Blockchain Tracing, Wallets and Exchange Records
Cryptocurrency Tracing Across Wallets, Exchanges and Devices
A blockchain records every transaction and names no one. Global Digital Forensics traces the funds on chain, then finds the evidence that ties an address to a person: the wallet on a laptop, the identity file at the exchange, the phone that signed the transaction. Every hop and every link to a person is documented for court.
Examiners Grounded in Transaction Systems and Devices
The hard questions in a cryptocurrency matter are rarely about the ledger. They are about what a wallet file on a seized laptop proves, whether an exchange identity record really ties to the person in the caption, and how much weight an address grouping heuristic deserves when a tracing report treats it as a name. Those are device, database and transaction system questions, the ground our examiners work every day, and every report is built for cross examination.
Our founder Joseph Caruso holds the CISSP and began his technology career in 1980 in software development, mainframe databases and real time transaction systems; his Bank One shareholder litigation work involved credit card transaction and deposit systems. Robert Knudsen, a CISSP and Certified Computer Examiner, has conducted hundreds of computer and mobile device examinations supporting federal and state court matters, which is where wallet artifacts actually live. Veronica Perez, our Senior Computer Forensic Specialist, examines the phones and mobile applications that hold wallet data. Our examiners have testified in federal and state courts.
Some payments never reach the public ledger. On the Lightning Network, channel funding and settlement are recorded on the blockchain while individual routed payments are not, so following a payment can take authorized wallet, node, invoice or counterparty records. The Lightning Labs overview of the Lightning Network and the original Lightning Network technical summary explain why a blockchain search alone can come back empty.
If the tracing report in your matter treats an address cluster as a person, get a free consultation and walk a senior examiner through the chains and the attribution before the opinion deadline is set.
The engagement
Trace the Funds, Then Test Every Link to a Person
We preserve the public blockchain evidence with the chain, network, transaction or block identifier, confirmation state and retrieval source recorded, so another examiner can pull the same record and follow the same path. Block timestamps are network times, not a clock on someone's wrist, and the report states the time basis for every step it relies on.
The work supports federal criminal defense, prosecution referrals, civil recovery, enterprise fraud, bankruptcy trustee matters and sanctions or regulatory matters, because the records do not change with the caption. The report keeps the blockchain transactions apart from wallet, exchange and other external records, and lays out exactly which evidence connects an address with a real identity.
Tracing covers Bitcoin, Ethereum and the EVM networks, Solana, Tron, Lightning and the major stablecoins where the analysis tools and public records support the chain, and coverage for the chains in your matter is confirmed before the engagement starts. Wallet examination reaches seed and keystore artifacts, browser and mobile wallets, custodial exports and hardware wallet companion records, subject to authority, encryption and the state of the device. Tracing shows where the money went, and the tracing report is the evidence used to pursue it.
Bring the known addresses and the exchanges involved, and coverage for your matter is confirmed on the first call. Call (800) 868-8189.
Scope
Blockchain tracing and transaction analysis
We trace the path independently across the chains in scope, anchor every hop to a transaction hash and block height, and name the records needed for activity the public ledger does not show.
Wallet forensics
Authorized wallet analysis covers Windows, macOS, Linux, iOS and Android sources, including seed and keystore artifacts, browser extension wallets, mobile application data and hardware wallet companion applications.
Exchange record analysis and subpoena support
We examine exchange identity verification packages, deposit and withdrawal histories, IP and device records, subaccounts and API key activity, and the findings support focused subpoena drafting at counsel's request.
Sanctions, mixer and DeFi analysis
We assess exposure to sanctioned addresses, mixer and bridge paths, and lending, decentralized exchange and yield records, with ledger observations reported separately from the evidence that bears on intent.
Documented basis for address grouping
For every grouping heuristic we document the rule, its known error considerations and the alternative attributions that remain, so you can weigh the attribution instead of inheriting it.
Expert testimony and Rule 702 support
An expert engagement can include deposition, evidentiary hearing and trial testimony, with technical support for challenges to clustering, mixer analysis and identity attribution.
Rebuttal and defense analysis
We review a government or opposing tracing report, test its heuristics and its leaps from address to person, and produce independent opinions, rebuttal declarations and lines of cross examination.
Methodology
From Retention Letter to Testimony
Define the chains, the addresses and the scope
We take the retention letter, clear conflicts across the named custodians and exchanges and fix the chains, addresses and review period.
Trace independently
Tracing is anchored in transaction hashes and block heights, with every grouping heuristic documented separately from the path and the alternative routes identified.
Reconcile the ledger with wallets and exchanges
Blockchain paths are reconciled with exchange records, wallet artifacts and endpoint findings, and activity is attributed to a person on the strength of those external records.
Report and testify
The written report sets out the blockchain evidence, the external records and the reasoning that connects them, and the examiner who wrote it testifies to it.
Have the known addresses, the chains and the dates ready, and an examiner will tell you on a free consultation what independent tracing can add, or call (800) 868-8189.
Evidence commonly examined
Cryptocurrency Evidence We Examine
Ledger records identify the chain, transaction hash and block height for every step of the path, and exchange identity, transaction, IP and device records supply what a public address cannot. Authorized wallet artifacts from Windows, macOS, Linux, iOS and Android devices give the device side of the story, and custodial audit exports and cold storage records document the service and custody context.
Analysis tool output is kept with the exact version and rule set used, opposing tracing reports and workpapers support independent review, and court orders, protective orders and tracing protocols govern how the evidence is handled.
What you can expect
Your Tracing Report and Expert Support
The tracing report connects the path to transaction hashes and block heights, the attribution appendix keeps public ledger observations apart from the external evidence that identifies a service or a person, and the wallet appendix records the recovery method and the conditions another examiner needs to reproduce it.
Deposition and trial testimony explain the opinions in the report, a rebuttal declaration answers an opposing tracing report when the matter calls for one, and court exhibits built from ledger and exchange records let a judge or jury follow the money without a glossary.
Frequently asked
Mixers, Clustering and Tracing Output in Court
Are address clustering heuristics accepted in court?
Courts weigh a grouping inference on the basis the expert lays for it. We document the grouping rule, its known error properties, the alternative identities that remain and the effect the rule has on the tracing conclusion, so the inference carries the weight it deserves. A cluster is evidence about addresses, and we report it that way.
Can you trace funds that moved through a mixer?
Often in part. Where the mixer's design and additional records permit analysis, we trace through it; where the path breaks, the report marks the break and builds from the downstream evidence that remains. You will know which situation you are in before you spend on the attempt.
Do you work only on government referrals, or for private plaintiffs and the defense?
Federal criminal defense, civil recovery, enterprise fraud, bankruptcy trustee work and enforcement referrals alike. A conflict check and an authority review run before any work begins.
How is tracing tool output prepared for court?
Tool output is one input to the opinion. The report names the tool version and rule set, explains the examiner's own reasoning, states what the tool is designed to show and builds the record a Rule 702 challenge will test.
Can you recover assets from a wallet when the seed phrase was not preserved?
With documented authority and surviving artifacts, we assess what they allow. Keystore files, browser databases, backups and device images are the starting point, and you will know early what the artifacts support. Any movement or custody of assets runs under separately agreed controls. Keep keys, seed phrases and signing credentials out of any intake form.
Free consultation
Put the Ledger and Wallets Before an Examiner
On the first call a senior examiner takes the chains and addresses you know, the devices and exchange records in hand and the deadline, tells you what to preserve and what to subpoena, and outlines the tracing, the wallet work and the report.
Founded in 1992. Hotline answered 24/7 by a practice whose examiners testify.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .