Investigators should start from known donation addresses, then map the wallet cluster around them, including operational wallets, consolidation wallets, gas funding wallets, bridges, and exchanges. The key is to preserve transaction history across cases so earlier evidence can reveal new links later. Over time, this approach turns isolated transfers into a network view that supports attribution, disruption, and follow-on collection.
How investigators turn changing wallets into a usable network map
The practical problem is not finding a single wallet, but keeping continuity as actors rotate addresses and move through intermediaries. Investigators need to treat donation addresses, cluster expansion, and exchange touchpoints as one evolving evidence set, so later transactions can be linked back to earlier cases instead of being analysed as isolated events.
That means the unit of analysis is the network around the fundraiser, not the wallet label alone. Once the cluster is built, recurring patterns such as operational wallets, consolidation wallets, gas funding wallets, bridges, and exchange exits become the structure that ties fresh activity to prior evidence.
Why cluster preservation matters more than single-transaction tracing
Donation flows in cryptocurrency are deliberately designed to be noisy. Funds may be split, recombined, bridged, or cashed out through multiple services, so a narrow view of one address can miss the relationships that matter for attribution and disruption.
Preserving transaction history across cases lets analysts connect old evidence to new infrastructure as it appears. BitMart hot wallet hack 2021 is a useful reminder that wallet compromise and value movement often become clearer once analysts keep the broader wallet ecosystem in view, not just the initial theft address.
Investigators should also expect support infrastructure to matter. A fundraising cluster may depend on wallets that pay gas, wallets that consolidate proceeds, and exchange accounts that provide liquidity, and each of those can become a pivot point for identifying control, timing, or reuse.
What makes a fundraising network linkable in practice
The strongest links are usually behavioural, not cosmetic. Repeated reuse of funding sources, stable bridge patterns, coordinated exchange deposits, and consistent operational timing can all indicate that separate-looking wallets belong to the same activity set.
Those links become stronger when investigators preserve context from the surrounding environment, such as associated web infrastructure, donation messaging, and off-chain handling of the funds. Mailchimp breach 2022 shows why adjacent operational systems can matter, because exposed customer data and API keys can extend the investigative surface beyond the wallet itself.
For collection, the goal is to move from a list of transfers to a graph of relationships. That graph should record which wallets touched the same source, which routes repeatedly converged, and where the funds exited into services that may preserve records or generate new investigative leads.
Risk and Threat Considerations
Crypto fundraising networks are intentionally adaptive, so the main risk is analytic fragmentation: if investigators treat each wallet change as a fresh case, they can lose continuity and miss the control points that reveal ownership, infrastructure reuse, or cash-out behaviour.
Failure mechanism: Actors rotate wallets, bridge assets, and route through exchanges to break simple address-based tracing, while gaps in case linkage allow earlier intelligence to be discarded instead of re-used against the same network.
Impact: Evidence value decays quickly, attribution becomes weaker, disruption opportunities are missed, and investigators may fail to identify the operational wallets and service chokepoints that connect multiple fundraising rounds.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1020 — Data Exfiltration | Tracing fund movement relies on following repeated transfer patterns and staging across systems. |
| Recommendation — Map repeated wallet reuse and transfer staging to adversary collection patterns in your hunting workflow. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerabilities Are Identified And Documented | Wallet clusters and exchange touchpoints are operational assets that need documented risk context. |
| Recommendation — Document wallet clusters, bridges, and exchange exit points as risk-relevant assets. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, And Reporting | Investigators need transaction-history review and correlation across cases to preserve evidence value. |
| Recommendation — Correlate transaction records across cases and retain them for recurring-link analysis. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Network tracing depends on preserving and analysing transaction and case history over time. |
| Recommendation — Keep transaction and case records centralized so older evidence remains searchable. | ||
| OWASP Non-Human Identity Top 10 | NHI-09 — NHI Reuse | Repeated wallet and infrastructure reuse is a key pattern in changing cryptocurrency fundraising networks. |
| Recommendation — Watch for repeated reuse of wallets, bridges, and exchange paths across campaigns. | ||
Practitioner Guidance
What to prioritise: Start with the donation address, then immediately expand to the neighbouring cluster and preserve every wallet that shows operational, consolidation, gas, bridge, or exchange behaviour. That preserves the evidence path even when the actor rotates primary donation addresses.
What to verify: Check whether the same funding source, bridge pattern, or exchange exit appears across separate incidents or campaigns before treating a wallet as new. If the same movement pattern recurs, it should be analysed as a continuing network lead, not a fresh one-off transfer.
Practitioner takeaway: The most useful investigative habit is to maintain continuity across cases, because the network view often emerges only after several seemingly unrelated wallet changes are stitched back together.
Related resources from NHI Mgmt Group
- Cryptocurrency Fundraising
- Trace
- How should investigators use blockchain analysis to trace illicit cryptocurrency proceeds across dormant wallets and exchanges?
- How should investigators combine blockchain analytics with traditional casework to trace stolen cryptocurrency across exchanges and mixers?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org