Bitcoin and cryptocurrency adoption has increased significantly over the past few years. That growth has been matched by growth in crimes in this domain — not only scams and dark-web illegal trading, but white-collar crimes such as fraud and perjury, occurring increasingly. With blockchain technology, the world of financial infidelity has become increasingly sophisticated. There is a common belief that blockchain and cryptocurrency provide a means of hiding funds from the public or close associates unfamiliar with the technology. The rise of cryptocurrency has led to spouses hiding digital assets during divorce settlements.
This study presents a use case of a couple in the midst of a divorce, where one of the spouses was accused of perjury for failing to declare bitcoin holdings — obtained via Bitcoin mining, and possibly other digital assets — to the court. The plaintiff is entitled to fifty percent of all assets. While property, stocks, bonds and bank accounts can easily be traced, cryptocurrency assets are more complex to trace, but it is not impossible. This paper illustrates how such a case can be investigated by following the flow of funds on the blockchain, using tools such as Maltego and QLUE.
Introduction
Bitcoin, the most popular cryptocurrency by market cap, has gained wide popularity since it was created, due to its unique properties, turbulent price swings and surging value. Some believe Bitcoin gives power back to the people because transactions can be performed without third parties such as banks. However, the popularity of cryptocurrency has attracted various types of fraud and crime, and crime in this space is increasingly moving into the white-collar category. The growth of cryptocurrency has also led to cases where spouses hide digital assets during divorce settlements. When a couple married in community of property files for divorce, both parties are usually obliged to declare all assets obtained during the marriage, including digital assets. Most physical assets and bonds are fairly easy to track down, whereas cryptocurrencies can be tougher to trace — a cryptocurrency and forensics investigator may be needed to assist.
Bitcoin is often perceived to offer anonymity. On the contrary, it is traceable. A person's identity is not directly linked to a bitcoin address, but all transactions are public and recorded on the blockchain. Bitcoin and Ethereum are older forms of cryptocurrency and easier to track down than anonymous or private coins such as Monero, Zcash and Dash — but tracing those is not impossible either. This study's focus, however, is only on tracking the flow of bitcoins.
Blockchain explorers are software applications that allow anyone to view the blocks on the blockchain, as well as addresses and transactions connected to them. Blockchain.com is one example. Tracing funds on a blockchain explorer can become very time-consuming, and since all blockchain data is publicly available, this falls squarely in the Open-Source Intelligence (OSINT) space. Maltego is one of the most popular OSINT tools, with transforms that integrate external data sources such as the Tatum Blockchain Explorer — though Maltego cannot cluster addresses or indicate whether an address belongs to an exchange. QLUE, a tool designed for law enforcement and financial investigators, fills that gap: it can cluster addresses belonging to the same user or exchange, flag known-fraudulent addresses, and indicate whether an address is linked to a cryptocurrency exchange. Once an address is linked to an exchange, an investigator can — through an attorney and law enforcement — have a subpoena issued instructing the exchange to reveal the personal and transactional information behind it.
This paper investigates a specific case of possible fraud and perjury during a divorce settlement. It should be noted that the plaintiff gave consent to the researcher to perform this study and conduct a high-level investigation. No personal information and no real blockchain addresses are exposed in this paper — the bitcoin addresses and transactions have all been sanitised.
Case Background
With the unique properties of bitcoin, it is possible to hide assets from people who are not aware of how the blockchain's public ledger works, or how to trace funds on it. Tracking down hidden cryptocurrency stashes during a divorce has led to a completely new case category of forensic investigation. If one spouse is technically skilled and the other is not, the former can easily hide digital assets. The best method to get information on a spouse's cryptocurrency holdings is via a subpoena from a centralised exchange; the alternative involves forensic analysis of their devices to identify a wallet address, followed by blockchain analysis. Crypto can be stored on exchanges, or on "hot" or "cold" wallets — hot wallets are connected to the Internet and easy to spend from, but more exposed to bad actors; cold wallets are offline, with private keys stored on the device itself, making an investigation more complex. Either way, to cash out, one normally has to go via an exchange or an off-ramp service.
The use case considered here concerns a divorced couple married in community of property, where the plaintiff is entitled to fifty percent of all assets. The defendant failed to declare any cryptocurrency holdings obtained via bitcoin mining. Bitcoin mining is the process of creating new bitcoins by solving complex mathematical puzzles that verify transactions on the blockchain — when a bitcoin is successfully mined, the miner receives a predetermined reward. The plaintiff also claimed to have contributed funds to procure fourteen bitcoin Antminers — dedicated bitcoin mining computers, with one Antminer capable of earning roughly 0.1248924 BTC per month. The photo below shows four of the fourteen miners in the defendant's possession. The plaintiff has a right of ownership to half of these miners, as well as half of the assets obtained through the mining process.
The defendant provided no information regarding bitcoin holdings obtained via the miners. However, the plaintiff managed to obtain two bitcoin addresses linked to the mining activity — the only inputs provided to start this investigation (full addresses are sanitised for privacy):
- 1DGDY…YSWwM — referred to as BTC_1
- 1JZYv…JPx8A — referred to as BTC_2
With this limited information, the next step is to follow the funds on the blockchain to determine if the addresses contain any funds, and to trace where those funds have moved — aiming to reach a destination address, ideally linked to an exchange.
Investigation and Findings
Using the Blockchain.com explorer and Maltego, it could easily be determined that both addresses contained 0 BTC, and that the last transaction on either address was in 2019.
The last amount transacted on BTC_1 was 1.07147560 BTC, sent out of the address into another bitcoin address, 177hB…wSxvh.
At the time of writing, the amount sent from BTC_1 was equivalent to $29,920.57.
| BTC Address | Current Balance | Total Received | Total Sent |
|---|---|---|---|
| BTC_1 | 0 | 1.07147560 | 1.07147560 |
| BTC_2 | 0 | 0.34892516 | 0.34892516 |
Using Maltego, it was discovered that BTC_1 has 24 incoming transactions and one outgoing transaction to 177hB…wSxvh — but this output address also contained 0 BTC. Further traces were followed, but all addresses ended up with a 0 BTC balance. BTC_2 similarly had several inputs and one output to 17rDj…wtCbK, which also showed a 0 BTC balance. Since the transaction dates are as old as 2019, the assumption is that the defendant had already cashed out via an off-ramp such as an exchange — the audit trail could still be followed to a destination address to indicate how many bitcoins were transacted, and if cashed out, the plaintiff would be entitled to a cash payment equivalent to that amount.
After several attempts to follow the funds, no clear conclusion could be reached with the tools at hand. The researcher reached out to a crypto-crime investigator who had assisted in a previous study — the same investigator involved in cases such as the Mirror Trading International (MTI) scam and the Finalmente Global scam. Through this collaboration, access was obtained to QLUE, a licensed cryptocurrency graphing and investigation tool that offers clustering capabilities beyond what Maltego provides — able to cluster addresses belonging to the same user, flag known-fraudulent addresses, and identify links to exchanges.
Using the same two input addresses in QLUE, it was discovered that transactions from both addresses ended up at an address belonging to Luno, a South African cryptocurrency exchange. In addition to the two provided inputs, another input address, 1NTQf…8Es7e, was revealed — appearing to be from the same source mining activity based on QLUE's clustering. This address is referred to as BTC_3.
Continuing to follow the funds, three addresses were identified with amounts sent to the destination address at Luno. In QLUE, bitcoin addresses are visualised as round circles and transactions as square blocks — an arrow from a square into a circle indicates an incoming flow of funds into an address, while an arrow from a circle into a square indicates an outgoing flow.
| From Input Address | Last Address Before Destination | Total Sent (BTC) |
|---|---|---|
| BTC_1 | 3Ltga…a2eGh | 0.34873298 |
| BTC_2 | 177hB…wSxvh | 1.07136644 |
| BTC_3 | 19nio…WNUNR | 2.81007962 |
The sum of these three amounts is 3.916319358 BTC. Looking at the outflow of funds from the destination address, only 3.88199398 BTC had been sent out of Luno to another external address — meaning the remainder of 0.34872 BTC that went into the destination address could possibly still have been sitting in its balance.
However, QLUE indicated that the current balance on the destination address showed 0 BTC — meaning the full amount had in fact been transferred out.
Further investigation using QLUE revealed that the remaining amount had been transferred from the Luno exchange into another address outside of Luno. That address was flagged by QLUE as a hot wallet linked to the cryptocurrency exchange Bitssa. To confirm this transaction was performed by the defendant, a transaction list would need to be obtained from Luno via a subpoena issued by law enforcement — at the time of writing, no subpoena had yet been requested. The aim of this paper is to reveal the amount of bitcoin the defendant had been hiding from the spouse; subsequent legal action is beyond the scope of the research.
It should be noted that the findings in this study were only linked to the two input addresses provided by the plaintiff — it is possible the defendant hid further cryptocurrency investments obtained by other means during the marriage, though establishing that is outside the scope of this investigation. This study illustrates that it is not impossible to trace funds on the blockchain. With an investigation on-chain, the aim is always to find a link to an exchange, since exchanges store KYC information on their members — once personal information can be identified, the investigator can attempt to contact the person of interest, or fall back on further OSINT techniques if no response is received.
Conclusion
This paper gives an overview and introduction to white-collar crime in the crypto space. Many people believe crypto is anonymous and that they can use the technology to hide assets from people such as a spouse — however, as illustrated here, that belief is contrary to reality, as every transaction on the blockchain is transparent and visible to the public. Using blockchain explorers and investigation tools such as Maltego or QLUE, it is possible to trace the flow of funds. An investigator simply needs a starting point to follow the funds to a destination linked to an exchange, at which point a subpoena via an attorney can compel the exchange to reveal the personal information behind a target address.
This paper described an investigative approach to a divorce settlement case where the defendant was accused of not declaring digital assets obtained via bitcoin mining during the marriage. Two bitcoin addresses were provided by the plaintiff as a starting point. The high-level investigation found that these input addresses showed a balance of 0 BTC, and that 3.916319358 BTC had been sent to a destination address linked to the Luno exchange. Only 3.88199398 BTC had left Luno, and appears to have been cashed out; the remainder was sent to another exchange. Proof of the cash-out and the destination of the remainder would require a subpoena instructing the exchange to reveal further transaction details.
Comments (0)