Cyber Crime Does Not End at the Intrusion

there is a habit in the cyber security industry of thinking about ecrime as the attack. the phishing email lands, credentials are harvested, malware executes, ransomware encrypts all endpoints throughout the estate, an exchange loses control of its keys. security teams and executives alike fixate on those specific moments because they are loud, disruptive, and usually where the visible damage occurs. but financially motivated ecrime does not stop once the attacker gets in. most of the time, access is where the economic component actually begins.

the ecrime ecosystem exists because ecrime got extraordinarily good at turning access into money. ransomware operators lease their sophisticated malware variants. initial access brokers sell access to the very networks they break into. infostealer operators harvest credentials and session cookies by the millions. dark web markets put buyers and sellers in the same room. fraud groups specialize in working the victim. laundering services move the proceeds through paths designed to be annoying to follow. each participant does one job, and together they form a supply chain built entirely around getting paid. cryptocurrency did not create any of this. it just ended up wired into the infrastructure keeping the underground economy running and profitable.

cryptocurrency investigation is not some niche skill about weird internet money. it is a way of looking at the financial layer sitting underneath modern ecrime. ransomware payments, extortion, fraud, illicit marketplaces, stolen crypto, sanctions evasion, and large scale theft all eventually produce financial activity someone can examine. the attacker can vanish off a compromised server in minutes. the money still has to go somewhere.

which is why an investigation can start with almost nothing. a crypto address surfaces inside a ransom negotiation. a transaction hash gets recovered during incident response. a wallet turns up tied to a marketplace account. no name, no location, no identity behind it. just a string of random alphanumeric characters, and a history of where some value moved.

that is just enough visible thread to pull on to begin.

for a long time bitcoin got treated as if anonymity were the whole point. criminals saw a financial system sitting outside the banks and assumed distance from banks also meant distance from investigators. what they got instead was something worse. public blockchains keep a permanent history of every transaction. this means funds can be followed across addresses, services, and time. the name behind an address might be a mystery. the behavior around it usually is not. this was not obvious in the beginning.

what changed was not the blockchain. investigators simply got better at reading it. once enough intelligent and persistent people started pulling apart how transactions actually moved, following cryptocurrency became surprisingly doable. with a little elbow grease, the principle of investigating the flow of cryptocurrency is the same as following fiat, even if the mechanics are substantially stranger at first glance.

one transaction in isolation may tell you very little. hundreds, sometimes thousands, begin telling a story. the same addresses keep showing up together. funds keep converging at the same destinations. wallets touch exchanges, mixers, bridges, marketplaces, and brokers, and the same infrastructure starts appearing across activity nobody thought was related. behavior turns into patterns, and patterns are where the openings are to be found.

a wallet address, by itself, is data. so is a hash, a timestamp, an amount, a transaction record on the blockchain. the moment you find that address inside a lockbit ransomware negotiation, the same data picks up context, and now it is information tied to ransomware activity. follow the transaction history into an exchange deposit, notice other ransomware operations using that same destination. layer in external cyber threat intelligence connecting those patterns to known actors and infrastructure, and the thing you are holding stops being a map of money moving around. it becomes intelligence.

this is also where crypto investigations quietly fall apart. transaction data feels authoritative because it is precise. the address is exact. the timestamp is exact. the amount is exact down to the satoshi. a graph showing one wallet wired to another can look far more conclusive than the underlying evidence has any right to be. precision in the data does not create certainty in the assessment, and confusing the two is how analysts quietly embarrass themselves.

a transaction proves value moved. it does not prove one person controlled both wallets. shared infrastructure can mean overlap without meaning shared ownership. two actors using the same exchange, hosting provider, bridge, or mixer may have nothing in common beyond convenience. a graph shows proximity. proximity is not intent.

the discipline is the same discipline running through all forms of intelligence analysis. keep facts separate from assessments. keep assumptions visible. work the alternative explanations before a hypothesis hardens into a conclusion you are emotionally attached to. confidence should go up because independent evidence converges, not because the visualization looks impressive in a briefing.

nowhere does this matter more than attribution. take a lockbit affiliate address pulled out of a ransom negotiation. on-chain analysis might show the ransom payments landing in an exchange address. that same destination might be receiving funds tied to other ransomware operations. push the relationships further and more patterns surface. enrich the blockchain activity with off-chain intelligence, and the financial trail starts lining up with known rebranding, infrastructure reuse, personas, and other adversary behavior. that is roughly how a lockbit affiliate eventually turned out to be a senior evil corp member.

connections. not attribution. the distinction is the whole game.

a connection tells you where to look next. attribution demands a great deal more, and the space between the two is exactly where sloppy analysis sets up shop. one is a lead. the other is a claim you have to defend when someone pushes back.

the strong cases are the ones where several sources independently corroborate the same story. blockchain data shows how value moved. open source intelligence (osint) can tie an address to a username, a service, a domain, or a public persona. cti adds adversary infrastructure, campaigns, and behavioral context. marketplace information can connect crypto activity to specific vendors or services. exchange records can hand you things the public ledger never will. no single source has to crack the case alone. the value is in the convergence, when independent trails keep pointing at the same place.

criminals understand this better than most defenders. this is why so much effort goes into breaking the trail. traditional money laundering tries to cut illicit proceeds off from their origin through placement, layering, and integration. crypto changes the tools, not the goal.

mixers blend funds from different sources. peel chains push value forward while shaving off smaller amounts. chain hopping converts assets and jumps between networks. coinjoin stuffs multiple participants into a single transaction. privacy coins obscure different pieces of the activity. otc brokers and nested services wedge extra intermediaries between where the money came from and where it is going.

every extra layer looks, at first, like it makes the investigator weaker. in practice, every extra action also produces more behavior. a peel chain has structure. a mixer has transaction characteristics. chain hopping leaves transitions between assets and services. nested services have to interact with the larger platforms they sit on top of. an adversary can burn through wallets constantly and still be dragging around the same objectives, habits, dependencies, and infrastructure. the trail gets more complicated. it does not get invisible.

which is what makes the moment criminals try to convert or actually use the proceeds so valuable. financial crime, in the end, depends on doing something useful with money. funds have to enter an exchange, pass through a broker, buy infrastructure, reach an accomplice, or turn into fiat. every one of those transitions can drag in a regulated entity, customer records, compliance processes, and another source of intelligence.

know your customer (kyc) and anti-money laundering (aml) controls matter for exactly this reason. the blockchain gives you pseudonymous activity. an exchange or service sitting at the edge of it may be holding information connecting that activity to a real person or organization. a purely technical investigation can turn, in a single hop, into a financial, intelligence, regulatory, and law enforcement problem all at once.

the more interesting part is that all of this hands defenders another way to understand the adversary directly. the diamond model normally maps the relationships between adversary, capability, infrastructure, and victim. drop blockchain activity into it and the logic holds up better than you might expect. wallets and clusters describe adversary activity. victim addresses anchor one end of a financial relationship. exchanges, brokers, mixers, and hosting providers become infrastructure. laundering techniques become capabilities. financial movement stops being something happening after the operation and becomes part of the broad operational picture itself.

that shifts what a blockchain investigation is worth. at the tactical level, an address becomes something defenders can monitor. at the operational level, laundering behavior shows how an adversary changes techniques and infrastructure over time. at the strategic level, aggregated activity exposes movement across ransomware, fraud, theft, sanctions evasion, and entire criminal markets. what starts as a single transaction can end up explaining how an adversary operates and how the economy around it actually functions.

for years security has poured almost all of its attention into the technical path into the victim. we study phishing, exploitation, malware, persistence, lateral movement, command-and-control, and exfiltration because those are the mechanics of a cyber attack. but an ecrime adversary is not breaking into an organization for the intellectual thrill of landing domain administrator.

there is an economy on the other side of the intrusion.

the stolen credentials have value. the access has value. the victim has value. the ransomware payment has value. the stolen crypto has value. even the infrastructure behind the attack costs something to run. look at the operation through that lens and financial movement stops being an administrative footnote after the incident. it becomes another source of adversary intelligence.

the blockchain will never show you everything. no source does. a transaction cannot tell you intent on its own, and a wallet address does not cough up the person holding the keys. criminals can pile on layers of obfuscation, move between services, switch assets, and deliberately live in the seams between jurisdictions and financial systems.

but they still have to operate. they have to make choices. they have to move value. they have to trust infrastructure. they have to interact with services, pay people, and convert proceeds into something they can actually use. every one of those decisions leaves a relationship behind.

the future of this work will not belong to whoever can draw the biggest transaction graph or follow the most wallet hops. it will belong to the investigators who can set blockchain evidence next to intelligence tradecraft, understand what the evidence actually proves, admit what it does not, and know which question to ask next.

criminals have spent years learning how to push money through systems built to be hard to follow. investigators are learning something that matters just as much.

complexity is not the same thing as invisibility.