The blockchain is a permanent public record
When you send Bitcoin, that transaction is broadcast to thousands of computers simultaneously and recorded in a public database called the blockchain. This record includes the sending address, the receiving address, the amount, and the timestamp. It cannot be altered, deleted, or hidden.
Every single Bitcoin transaction ever made — from the very first block in 2009 to transactions happening right now — is publicly viewable by anyone. You do not need special access or permissions. Tools like Blockstream.info allow anyone to look up any address or transaction in seconds.
This is the fundamental reason why Bitcoin is a poor choice for sophisticated money laundering, despite its reputation. Cash is far more anonymous. The blockchain provides investigators with a permanent, detailed audit trail that conventional financial investigation rarely enjoys.
What "addresses" are and why they matter
A Bitcoin address is a string of letters and numbers, typically starting with 1, 3, or bc1. It functions like a bank account number — funds can be sent to it, and the balance and complete transaction history are publicly visible to anyone who looks it up.
A person can control thousands of addresses, and professional investigators use clustering techniques to identify which addresses are controlled by the same person or organisation. The most powerful of these is the common input ownership heuristic — when multiple addresses are used as inputs to a single transaction, they are almost certainly controlled by the same entity.
How tracing actually works
A professional blockchain trace starts from a known address — typically the address a victim sent funds to — and follows the movement of funds forward through subsequent transactions. This is known as forward tracing.
At each step, the investigator identifies:
- Where funds were sent next
- Whether the receiving address is attributed to a known entity (exchange, mixer, darknet market)
- Whether any address appears on the OFAC sanctions list
- Behavioural patterns that indicate money laundering typologies
The trace continues hop by hop until funds either reach an identified endpoint (typically an exchange deposit or a mixer) or become too diffuse to follow productively.
Entity attribution — the key to identifying perpetrators
Tracing addresses is only useful if you can link them to real-world identities. This is done through entity attribution — the process of identifying which addresses belong to known exchanges, services, or individuals.
Large exchanges like Binance, Coinbase, and Kraken have distinctive on-chain patterns and known deposit addresses. When traced funds reach one of these exchanges, investigators can identify the specific exchange — and a production order or subpoena served on that exchange can compel disclosure of the account holder's identity.
Common patterns in crypto money laundering
Peel chains: Funds are moved through a long sequence of addresses, with a small amount "peeled off" at each step. This is an attempt to confuse automated tracing tools, but it is highly distinctive and immediately identifiable to a trained investigator.
Fan-out: Funds from one address are distributed to many addresses simultaneously, attempting to dilute and complicate the trail.
Layering through exchanges: Funds are moved through multiple exchanges, potentially converting between currencies at each step, in an attempt to break the chain of ownership.
Mixing services: Cryptocurrency mixers pool funds from multiple users and redistribute them, attempting to break the link between input and output addresses.
The role of mixing services
Mixing services (also called tumblers) are the primary tool used to attempt to obscure Bitcoin trails. They work by accepting Bitcoin from multiple sources, pooling it, and returning equivalent amounts minus a fee to new addresses.
While mixing does make tracing significantly harder, it does not make it impossible. Many mixing services have been identified and shut down by law enforcement. The use of a mixing service is itself evidentially significant — it demonstrates a deliberate attempt to conceal the origin of funds, which courts have found relevant in criminal proceedings.
The most widely used Bitcoin mixer in recent years was Wasabi Wallet, which uses a technique called CoinJoin. It remains operational, though its effectiveness as an obfuscation tool has been significantly reduced by improved chain analysis techniques.
Key limitations of Bitcoin tracing
- Funds that pass through a mixer become significantly harder (but not always impossible) to trace
- Privacy coins like Monero use ring signatures that make tracing mathematically impossible with current technology
- Exchange cooperation is required to link on-chain addresses to real-world identities — this typically requires legal process
- Very old transactions may have limited live data available through standard APIs
What happens when funds reach an exchange
When a blockchain trace identifies funds reaching a regulated exchange — which is the most common outcome in fraud cases — the investigation enters its second phase: legal process.
Regulated exchanges in the UK, US, EU, and most major jurisdictions are required by law to maintain KYC records of their customers and to cooperate with lawful requests from law enforcement and courts. A production order, subpoena, or mutual legal assistance request served on the exchange can compel disclosure of:
- The account holder's name, date of birth, address, and nationality
- The identity documents submitted at registration
- IP addresses used to access the account
- Complete transaction history
- Any suspicious activity reports previously filed
This is why identifying the exchange is so valuable — it transforms a pseudonymous blockchain trace into a real-world identity.