Crypto crime now produces billions in reported losses each year, and the people who can follow stolen funds across blockchains, bridges and exchanges are in short supply in law enforcement, exchanges and analytics firms alike. The FBI's Internet Crime Complaint Center (IC3) 2024 report recorded 149,686 cryptocurrency-related complaints with reported losses of about US$9.3 billion, of which crypto investment fraud alone accounted for about US$5.8 billion. This guide explains what crypto investigators (also called blockchain investigators, on-chain analysts or crypto tracing analysts) actually do, the skills and tools the work needs, the routes in from policing, AML, cyber security and data roles, which certifications help, and how careers progress. It is for analysts, investigators and security practitioners considering the move. It does not give salary figures, because no official statistics body publishes data for this specialism.
Key takeaways
- The job is financial investigation on a public ledger: tracing is the visible part, but most of the value comes from linking addresses to real-world entities and producing evidence others can act on.
- Three main employer types: law enforcement and government agencies, virtual asset service providers (exchanges, custodians, payment firms) and blockchain analytics or incident response firms, with banks and consultancies as a fourth.
- AML knowledge matters as much as blockchain knowledge: FATF Recommendation 15, travel rule obligations and sanctions screening (OFAC lists digital currency addresses on the SDN List) frame most exchange and compliance work.
- Routes in are varied: fraud and financial crime analysts, police detectives, DFIR analysts and data analysts all move across, usually by adding on-chain skills to an existing investigative base.
- Write-ups decide outcomes: a trace that cannot be explained to a prosecutor, a court or a compliance committee rarely leads to a freeze, seizure or account action.
What the role does
Crypto investigators follow value on public blockchains and connect it to people, services and accounts. Bitcoin and Ethereum record every transaction publicly, so a trace can start from a transaction hash or wallet address supplied by a victim. IC3 tells victims to report wallet addresses, amounts and types of cryptocurrency, transaction hashes and dates and times, and notes that Bitcoin and Ethereum transaction hashes are 64 characters while Ethereum addresses are 42 characters including the "0x" prefix. That is often the raw material an investigator starts with.
Typical work by setting
| Setting | Typical job titles | Main tasks | Output |
|---|---|---|---|
| Law enforcement and government | Cryptocurrency investigator, financial investigator, cybercrime detective | Tracing proceeds of fraud, ransomware and darknet sales; identifying cash-out points; preparing production orders and seizure requests to exchanges | Evidence packs, witness statements, seizure and forfeiture support |
| Exchanges and VASPs | Crypto compliance analyst, financial intelligence unit analyst, investigations analyst | Transaction monitoring alerts, exposure to sanctioned or illicit addresses, law enforcement request handling, suspicious activity reporting | Case decisions, suspicious activity reports, account restrictions, blocked-asset reports |
| Analytics and incident response firms | Blockchain intelligence analyst, investigations consultant | Attributing addresses to services and threat actors, tracing hacks of protocols and exchanges, supporting victims and their counsel | Attribution data, incident reports, expert evidence |
| Banks and consultancies | Financial crime analyst (digital assets), forensic accountant | Assessing customer exposure to crypto, investigating fiat on-ramps and off-ramps, asset tracing in litigation and insolvency | Risk assessments, investigation reports |
Common case types
- Investment and romance fraud: crypto investment fraud alone produced 41,557 complaints and about US$5.8 billion in reported losses in the IC3 2024 report, often involving victims sending funds to fake trading platforms. See the Crypto Scam and Drainer Guide.
- Exchange and protocol hacks: tracing stolen funds through swaps, bridges and mixers, usually racing to alert exchanges before cash-out. Compromised signing keys and hot wallet credentials are a recurring root cause: see the Crypto Exchange Breaches Signing Path Lessons Guide.
- Ransomware payments: following ransom proceeds to identify affiliates and laundering services.
- Sanctions exposure: identifying direct or indirect exposure to addresses on sanctions lists. OFAC's FAQs state that its address listings are not likely to be exhaustive, so investigators look beyond list matches.
- Scam ATMs and cash-out: linking kiosk deposits to scam wallets. See the Crypto ATM Scams Guide.
Core skills and tools
| Skill area | What it involves | How to build it |
|---|---|---|
| Blockchain fundamentals | UTXO model (Bitcoin) versus account model (Ethereum), transaction structure, smart contracts, tokens, layer 2 networks | Read raw transactions in public block explorers; follow a known public case end to end |
| Tracing techniques | Address clustering heuristics, change address identification, peel chains, following funds across swaps and bridges | Practice on documented public incidents; vendor training on analytics tools |
| Attribution and OSINT | Linking addresses to services, domains, social accounts and infrastructure, with confidence levels stated | OSINT training; disciplined note-taking and source recording |
| AML and sanctions | FATF standards for virtual assets (R.15), travel rule, suspicious activity reporting, OFAC sanctions screening and blocking | CAMS or CCAS study; reading FATF and OFAC primary guidance |
| Evidence handling | Reproducible traces, chain of custody for seized devices and keys, documenting tool versions and data sources | Digital forensics fundamentals; court or disclosure experience |
| Data skills | SQL or Python against blockchain datasets, graph analysis, spreadsheet discipline at scale | Public blockchain datasets and node data; small personal projects |
| Communication | Explaining a trace to a non-technical audience, writing reports that survive challenge | Peer review of reports; presenting cases internally |
Tool categories
- Block explorers: free public views of transactions and addresses for each chain; the starting point for any trace and a way to verify what commercial tools show.
- Blockchain analytics platforms: commercial tools that cluster addresses, label services and visualise flows across chains. Employers usually provide and train on these; attribution labels are the vendor's assessment and should be stated as such in reports.
- Sanctions and screening data: the OFAC SDN List, where listed addresses appear in a "Digital Currency Address" field followed by the currency symbol (for example XBT or ETH), and equivalent lists from other authorities.
- Case management and graph tools: for linking on-chain findings with off-chain records such as exchange account data and communications.
The detection side of the same discipline, used by exchanges and protocols to spot suspicious flows in real time, is covered in the On-Chain Monitoring Guide.
Routes into the role
| Starting point | What you bring | What to add |
|---|---|---|
| AML or fraud analyst | Investigation method, suspicious activity reporting, regulatory context | Blockchain mechanics, tracing practice, CCAS or vendor tool training |
| Police detective or financial investigator | Evidence standards, interviewing, legal powers and process | On-chain tracing, exchange request processes, technical vocabulary |
| DFIR or SOC analyst | Forensic discipline, malware and ransomware knowledge, log analysis | AML and sanctions rules, financial investigation reporting |
| Data analyst or engineer | SQL, Python, graph analysis | Investigative judgement, AML context, report writing |
| Graduate | Fresh technical or legal study | A portfolio of documented public traces and an entry role in exchange compliance |
Exchange compliance teams are the most common entry point because they hire at analyst level and expose new staff to high case volumes. Law enforcement routes usually require first joining as an officer or civilian investigator and then specialising: the US Bureau of Labor Statistics notes that detectives in large departments often specialise in a crime type such as fraud. For adjacent careers, see the AML and Financial Crime Analyst Career Guide and the DFIR Analyst Career Guide.
Building a portfolio
- Pick a well-documented public incident with published transaction hashes.
- Reproduce the trace in a block explorer, recording each hop and why you followed it.
- Mark where your confidence drops (mixers, bridges, exchange deposits) and say so.
- Write a two-page report for a non-technical reader, with a flow diagram.
- Keep it factual: do not publish allegations about identifiable individuals.
Certifications that help
No single credential is required. Employers value demonstrable tracing skill, but certifications help with screening and with structured learning.
| Certification type | Examples | Best for |
|---|---|---|
| Cryptoasset financial crime | ACAMS Certified Cryptoasset Anti-Financial Crime Specialist (CCAS): see the CCAS Certification Guide | Exchange compliance and bank roles |
| General AML | ACAMS CAMS: see the CAMS Certification Guide | Anyone moving from outside financial crime |
| Fraud examination | ACFE Certified Fraud Examiner: see the CFE Certification Guide | Investigators handling fraud cases and litigation support |
| Analytics tool certifications | Product certifications run by blockchain analytics vendors for their own platforms | Analysts whose employer uses that platform; they prove tool fluency rather than independent method |
| Digital forensics | Forensics credentials covered in the Digital Forensics (DFIR) Guide | Seized device and wallet recovery work |
Check each certifying body's own pages for current exam format, fees and renewal before committing: details change, and some crypto credentials are new.
Progression
- Analyst: works alerts and straightforward traces under review; learns tools and reporting standards.
- Investigator: owns complex cases (hacks, cross-chain laundering), handles law enforcement liaison, writes reports relied on externally.
- Senior or lead investigator: sets methods and quality standards, reviews others' work, may give expert evidence.
- Head of investigations or FIU lead: runs the team, owns relationships with regulators and agencies, shapes monitoring policy.
- Side moves: threat intelligence on crypto-focused threat actors, product roles at analytics firms, policy and regulatory roles, and incident response for exchanges and protocols.
Labour market data for this exact specialism is not published by official statistics bodies. For context, the US Bureau of Labor Statistics projects employment of detectives and criminal investigators overall to stay roughly flat between 2025 and 2035 (about 120,500 to about 120,700), so growth in crypto investigation roles is more likely in the private sector and specialist units than in overall police numbers.
Ethics and safety in the role
- Recovery scams: IC3 warns victims to be wary of cryptocurrency recovery services, especially those charging up-front fees, and states it does not work with non-law-enforcement entities to recover funds. Legitimate investigators do not promise recovery.
- Attribution discipline: state confidence levels, separate on-chain facts from vendor labels, and avoid naming individuals without evidence.
- Personal security: investigators of organised fraud and ransomware groups should keep a low public profile and separate personal and work identities.
- Handling seized keys: seed phrases and private keys are bearer assets; dual control and documented custody apply. See the Crypto Wallet Security Guide.
Practitioner checklist
- Learn the UTXO and account models well enough to read raw transactions in a block explorer.
- Reproduce at least two documented public traces and write them up.
- Read FATF guidance on virtual assets and the OFAC virtual currency FAQs.
- Add an AML credential (CAMS or CCAS) if you come from outside financial crime.
- Build SQL or Python skills against a public blockchain dataset.
- Practise explaining a trace to a non-technical reader in two pages.
- Learn evidence and chain of custody rules for your jurisdiction.
- Target entry roles in exchange compliance or financial crime units if direct investigator roles are not open.
Standards and references
- FBI IC3: 2024 Internet Crime Report
- FBI IC3: Cryptocurrency crime information
- FATF: Virtual assets
- US Treasury OFAC: Questions on virtual currency
- US Bureau of Labor Statistics: Police and Detectives
- Europol: European Cybercrime Centre (EC3)
Related NHI Mgmt Group resources: On-Chain Monitoring Guide · Crypto Crime Statistics Guide · Crypto Travel Rule Compliance Guide · CCAS Certification Guide