There is a persistent myth that cryptocurrency is an anonymous paradise for criminals. The reality is the opposite: the public blockchain has turned out to be one of the worst places to launder money. Every transaction is recorded forever and visible to everyone, which means every thief leaves a permanent trail. In this lesson we look at how independent on-chain detectives and government agencies use this transparency to recover stolen funds years later — and why the public nature of the blockchain has become a weapon against money laundering rather than an aid to it.
The clearest example that an investigation needs no badge or warrant is the work of an independent detective known by the pseudonym ZachXBT. He is an anonymous investigator who, since 2021, relying solely on public blockchain data and open sources, has helped return around $500 million to victims of fraud and hacks (Paradigm co-founder Matt Huang gave a more cautious figure — over $350 million). His method is blockchain forensics combined with OSINT: clustering addresses and matching on-chain movements with public traces on social media and forums.
Cracking a theft takes not only technology, but people willing to patiently follow every lead.
— a paraphrase of the approach of on-chain investigators like ZachXBT (not a verbatim quote).
The main takeaway from his work is striking: anyone can investigate. Blockchain data is public, the tools are available, and a lone individual with a laptop can untangle a multi-million-dollar scheme that, in traditional finance, would be invisible without banking secrecy and court orders. A criminal accustomed to cash vanishing without a trace runs into the exact opposite on the blockchain: his money leaves a public route, along which an entire community of analysts follows him.
What a lone enthusiast does, government agencies do on an industrial scale. The U.S. Department of Justice, the FBI and IRS-CI have learned to exploit the blockchain's key property — the permanence of the record. Consider two telling cases from the course's verified facts.
In August 2016 the Bitfinex exchange was hacked and around 119,754 BTC were stolen, scattered across 2,075 addresses. At the time this was worth roughly $71 million. For years almost all the coins sat untouched — the thieves could not "cash them out" without exposing themselves. Movement began later, in an attempt to move the funds into the banking system: it was at that bottleneck that investigators got their grip. In February 2022 the U.S. Department of Justice seized around 94,000 BTC — approximately $3.6 billion, the largest financial seizure in the department's history at the time. Ilya Lichtenstein and Heather Morgan were arrested; in 2023 they pleaded guilty. A crucial detail played a key role: the wallet's private keys were found in one of the defendants' cloud accounts.
As the U.S. Department of Justice noted, it was precisely the permanence of the blockchain — the fact that a record cannot be erased or forged — that made it possible to trace the coins' path and recover the funds six years later. The blockchain waited patiently: it held the route of the stolen funds all that time, while the investigation searched for the weak link.
On 7 May 2021 the extortion group DarkSide encrypted the networks of Colonial Pipeline — a fuel pipeline on the U.S. East Coast. The company paid a ransom of 75 BTC (about $4.4 million). But the FBI traced the movement of these funds across the blockchain and, by court order, seized a significant portion of the ransom — around 63.7–69.6 BTC (about $2.3 million), gaining access to the key of a wallet belonging to a group affiliate. U.S. Deputy Attorney General Lisa Monaco commented on the operation as follows:
"Today we turned the tables on DarkSide"
— Lisa Monaco, U.S. Deputy Attorney General, on the Colonial Pipeline case.
The lesson of this case is direct: even a ransom paid in cryptocurrency can be traced and recovered. What the extortionists considered their advantage — a fast, anonymous payment — turned against them: the money left a public trail, and along it the state came for them.
Let us pull together the full picture. Money laundering is the process of giving criminal money the appearance of legitimate origin. In the world of cash it works, because banknotes are anonymous and the trail is lost. On the blockchain it stumbles over a fundamental property of the technology.
Publicity = a weapon against money laundering
On the blockchain a criminal ends up worse off than in the world of cash: his money is visible to everyone and forever, and he can use it only through legitimate gateways, where he is awaited. A lone detective returns hundreds of millions, the state seizes billions years later — and both are possible only because the ledger is open. The transparency that critics consider crypto's vulnerability is in fact its main defence against crime.
We have seen transparency as the investigators' weapon. In the next lesson we look at how this weapon is wielded by those on the front line of legitimate circulation — crypto exchanges: why they roll out KYT, freeze addresses and cooperate with law enforcement, and what their logic implies for the ordinary user.
This material is for educational purposes and does not constitute legal advice.