions and attributable entitlements. |
| Recommendation — Apply PR.AA-05 to case systems so investigative access stays named, scoped, and reviewable. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle control is central where multiple agencies and temporary staff access investigation tools. |
| Recommendation — Use CIS-5 to remove stale analyst and partner accounts from crypto investigation platforms. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is directly relevant to preventing broad access from undermining evidence handling. |
| Recommendation — Enforce AC-6 so investigators receive only the access required for the active case. | ||
| MITRE ATT&CK | TA0006 — Credential Access | Credential misuse and uncontrolled access are core risks when investigation workflows lack discipline. |
| Recommendation — Map weak investigation account controls to TA0006 and prioritise privileged access monitoring. | ||
| GDPR | Art.32 — Security of Processing | When cases touch personal data, security of processing and access control become relevant to investigation handling. |
| Recommendation — Apply Article 32 controls to secure personal data used in crypto investigations. | ||
Key terms
- Blockchain Analysis: Blockchain analysis is the process of examining transaction data to infer relationships between wallets, entities, and financial flows. In investigations, it supports attribution and tracing, but it remains an analytical aid rather than proof on its own, so governance and corroboration still matter.
- Chain of custody: A documented record that preserves the integrity of evidence from the moment an event is detected through investigation and response. In identity and data protection workflows, it helps prove what happened, when it happened, and which actor or session was involved.
- Case-Scoped Access: Access limited to the data, systems, and time window required to handle a specific support case. For AI-assisted support, it is the control that prevents temporary troubleshooting from hardening into standing privilege after resolution.
- AML/CTF Enforcement: AML/CTF enforcement is the set of investigative and regulatory activities used to detect and disrupt money laundering and terrorism financing. In crypto contexts, it often requires sharing evidence across agencies, which increases the importance of access governance and retention discipline.
Deepen your knowledge
NHI Foundation Level course covers NHI governance, identity lifecycle, and secrets management through the industry's only accredited NHI security programme. It is designed for practitioners who need to connect access control to operational evidence and accountability.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org