Cryptocurrency and Technology-Facilitated Financial Crime

Introduction and Context

Cryptocurrency and related digital-asset technologies have changed how value is stored, transferred and exchanged. They support legitimate activities such as cross-border payments, investment, fundraising and digital commerce. The same features—speed, global reach, pseudonymous identifiers, programmable transfers and limited dependence on traditional intermediaries—can also facilitate fraud, money laundering, sanctions evasion, ransomware payments and extortion.

The legal and investigative challenge is not that cryptocurrency is inherently criminal. Rather, criminal misuse occurs when lawful technologies are combined with unlawful conduct, weak controls, deceptive representations or concealment techniques. Effective cyber-law practice therefore requires both technical literacy and legal analysis. Investigators must understand how transactions move through wallets and services, while compliance officers must identify suspicious behaviour without treating every digital-asset user as criminal.

This chapter introduces the principal technologies, criminal methods, tracing techniques, know-your-customer (KYC) controls and reporting duties relevant to technology-facilitated financial crime. Specific obligations differ by jurisdiction; practitioners must consult applicable statutes, regulators and supervisory guidance.

Learning Objectives

By the end of this chapter, a student should be able to:

1. Distinguish wallets, exchanges, tokens, mixers and decentralised services.
2. Explain how digital assets can facilitate laundering, fraud and extortion.
3. Describe the basic logic of blockchain transaction tracing.
4. Explain the purpose and limits of KYC, customer due diligence and transaction monitoring.
5. Identify common reporting, preservation and governance obligations.
6. Assess ethical and legal risks in investigating digital-asset activity.

1. Essential Concepts and Terminology

1.1 Blockchain and distributed ledgers

A blockchain is a distributed ledger in which transactions are recorded in ordered blocks and validated according to a protocol. Public blockchains commonly allow anyone to inspect transaction data, although the identity behind an address may not be immediately visible. A transaction normally identifies inputs, outputs, amounts, fees and cryptographic signatures. The ledger records control of assets; it does not necessarily reveal the legal identity, purpose or beneficial owner of the participants.

Some networks are permissionless, meaning that participation is broadly open. Others are permissioned and restrict validation or access. This distinction matters legally: a permissionless public ledger may be highly transparent but difficult to attribute to a person, whereas a permissioned system may offer stronger identity controls but less public visibility.

1.2 Wallets and keys

A wallet is software, hardware or a service used to manage cryptographic keys and construct transactions. The asset itself is not stored inside the wallet; ownership or control is represented by ledger entries associated with addresses.

A private key authorises transactions. A public key or address is used to receive assets. In a custodial wallet, an exchange or other provider controls the private keys on behalf of customers. In a non-custodial wallet, the user controls the keys directly. Loss of a private key can mean permanent loss of access. Theft, coercion, malware and social engineering can transfer control without changing the victim’s legal entitlement.

The distinction between custody and control is important in investigations. An address does not automatically identify an individual, and possession of a device does not always prove ownership of its keys. Evidence may include exchange records, recovery phrases, authentication logs, device artefacts, communications and admissions.

1.3 Exchanges and brokers

Centralised exchanges match buyers and sellers, hold customer accounts and often convert digital assets into government-issued currency. They are important investigative points because they generally maintain account information, login records, deposit and withdrawal records, device information and KYC documents. Decentralised exchanges (DEXs) use smart contracts to facilitate trades without a conventional central order book or custodian. A DEX may not have a single operator capable of producing ordinary customer records, although developers, front-end providers, liquidity providers or other service participants may hold relevant information.

1.4 Coins, tokens and stablecoins

A coin is generally native to its own blockchain. A token is created on an existing blockchain through a protocol or smart contract. Tokens may represent utility, governance rights, an investment interest, access rights or claims on another asset. Stablecoins seek to maintain a relatively stable value against a reference asset, often a national currency, but their stability depends on reserves, governance, redemption arrangements and market confidence.

Legal classification varies. A digital asset may be treated as property, a financial instrument, electronic money, a commodity, a payment instrument or an unregulated asset depending on the jurisdiction and facts. Classification affects licensing, disclosure, custody and reporting duties.

1.5 Mixers and privacy-enhancing services

A mixer or tumbler pools digital assets from multiple users and returns assets through a process intended to make transaction links more difficult to follow. Privacy-enhancing technologies may also include shielded transactions, coin-joining mechanisms, anonymous networks and cross-chain bridges. Privacy is not itself unlawful, and legitimate users may seek confidentiality. However, deliberate concealment of criminal proceeds, evasion of sanctions or obstruction of an investigation may create criminal or regulatory exposure.

Mixing is an investigative complication rather than proof of guilt. Analysts should examine the complete context, including source of funds, timing, amounts, service risk, communications and subsequent cash-out activity.

1.6 Smart contracts and decentralised services

A smart contract is computer code deployed on a blockchain that executes specified functions when called. It may exchange tokens, issue assets, provide lending, manage governance or hold funds. “Decentralised” does not mean ownerless, risk-free or beyond law. Administrative keys, upgrade functions, concentrated voting power, websites, hosting providers and front-end interfaces may create practical control points.

A vulnerability, malicious code or compromised private key can cause large-scale losses. The legal issues may include fraud, unauthorised access, breach of fiduciary duty, consumer protection violations and liability for misleading statements.

2. How Digital Assets Facilitate Financial Crime

2.1 Money laundering

Money laundering is commonly analysed through three broad stages: placement, layering and integration. The stages are conceptual rather than mandatory. Criminal proceeds may enter a digital-asset ecosystem through a broker, cash-conversion service, stolen payment card, fraudulent investment platform or ransomware payment. Layering may involve rapid transfers, multiple wallets, swaps between assets, cross-chain bridges, peer-to-peer trades and mixers. Integration may occur when assets are sold through an exchange, used to purchase goods, deposited into a bank account or invested in an apparently legitimate enterprise.

Digital assets can accelerate these processes because transfers may be global, continuous and divisible. Yet blockchains can also preserve a permanent or semi-permanent transaction history. The resulting tension is central: identity may be obscured while movement remains visible.

2.2 Fraud and investment schemes

Common schemes include fake exchanges, Ponzi arrangements, romance-investment fraud, impersonation, token-sale deception, pump-and-dump manipulation, phishing and “pig-butchering” operations. Victims may be instructed to transfer assets to a wallet or to connect their wallet to a malicious smart contract. Fraudsters often display fabricated profits, impose false withdrawal taxes or use fabricated regulatory credentials.

A transaction authorised by a victim is not necessarily consensual in a meaningful legal sense. Deception, coercion and manipulation can vitiate apparent consent. Investigators should preserve the communications and interface through which the victim was induced to act, not merely the blockchain transaction.

2.3 Ransomware and extortion

Ransomware actors encrypt systems or threaten to release stolen information and demand payment, frequently in digital assets. Extortion may involve threats against individuals, hospitals, universities or businesses. The relevant evidence may include ransom notes, negotiation chats, malware logs, endpoint data, wallet addresses and exchange activity.

Payment can create difficult decisions. An organisation may need to consider safety, operational continuity, sanctions, reporting duties, insurance conditions and the risk of encouraging further attacks. Payment does not guarantee decryption or deletion of copied data. A response should be coordinated with legal counsel, incident responders, law enforcement and relevant regulators.

2.4 Theft and unauthorised access

Criminals may steal seed phrases, exploit exchange accounts, compromise cloud storage, manipulate SIM cards or exploit smart-contract vulnerabilities. Asset recovery depends on speed. Transfers may be irreversible, but an exchange or custodian may be able to freeze assets if notified before withdrawal or conversion. Unauthorised access, unlawful interception, fraud and computer misuse laws may apply in addition to property offences.

3. Transaction Tracing and Attribution

3.1 The tracing process

Transaction tracing is the reconstruction and interpretation of value movement. A defensible workflow generally includes:

1. Preservation: Record addresses, transaction identifiers, timestamps, screenshots, URLs, communications and relevant devices. Preserve original data and document collection methods.
2. Extraction: Obtain ledger data from reliable nodes, explorers, service providers or specialist tools. Record the source, time of access and network used.
3. Normalisation: Convert timestamps, asset denominations and transaction formats into a consistent analytical record.
4. Graph construction: Represent addresses, transactions and services as nodes and edges. Identify inputs, outputs, fees, swaps and bridges.
5. Clustering: Form hypotheses about addresses controlled by the same entity using technical and behavioural indicators.
6. Service identification: Determine whether an address belongs to an exchange, broker, mixer, gambling service, scam infrastructure or legitimate business.
7. Attribution: Link blockchain activity to real-world actors using KYC records, IP logs, device information, communications, payment records and witness evidence.
8. Corroboration and reporting: Test alternative explanations, state confidence levels and distinguish observed facts from analytical inferences.

A transaction graph can show that assets moved from Address A to Address B. It does not, by itself, prove who controlled either address, why the transfer occurred or whether a criminal offence was committed.

3.2 Common analytical techniques

Analysts may examine temporal proximity, repeated transaction amounts, common spending patterns, address reuse, consolidation of funds, deposit addresses and interaction with known services. Heuristics can be useful but are probabilistic. For example, several inputs spent together may suggest common control in some account-based or UTXO-based systems, but shared custody arrangements, exchange batching and privacy tools can produce misleading patterns.

Cross-chain analysis is particularly difficult. A bridge may lock an asset on one network and issue a corresponding representation on another. Swaps may change the asset while preserving economic value. Investigators must track the relationship between the original and resulting assets rather than treating each chain as isolated.

3.3 Limits of tracing

Tracing may be obstructed by mixers, privacy coins, off-chain transactions, peer-to-peer trades, chain reorganisations, poor data quality, false service labels and jurisdictional barriers. Analysts must avoid overstating certainty. A professional report should identify methodology, assumptions, data gaps, error risks and the difference between an address, a wallet, an account and a person.

4. KYC, Customer Due Diligence and AML Controls

4.1 Purpose of KYC

KYC controls help a regulated entity know who its customer is, understand the purpose and expected nature of the relationship, identify beneficial owners and assess risk. KYC is not a guarantee that a customer is honest. It is one part of a broader risk-based anti-money-laundering and counter-terrorist-financing (AML/CFT) system.

A risk-based approach allocates greater scrutiny to higher-risk relationships while avoiding unjustified exclusion of entire populations. Relevant factors may include customer type, geography, products, delivery channels, transaction size and complexity, use of privacy-enhancing services, exposure to sanctions and inconsistency with the customer’s stated activity.

4.2 A practical control framework

Enhanced due diligence may be appropriate for politically exposed persons, high-risk jurisdictions, complex ownership, unusually large transfers, unexplained mixer exposure or activity inconsistent with a customer’s profile. Controls should be lawful, proportionate and periodically reviewed.

4.3 Transaction monitoring

Monitoring rules may identify rapid movement through newly opened accounts, repeated deposits followed by immediate withdrawals, exposure to known scam addresses, unexplained use of mixers, unusual cross-border activity, sudden changes in transaction size or many accounts controlled from a common device. No single alert proves criminality. Human review, contextual information and quality assurance are essential.

A useful internal distinction is between an alert, an investigation and a report. An alert is a system-generated signal; an investigation is a documented assessment; a report is a formal notification made when the legal threshold is met.

4.4 Reporting and preservation obligations

Depending on the jurisdiction, virtual-asset service providers may be required to register or license, conduct KYC, maintain records, file suspicious transaction or activity reports, comply with targeted financial sanctions, respond to lawful information requests and implement a travel rule requiring certain originator and beneficiary information to accompany transfers.

A report normally states relevant facts, dates, parties, assets, addresses, transaction identifiers, reasons for suspicion and supporting records. It should not disclose the report to the customer where law prohibits “tipping off.” Organisations should preserve relevant data under legal hold procedures and follow privacy and data-protection requirements. Reporting is not a substitute for immediate operational action: where permitted, an institution may need to freeze or delay a transaction and contact law enforcement.

5. Illustrative Case Study: The Silver Horizon Investment Scam

This is a fictional illustrative case.

Background

Silver Horizon advertised guaranteed weekly returns from an automated cryptocurrency-trading system. Victims were directed to a professional-looking website and a messaging group containing fabricated profit statements. After depositing stablecoins, victims saw account balances increase but were required to pay a “tax” before withdrawal.

Problem

A victim transferred 18,000 units of a stablecoin to an address supplied by a promoter. The promoter then moved the funds through several addresses, exchanged part of them for another asset and transferred the remainder to two centralised exchanges.

Analysis

Investigators preserved the website, chat records, domain-registration information and wallet addresses. Ledger analysis showed that deposits from more than 30 victims entered a common collection address. Funds were divided into regular amounts and moved within minutes to intermediary addresses. The pattern suggested organised collection and layering, but did not alone identify the operators.

Legal requests to the exchanges produced KYC records, login IP addresses, device identifiers and withdrawal destinations. One account was registered using a false identity but accessed from an IP address associated with the website administrator. Bank records showed payments for advertising and domain services. The investigators treated the blockchain clustering as an investigative lead and relied on exchange and communications evidence for attribution.

Approach and outcome

The exchange compliance teams placed lawful holds on assets still within their control and filed the required suspicious-activity reports. Investigators obtained preservation orders and coordinated across jurisdictions. The evidence supported allegations of fraud, unlawful handling of proceeds and operation of an unlicensed financial service, subject to prosecutorial assessment.

Learning points

1. A polished interface does not establish legitimacy.
2. Stablecoins can move quickly and retain traceable ledger histories.
3. Blockchain evidence is strongest when corroborated by service-provider and communications evidence.
4. Early preservation and notification can improve recovery prospects.
5. Suspicion must be documented objectively; clustering is not equivalent to proof of identity.

6. Governance, Ethics and Contemporary Developments

Digital-asset investigations create tensions between public safety, privacy, innovation and due process. Excessive surveillance can chill lawful financial privacy. Inadequate controls can expose victims and the financial system to serious harm. Organisations should apply necessity, proportionality, purpose limitation, access controls and retention limits when processing identity and transaction data.

Artificial intelligence is increasingly used to classify addresses, detect anomalies, prioritise alerts and identify patterns across large transaction graphs. Its output should be treated as decision support, not automatic proof. Models may reproduce biased assumptions, generate false positives, fail when criminals change behaviour and lack explainability. Human review, documented thresholds, validation data, audit trails and appeal mechanisms are important safeguards.

Contemporary developments include tokenised real-world assets, central-bank digital-currency experiments, privacy-preserving computation, decentralised finance, cross-chain protocols and increased regulatory focus on stablecoin issuers and virtual-asset service providers. These developments do not eliminate established legal principles. Questions of jurisdiction, beneficial ownership, custody, consumer protection, evidence and accountability remain central.

7. Best Practices for Professionals

Professionals working with digital-asset crime should:

• preserve volatile evidence quickly and record chain of custody;
• distinguish addresses, wallets, accounts, services and people;
• use reliable data sources and document analytical assumptions;
• corroborate blockchain findings with independent evidence;
• apply risk-based rather than purely rule-based compliance;
• maintain current sanctions, KYC and suspicious-activity procedures;
• escalate ransomware and extortion decisions to legal and incident-response specialists;
• protect confidential customer and investigative information;
• avoid tipping off subjects where prohibited;
• train staff to recognise phishing, impersonation and social-engineering tactics; and
• state uncertainty honestly in reports and testimony.

Challenges and Limitations

The main difficulties are pseudonymous identity, cross-border jurisdiction, inconsistent regulation, rapidly changing technologies, irreversible transfers, fragmented evidence and the risk of both under-enforcement and over-enforcement. A public address may be controlled by an exchange, a criminal group, a victim, a software service or several users. Privacy tools may conceal links without proving unlawful intent. Conversely, a transparent ledger may reveal activity without providing admissible evidence of identity or purpose.

Sound practice therefore combines technical tracing, financial investigation, legal process, international cooperation, privacy protection and careful evidential reasoning.

Chapter Summary

Cryptocurrency systems are neutral technologies that can support legitimate finance and criminal activity. Wallets manage keys; exchanges provide conversion and custody; tokens represent varied rights; mixers and privacy tools can complicate tracing; and smart contracts automate decentralised services. Criminals may use these systems for laundering, fraud, ransomware, extortion and theft.

Transaction tracing reconstructs movement but does not automatically establish identity or criminal intent. Strong investigations combine ledger analysis with KYC records, device and login evidence, communications, financial records and lawful process. KYC, beneficial-owner checks, sanctions screening, transaction monitoring, record retention and suspicious-activity reporting form the core of risk-based AML controls. Ethical practice requires proportionality, privacy protection, transparency about uncertainty and human oversight of analytical technologies.

Key Terms

Blockchain: A distributed ledger that records transactions in an ordered and validated structure.

Wallet: Software, hardware or a service used to manage cryptographic keys.

Private key: Secret cryptographic material used to authorise a transaction.

Address: A ledger identifier used to send or receive digital assets.

Custodial wallet: A wallet in which a service provider controls the private keys.

Non-custodial wallet: A wallet in which the user controls the private keys.

Exchange: A service that facilitates trading or conversion of digital assets.

Token: A digital unit issued on an existing blockchain.

Stablecoin: A digital asset designed to maintain value relative to a reference asset.

Mixer: A service intended to make links between incoming and outgoing assets more difficult to trace.

Smart contract: Blockchain-deployed code that executes programmed functions.

Decentralised exchange: A trading service operated primarily through smart contracts rather than a conventional central intermediary.

Money laundering: Concealing or disguising the origin, ownership or movement of criminal proceeds.

KYC: Know-your-customer procedures used to identify and understand customers.

Beneficial owner: The natural person who ultimately owns or controls an entity or arrangement.

Customer due diligence: Measures used to identify customers, assess risk and monitor relationships.

Transaction monitoring: Review of activity to identify unusual or suspicious patterns.

Suspicious-activity report: A legally prescribed report concerning suspected financial crime.

Travel rule: A requirement in some regimes for specified originator and beneficiary information to accompany transfers.

Blockchain clustering: Analytical grouping of addresses believed, subject to uncertainty, to share common control.

Review Questions

Short Answer Questions

1. What is the difference between a custodial and a non-custodial wallet?
2. Why does a public blockchain provide transparency but not necessarily identity?
3. What are the conceptual stages of money laundering?
4. What is the purpose of beneficial-owner identification?
5. Why should blockchain analysis be corroborated with other evidence?

Long Answer Questions

1. Explain how exchanges, mixers and cross-chain bridges can facilitate or complicate financial-crime investigations.
2. Describe a complete transaction-tracing workflow from preservation to attribution.
3. Discuss the role and limitations of KYC and transaction monitoring in a risk-based AML programme.
4. Explain the legal and operational issues raised by ransomware payments in digital assets.
5. Evaluate the privacy, fairness and accountability issues associated with AI-assisted blockchain analytics.

Analytical / Application Questions

1. A new customer deposits digital assets from several unrelated addresses, sends most funds through a privacy-enhancing service and withdraws to a newly created exchange account. What facts should a compliance analyst examine before deciding whether to escalate or report the activity?
2. A victim authorises a transfer after being deceived by a fraudulent investment platform. Analyse the evidence needed to distinguish an ordinary transaction from fraud and to attribute the receiving addresses.
3. An investigator identifies a cluster of addresses that appears to receive proceeds from an extortion campaign. Explain the analytical limits of the cluster and propose independent evidence required for a defensible legal conclusion.

Multiple Choice Questions with Answers

Question 1

Which statement best describes a non-custodial wallet?

A. The exchange permanently owns the customer’s assets

B. The user controls the private keys

C. The blockchain is operated by a government

D. The wallet prevents all transaction tracing

Correct Answer: B. The user controls the private keys

Question 2

What does a public blockchain generally reveal most directly?

A. The legal identity of every user

B. The purpose of every transaction

C. Recorded transaction movements and amounts

D. The criminal intent of participants

Correct Answer: C. Recorded transaction movements and amounts

Question 3

Which activity is most closely associated with layering?

A. Entering criminal proceeds into the financial system

B. Moving proceeds through multiple transactions and services

C. Using legitimate proceeds to buy ordinary goods

D. Verifying a customer’s identity

Correct Answer: B. Moving proceeds through multiple transactions and services

Question 4

What is the primary purpose of KYC controls?

A. To guarantee that no customer commits a crime

B. To identify customers and understand the relationship’s risk

C. To make all transactions anonymous

D. To replace transaction monitoring

Correct Answer: B. To identify customers and understand the relationship’s risk

Question 5

Why is a blockchain address not automatically proof of a person’s identity?

A. Addresses cannot receive assets

B. Addresses are only used by banks

C. Control of an address must be linked to real-world evidence

D. Blockchain records are never permanent

Correct Answer: C. Control of an address must be linked to real-world evidence

Question 6

Which is an appropriate use of AI in blockchain compliance?

A. Automatically convicting every customer flagged by a model

B. Prioritising alerts for human investigation

C. Replacing all legal procedures

D. Deleting records after classification

Correct Answer: B. Prioritising alerts for human investigation

Question 7

What is a mixer primarily designed to do?

A. Verify beneficial ownership

B. Increase the difficulty of linking incoming and outgoing transactions

C. Guarantee stable asset prices

D. Provide government-issued identity documents

Correct Answer: B. Increase the difficulty of linking incoming and outgoing transactions

Question 8

Which evidence would most directly assist attribution of an exchange account?

A. A random blockchain address

B. A general market-price chart

C. KYC records and account access logs

D. The existence of a transaction fee

Correct Answer: C. KYC records and account access logs

Question 9

What is the correct relationship between an alert and a suspicious-activity report?

A. Every alert automatically proves criminality

B. An alert may lead to investigation and, where justified, a report

C. A report must be filed before any alert is reviewed

D. Alerts and reports are legally identical in every jurisdiction

Correct Answer: B. An alert may lead to investigation and, where justified, a report

Question 10

Why should analysts state uncertainty in a tracing report?

A. Because ledger data has no evidential value

B. Because clustering and attribution are often analytical inferences

C. Because transactions cannot be recorded

D. Because KYC evidence is always unreliable

Correct Answer: B. Because clustering and attribution are often analytical inferences