Crypto Asset Investigations: Key Considerations And Pitfalls – Fin Tech – United States

Crypto assets are some of the most rapidly
evolving and increasingly adopted assets in the world.
Decentralized Finance (DeFi) is emerging as a blockchain-based
alternative to traditional banking and financial services and has
seen dramatic growth in conjunction with the growth and development
of cryptocurrencies and blockchain technology. The associated
regulation and guidance for investigation and enforcement is
constantly evolving given the early-stage nature of this
industry.

The crypto and DeFi industry has seen a growing number of
regulatory enforcement actions as developers and founders push the
boundaries of these fintech applications into areas of our existing
financial regulations that were established well before the concept
of crypto assets was contemplated. In the United States, the number
of Security and Exchange Commission (SEC) enforcement actions
related to crypto assets has steadily increased over the last
decade, from a total of 11 between 2012 and 2017 to 128 between
2018 and 2023 (Figure 1).
¹

Figure 1: Growth of Digital Asset
Enforcement Actions by the SEC

Source: SEC.gov

The rise in SEC enforcement actions related to crypto assets has
coincided with significant growth in the total market cap of the
crypto asset industry, which has seen a precipitous rise since
2017. Bitcoin represents the largest share of the overall crypto
asset industry market cap, currently representing approximately
one-half of the total market cap for all crypto assets.
(Figure 2).

Figure 2: Market Capitalization of the
Crypto Asset Industry and Bitcoin

Source: CoinMarketCap.com

The SEC’s first noticeable increase in crypto asset
enforcement actions was in 2018, which followed an all-time high in
the price of Bitcoin and in the industry market cap in December
2017. Similarly, enforcement actions increased in 2021 when the
overall industry market cap and Bitcoin again reached all-time
highs. Given this trend, it seems likely that the SEC and other
regulators and enforcement agencies will continue to increase their
focus on the crypto asset industry.

With the rise of crypto asset enforcement actions and other
related litigation, investigators must familiarize themselves with
the nuances and mechanics in the crypto asset industry,
particularly on the differences to investigations solely involving
traditional financial assets. Below, we will outline some of the
key considerations and major pitfalls that investigators may
encounter on investigations involving crypto assets.

The Basics

It is critical that investigators understand the type of crypto
assets that they are working with and how users will transact with
those assets. A wide variety of crypto assets exist with many
different transaction types, and understanding the nuances between
these assets and transactions is necessary in properly analyzing
the activity and tracing the flow of funds through blockchains and
off-chain entities.

While each crypto asset is unique in terms of its functionality,
supply and distribution characteristics, each crypto asset can be
generally categorized as either a native asset to a specific
blockchain (or a cryptocurrency
coin) or an asset that is built on top of
and operable with an existing blockchain (or a crypto
asset token).
Cryptocurrency coins are necessary to transact with or interact
with the blockchain that the coins are native to and are critical
to the operation of independent blockchains (e.g., Ether
is the native coin of the Ethereum blockchain). Each transaction on
a blockchain requires fees to be paid in the native asset and these
assets are critical to the security and consensus mechanism for
that blockchain, including rewarding blockchain participants for
validating transactions executed on each respective blockchain.

Conversely, crypto asset tokens are digital assets built on top
of and supported by a blockchain but are not native to a
blockchain. The characteristics of these tokens can vary widely,
however, they can be further classified as
fungible tokens or
non-fungible tokens (NFTs). A fungible
token shares the same rights and characteristics as all the other
tokens created by that token’s smart contract. Each fungible
token holds the same value and is interchangeable with every other
identical fungible token issued by the same smart contract. A
non-fungible token is one that is distinct from all other tokens
and does not have the same rights or characteristics of other
non-fungible tokens created by that token’s smart contract.

Wallet and Address Identification

One of the most critical aspects of a cryptocurrency
investigation is the identification of specific addresses and
wallets to analyze. Blockchains and cryptocurrencies inherently
provide a level of privacy and confidentiality as a feature of the
system known as pseudonymity, meaning that users interact with the
blockchain via a public cryptographic address as opposed to using
their full identity. Despite this privacy feature afforded to
users, because blockchains are immutable public ledgers, the
transactional and balance data of each address can always be
accessed and analyzed by investigators experienced in blockchain
forensics, and this data can be used to determine the ownership of
crypto asset addresses.

There are several methods to determine the identity of the
user(s) of a crypto asset address and/or wallet. In some cases,
individuals or entities may publicly identify their own public
addresses on social media platforms or web forums, or they may have
provided their addresses in documents included in the legal
discovery process. Additionally, because of the increased know your
customer (KYC) and anti-money laundering (AML) regulations imposed
in certain jurisdictions, users are more frequently required to
provide their identities to gain access to the services offered by
centralized crypto institutions, such as crypto exchanges. While
these entities are typically reluctant to share information about
their users, sound analysis prepared by an experienced investigator
combined with a court order or subpoena can be leveraged to obtain
relevant account information for target individuals or entities
using their platform.

Finally, identification of individuals or entities can be
achieved through the analysis of blockchain activity to link
blockchain addresses and transactions to addresses previously
identified through other means throughout the investigation. This
concept is similar to the Mosaic Theory in finance, whereby
cryptocurrency investigators can gather and analyze data from a
wide variety of sources to develop a probabilistic understanding of
address ownership that is not available from one single source of
data. Once investigators have identified the addresses and wallets
of individuals related to the investigation, they can subsequently
work forward or backward to trace assets associated with that
individual and identify additional addresses of interest.

Blockchain Data Sources

Leveraging the public nature of blockchain transactions is of
the upmost importance to a successful crypto asset investigation.
Investigators will need to extract and analyze public blockchain
data to identify transactions that occurred on-chain. Subsequently,
this data may need to be supplemented with account data from
centralized exchanges or over-the-counter (OTC) trading desks,
which can be obtained through subpoenas or legal discovery as noted
above.

A publicly available, widely accessible (and free) source of
blockchain data is block explorers, which are web-based blockchain
data interfaces that provide a relatively straightforward means for
users to explore and search for certain data recorded on a
blockchain, including transactions, addresses, and smart contract
code. Prominent blockchains, such as Bitcoin and Ethereum, have
extremely reliable and well tested block explorers (i.e.,
Blockchain.com for Bitcoin, Etherscan for Ethereum).

Conversely, smaller or less used blockchains may have limited
block explorers that lack proper technical support, offer poor user
interfaces, or may have no usable public block explorer at all, and
the reduced reliability, usability, and completeness of those tools
may complicate blockchain forensics and investigative procedures.
In some cases, the block explorers may be built by the same
individuals who designed the blockchain, and these insiders may
have an incentive to sensor or falsify blockchain activity that
appears on the block explorer interface available to users.

When investigating transactions, addresses, or protocols built
on blockchains without reliable block explorers, it is critical
that investigators conduct testing on the reasonableness and
completeness of the data sources being used. Inconsistencies or
discrepancies in data presented on the block explorer or between a
block explorer and another blockchain analytics tool may be
indicative of an unreliable block explorer. When there is any
concern regarding the quality or completeness of a block explorer,
investigators should either run their own blockchain node to access
the full history of that blockchain or consider relying on other
blockchain data providers who are running their own node.

Finally, investigators will need to obtain and understand data
from centralized exchanges, OTC desks, or other entities who
execute transactions involving crypto assets
off-chain. These entities provide trading
and other services for their users on their own systems and not on
the public blockchain (i.e., off chain). As a result,
investigators can trace and analyze crypto asset transactions using
public sources until it is sent to a centralized, off-chain entity.
In order to continue the tracing of crypto assets, investigators
will need internal account and transactional records from these
entities. As noted above, it is not a guarantee that you will be
given access to records from these entities depending on their
jurisdiction and willingness to cooperate with the investigation.
Additionally, even when requested data is provided, the data
points, formatting, and account structure in the documentation
received can vary widely.

Crypto Asset Tracing

The methodologies and assumptions used to trace assets through
and across blockchains can result in substantial differences in the
conclusions reached by investigators and blockchain forensics
practitioners. While parallels exist between traditional financial
instruments and crypto assets when it comes to tracing
methodologies, there are several critical nuances that are unique
to cryptocurrencies, including the underlying model used by each
blockchain to process and record transactions, the bifurcation
between wallets and addresses for tracing purposes, and the novel
types of transactions an investigator may come across….