VSI GLOBAL // ENTERPRISE ARCHITECTURE

OSINT-022-cryptocurrency-tracing-and-attribution-report-collection

15 min read

[SUBJECT / ENTITY - CRYPTO HOLDER] - Collection Map

OSINT-022 Cryptocurrency Tracing & Attribution Report - collection workspace. Central topic = the subject or entity whose crypto holdings are being traced and attributed. Branches = blockchain-forensic + off-chain data-point categories. Drop each collected value as a child node; expand it with where / how it was found. Paste raw tool output into the node’s Notes. → feeds deliverable OSINT-022.

00 · Collection Plan - PIRs & EEIs

The questions this collection must answer + the essential elements of information (EEI) for each. Tick as satisfied. → drives §3 Key Judgments, §4 PIRs, §16 Verified Findings Summary, §17 Red Flags, §20 Collection Gaps & RFIs, §21 Assessment & Recommendations.

PIR-1 - Address Inventory: what is the complete or best-available inventory of blockchain addresses and address clusters attributable to the subject?

  • EEI: all seed addresses provided by client / disclosed by subject
  • EEI: additional addresses discovered via cluster-heuristic analysis (co-spend, common-input, change-address)
  • EEI: addresses linked via off-chain corroboration (court filings, social-media disclosures, KYC-linked exchange deposits/withdrawals)
  • EEI: addresses identified via leaked / breach-sourced data (flagged, graded low, for lead-generation only)
  • EEI: per-address first-seen / last-active dates, transaction counts, blockchain network

PIR-2 - Value Aggregate: what is the estimated aggregate value and value distribution across addresses/clusters?

  • EEI: current balance at each identified address / cluster (per blockchain explorer, current as of stated block height)
  • EEI: historical peak balance and estimated realized / unrealized gains
  • EEI: estimated fiat-equivalent aggregate value bracket (currency and price source stated)
  • EEI: highest-value single address or cluster identified
  • EEI: locked / staked / DeFi-illiquid positions that reduce immediately realizable value

PIR-3 - Exchange Exposure: through which exchanges, platforms, or off-ramp services has the subject transacted, and what KYC/identity data is associated?

  • EEI: exchanges identified via known deposit-address clustering
  • EEI: exchange regulatory standing and jurisdiction (licensed / registered / unregulated)
  • EEI: KYC/AML posture of each exchange (observable - e.g., high-risk / FATF grey-listed jurisdiction)
  • EEI: value bracket transacted through each exchange
  • EEI: fiat off-ramp events (exchange-to-bank transfers observable on-chain or via off-chain intelligence)

PIR-4 - Concealment Indicators: are there indicators of deliberate concealment?

  • EEI: mixer / tumbler service interactions (Wasabi, Samourai, Tornado Cash, ChipMixer, Sinbad, YoMix, or equivalent)
  • EEI: privacy-coin usage (Monero, Zcash, Dash) - including receipt or conversion
  • EEI: privacy-layer protocol interactions (Aztec, Railgun, Umbra, or equivalent)
  • EEI: systematic cross-chain bridging to privacy-favoring networks
  • EEI: OTC / P2P channel indicators (direct wallet-to-wallet, forum / Telegram OTC references)
  • EEI: non-custodial wallet dominance (hardware wallet patterns, no exchange intermediary)

PIR-5 - Illicit-Finance Nexus: is there any traceable connection to sanctioned addresses, darknet markets, ransomware wallets, fraud schemes, or other illicit-finance activity?

  • EEI: OFAC SDN screening result for all identified addresses and counterparties
  • EEI: OFSI / EU / UN sanctions screening result
  • EEI: darknet-market address screening (Chainalysis Reactor / Elliptic / TRM Labs or equivalent flags)
  • EEI: ransomware / hack-theft address screening (known ransomware wallet lists, hack-attribution databases)
  • EEI: fraud / scam scheme address screening
  • EEI: disposition for each match (true / false positive / inconclusive)

Collection gaps / RFIs (running)

  • [open gap - e.g., exchange-data not yet returned via legal process] → route to §20 Collection Gaps & RFIs
  • [open gap - e.g., privacy-coin holdings undiscoverable within scope]
  • [open gap requiring escalation to deeper product - e.g., non-crypto hidden assets → Hidden Asset Investigation OSINT-021]

01 · Target Identity (Holder)

Resolve who controls the crypto assets - individual, entity, or both. Attribution of addresses to the subject requires identity resolution first. → feeds §5 Subject Crypto Profile Overview, §6 Known Addresses & Wallet Clusters, §22 Annex A (subject identity-resolution confidence), Appendix A.

Identity anchors

  • Full legal name:
  • Aliases / trading names / pseudonyms:
  • Date of birth / incorporation date:
  • Nationality / jurisdiction of incorporation:
  • Passport / national ID (partial/redacted):
  • Tax ID / registration number:
  • LEI (if entity):

Subject identity-resolution confidence

  • Resolution level: [Confirmed / Probable / Possible / Unresolved]
  • Matched identifiers basis:
  • Same-name / coincidental-cluster exclusions documented:

Known blockchain addresses (seed)

  • [address - e.g., bc1q…]
    • Blockchain:
    • Source of seed (client-provided / court filing / disclosed / discovered):
    • Confidence it belongs to subject: [Confirmed / Probable / Possible / Unresolved]
    • Notes / tool output: ← (blockchain explorer verification - Blockchair, Mempool.space, Etherscan)
  • [address 2]

Associated entities / controllers

  • [entity or individual name]
    • Relationship to subject:
    • Basis:
    • Confidence: [H/M/L]

02 · Real Property

OSINT-visible property that may indicate wealth flows or off-ramp destinations - not the primary focus for this deliverable but relevant to fiat off-ramp verification and lifestyle-audit cross-check. → feeds §15 Value Estimates & Standing, §17 Red Flags (lifestyle incongruity).

Real property

→ §15 Value Estimates & Standing. Clone per property.

  • [property - address or descriptor]
    • Jurisdiction / registry:
    • Owner of record (nominee / direct):
    • Date acquired:
    • Value indicator:
    • Crypto-to-fiat off-ramp linkage (if any):
    • Source / registry:
    • Confidence: [H/M/L]
    • Notes / tool output: ← (land registry, property databases, HM Land Registry, county recorder)
  • [property 2]

03 · Corporate Holdings & Business Interests

Entities through which crypto may be held or laundered - shell companies, nominee structures, crypto businesses. → feeds §8 Exchange & Off-Ramp Attribution, §9 Mixer / Tumbler Indicators, §14 Illicit-Finance & Sanctions Indicators, Appendix A.

Corporate holdings

→ §8 Exchange & Off-Ramp Attribution, Appendix A. Clone per entity.

  • [entity name - e.g., XYZ Holdings Ltd]
    • Jurisdiction of incorporation:
    • Registration number:
    • Registered address:
    • Directors / UBOs:
    • Crypto-relevant business activity (exchange / wallet provider / token issuer / OTC desk):
    • Known blockchain addresses linked to entity:
    • Sanctions / adverse media:
    • Source (OpenCorporates / Companies House / GLEIF / local registry):
    • Confidence: [H/M/L]
    • Notes / tool output: ← (OpenCorporates, national registries, GLEIF)
  • [entity 2]

04 · Financial Accounts & Instruments (Fiat Linkages)

Fiat-side indicators that corroborate crypto off-ramp events or reveal on-ramp sources. OSINT-accessible only. → feeds §8 Exchange & Off-Ramp Attribution, §13 OTC / P2P Indicators, §15 Value Estimates & Standing.

Exchange accounts (fiat-linked)

Clone per exchange account.

  • [exchange - e.g., Binance / Coinbase / Kraken / LocalBitcoins]
    • Jurisdiction / regulatory standing:
    • Account linkage basis (KYC-linked deposit address / cluster / off-chain):
    • Fiat currency(ies) used:
    • Estimated fiat throughput:
    • Source grade:
    • Notes / tool output: ← (Chainalysis Reactor, Elliptic Investigator, TRM Labs)
  • [exchange 2]

Observable bank / payment-system linkages

  • [indicator - e.g., bank transfer to exchange visible in court filings]
    • Basis:
    • Value:
    • Confidence: [H/M/L]

05 · Movable Assets (Crypto-Purchased / Lifestyle Indicators)

Crypto-to-fiat purchases of high-value movable assets - vehicles, yachts, aircraft, luxury goods - where observable via OSINT. Provides lifestyle incongruity evidence. → feeds §15 Value Estimates & Standing, §17 Red Flags.

Vehicles

  • [vehicle - make / model / plate / VIN]
    • Acquisition method (crypto-linked or inferred):
    • Value indicator:
    • Source:
    • Confidence: [H/M/L]

Vessels / aircraft

  • [descriptor]
    • Registry (flag state):
    • Value indicator:
    • Source:

High-value luxury goods / art

  • [item descriptor]
    • Value indicator:
    • Basis:

06 · Cryptocurrency & Digital Assets

PRIMARY BRANCH - the blockchain-forensic core of this deliverable. Every sub-branch maps to a discrete section of OSINT-022. Clone recursive blocks per address, exchange, protocol, or obfuscation interaction.

06a · Known Addresses & Wallet Clusters

→ §6 Known Addresses & Wallet Clusters, Appendix B Address & Cluster Register.

  • [address / cluster ref - e.g. BTC-CLU-001]
    • Blockchain / network: [Bitcoin / Ethereum / ERC-20 / BSC / Solana / TRON / Monero / Other]
    • First seen (date / block height):
    • Last active (date / block height):
    • Transaction count:
    • Current balance (crypto):
    • Current balance (fiat equivalent - state date & price source):
    • Attribution basis: [Direct KYC-linked exchange deposit/withdrawal / Cluster heuristic (co-spend / common-input / change-address) / Off-chain corroboration (court filing / social-media / disclosed wallet / leaked record) / Derived inference]
    • Attribution confidence: [Confirmed / Probable / Possible / Unresolved]
    • Source grade:
    • Notes / tool output: ← (Blockchair, Mempool.space, Etherscan, BscScan, Solscan; Chainalysis Reactor / Elliptic / TRM Labs for cluster attribution)
  • [address 2 / cluster ref 2]

06b · Transaction Flow Analysis

→ §7 Transaction Flow Analysis, Appendix C Transaction Flow Diagrams.

  • [transaction hash / ref - e.g. TX-BTC-001]
    • Date / block height:
    • From (address / cluster):
    • To (address / cluster):
    • Value (crypto):
    • Value (fiat equivalent - state date & price source):
    • Flow direction: [Inbound / Outbound / Internal transfer]
    • Notable flag: [Sanctioned address / Mixer interaction / DeFi protocol / OTC pattern / Illicit nexus / None]
    • Source grade:
    • Notes / tool output: ← (Blockchair, Etherscan; Chainalysis Reactor / Elliptic / TRM Labs for flow tracing; Maltego blockchain plugin)
  • [transaction 2]

06c · Exchange & Off-Ramp Attribution

→ §8 Exchange & Off-Ramp Attribution, Appendix D Exchange & Platform Interaction Map.

  • [exchange / platform - e.g. Binance / Coinbase / OKX / Kucoin / Huobi]
    • Jurisdiction:
    • Regulatory standing: [Licensed / Registered / Unregulated / Unknown]
    • KYC/AML posture (observable): [High-risk jurisdiction / FATF grey-listed / Regulated / Unobservable]
    • Subject interaction type: [Deposit / Withdrawal / Trade / Multiple]
    • Value bracket transacted:
    • Attribution basis: [Known exchange deposit address / Cluster analysis / Off-chain intelligence]
    • Source grade:
    • Notes / tool output: ← (Chainalysis Reactor exchange attribution; Elliptic Investigator; exchange deposit-address databases; WalletExplorer)
  • [exchange 2]

06d · Mixer, Tumbler & Privacy-Layer Indicators

→ §9 Mixer, Tumbler & Privacy-Layer Indicators, Appendix E Mixer / Privacy-Layer Interaction Detail. Flag each interaction as high-severity concealment indicator.

  • [obfuscation service / technique - e.g. Tornado Cash / Wasabi Wallet / Samourai Whirlpool / Monero conversion / Aztec / Railgun]
    • Transaction hash(es):
    • Value obfuscated (crypto):
    • Value obfuscated (fiat equivalent):
    • Direction: [Deposit / Withdrawal / Receipt (third-party)]
    • Intent confidence: [Confirmed (deliberate use by subject) / Probable / Possible / Unresolved (received as third-party)]
    • Severity: [Critical / High / Medium]
    • Source grade:
    • Notes / tool output: ← (Chainalysis Reactor mixer-detection; Elliptic mixer flagging; TRM Labs; Crystal Blockchain; on-chain coinjoin / CoinJoin pattern analysis)
  • [service 2]

06e · DeFi, Staking & Yield-Farming Exposure

→ §10 DeFi, Staking & Yield-Farming Exposure.

  • [protocol / platform - e.g. Uniswap / Aave / Compound / Lido / Curve / PancakeSwap]
    • Blockchain:
    • Interaction type: [Deposit / Withdraw / Lend / Borrow / Stake / LP position / Yield farm / Governance]
    • Value (crypto):
    • Locked / staked status: [Liquid / Locked / Staked / In LP pool / Withdrawn]
    • Lock-up / withdrawal timeline:
    • Notable flag: [Security-incident protocol / Regulatory action / Sanctions nexus / None]
    • Source grade:
    • Notes / tool output: ← (DeFiLlama, Zapper.fi, DeBank, Etherscan contract interactions; Chainalysis DeFi tracing)
  • [protocol 2]

06f · NFT & Token Holdings

→ §11 NFT & Token Holdings.

  • [token / NFT - e.g. CryptoPunk XXXX / BAYC XXXX / USDT / LINK / SHIB]
    • Contract address / collection:
    • Blockchain:
    • Token standard: [ERC-20 / ERC-721 / ERC-1155 / BEP-20 / SPL / Other]
    • Quantity / holdings:
    • Value bracket:
    • Acquisition basis: [Purchase / Airdrop / Mining / Transfer / Unknown]
    • Sale / transfer activity:
    • Notable flag: [High-value / Regulatory nexus / Sanctions-linked collection / None]
    • Source grade:
    • Notes / tool output: ← (OpenSea, Blur, Etherscan ERC-721 events; Nansen, DappRadar; NFTScan; portfolio trackers - Zapper, DeBank)
  • [token / NFT 2]

06g · Cross-Chain & Bridge Activity

→ §12 Cross-Chain & Bridge Activity. Flag systematic bridging to privacy-favoring networks.

  • [bridge protocol - e.g. Wormhole / Stargate / Synapse / Binance Bridge / Ren Protocol / RenBridge / Hop Protocol]
    • Source chain:
    • Destination chain:
    • Transaction hash(es):
    • Value (crypto):
    • Pattern / frequency: [Single instance / Systematic / Layering pattern]
    • Concealment indicator: [Yes - privacy-chain destination / Jurisdictional arbitrage / No]
    • Source grade:
    • Notes / tool output: ← (bridge analytics - DefiLlama bridge tracker; Chainalysis cross-chain tracing; Etherscan bridge contract events)
  • [bridge event 2]

06h · OTC, P2P & Non-Custodial Channel Indicators

→ §13 OTC, P2P & Non-Custodial Channel Indicators. Indicators only - these holdings may be undiscoverable within scope.

  • [channel / indicator - e.g. LocalBitcoins pattern / Telegram OTC group reference / hardware-wallet withdrawal pattern / Bisq / Hodl Hodl]
    • Indicator type: [On-chain pattern (direct wallet-to-wallet, no exchange intermediary) / Off-chain intelligence (forum / social / field) / Leaked OTC-dealer record]
    • Value bracket (inferred):
    • Confidence: [H/M/L]
    • Source grade:
    • Notes / tool output: ← (on-chain pattern analysis; forum / Telegram OSINT; dark-web market monitoring if relevant)
  • [indicator 2]

07 · Income & Source of Wealth / Funds

On-chain inbound sources - what funded the crypto positions. Not a full SoW investigation (route that need to OSINT-023); this is an indicator-level trace of observable inbound flows. → feeds §7 Transaction Flow Analysis (inbound sources), §17 Red Flags (unexplained inflows), §21.2 Recommendations (escalation to SoW report).

Inbound flow sources (observable)

  • [source indicator - e.g., miner reward coinbase txs / exchange withdrawal from [exchange] / peer transfer from [cluster] / DeFi yield / airdrop]
    • Transaction hash(es):
    • Value:
    • Plausibility as legitimate income source: [High / Medium / Low / Unexplained]
    • Confidence: [H/M/L]
    • Notes:

Unexplained / suspicious inflows

  • [indicator]:
    • Value:
    • Destination after receipt:
    • Flag: [Potential illicit proceeds / Unknown / Under investigation]

08 · Liabilities & Encumbrances

Observable on-chain liabilities (DeFi borrowings, collateralized positions) and off-chain encumbrances (court judgments, freezing orders, regulatory seizure). Affects realizable / recoverable value. → feeds §15 Value Estimates & Standing, §21.2 Recommendations.

DeFi borrowings / collateralized positions

  • [protocol - e.g. Aave loan / Compound borrow / MakerDAO CDP]
    • Blockchain:
    • Collateral locked:
    • Debt outstanding:
    • Liquidation risk: [Yes - threshold near / No]
    • Notes:

Legal / regulatory encumbrances (on-chain or off-chain)

  • [order / judgment - e.g. freezing order, OFAC designation, court-ordered seizure]
    • Jurisdiction:
    • Issuing body:
    • Date:
    • Assets subject to order:
    • Status: [Active / Discharged / Under appeal]
    • Source:

09 · Hidden / Nominee Structures (Shell, Nominee, Offshore)

Structures used to distance the subject from visible on-chain holdings - nominee wallet controllers, offshore-entity-held exchange accounts, multi-sig controlled by nominee. → feeds §9 Mixer / Tumbler Indicators, §13 OTC / P2P Indicators, §14 Illicit-Finance & Sanctions Indicators, §17 Red Flags, §18 ACH (H2 / H3).

Nominee wallet / controller indicators

  • [indicator - e.g., multi-sig wallet with unknown co-signers / wallet registered to a shell entity / exchange account in nominee name]
    • Indicator basis:
    • Nominee / shell entity identified:
    • Confidence subject is beneficial controller: [Confirmed / Probable / Possible / Unresolved]
    • Source grade:
    • Notes / tool output:

Offshore / shell entity-held crypto

→ §03 Corporate Holdings branch (also). Clone per structure.

  • [entity name / jurisdiction]
    • Exchange account / wallet link:
    • Basis for subject-control attribution:
    • Confidence: [H/M/L]
    • Notes:

Privacy-coin / non-custodial holding indicators (undiscoverable)

  • [indicator - e.g., known Monero conversion event, hardware-wallet exit from exchange]
    • Value plausibly concealed:
    • Tracing limitation note:

10 · Network & Facilitators

Individuals and entities who facilitate the subject’s crypto activity - exchange account managers, OTC brokers, wallet custodians, professional advisers, money-laundering associates, nominees. → feeds §8 Exchange & Off-Ramp Attribution, §14 Illicit-Finance & Sanctions Indicators, §17 Red Flags, §21.2 Recommendations.

Exchange contacts / account managers

Clone per facilitator.

  • [name / handle - e.g. OTC broker alias “trader_X”]
    • Platform / channel:
    • Role (OTC broker / nominee account holder / professional adviser):
    • Crypto addresses linked to facilitator:
    • Attribution basis:
    • Sanctions / adverse screening result:
    • Confidence: [H/M/L]
    • Notes / tool output: ← (username search: sherlock, whatsmyname; email: holehe, hunter.io; entity: OpenCorporates; OFAC SDN check)
  • [facilitator 2]

Money-laundering associates / co-conspirators

  • [name / entity]
    • Role:
    • Blockchain-address links:
    • Basis:

Professional advisers (lawyers, accountants, company-formation agents)

  • [name / firm]
    • Role:
    • Jurisdiction:
    • Basis:

11 · Illicit-Finance & Sanctions Indicators

Screening log for all identified addresses, clusters, and counterparties against known illicit-address databases and sanctions lists. → §14 Illicit-Finance & Sanctions Indicators, Appendix F Illicit-Finance & Sanctions Screening Log. Critical findings require immediate escalation.

Sanctions screening

→ §14, Appendix F. Clone per address screened.

  • [address / cluster ref]
    • OFAC SDN result: [Clear / Hit - designation / Near-match - review]
    • OFSI (UK) result: [Clear / Hit / Near-match]
    • EU Consolidated List result: [Clear / Hit / Near-match]
    • UN Security Council List result: [Clear / Hit / Near-match]
    • Screening tool / version / date:
    • Disposition: [True positive / False positive / Inconclusive - escalate]
    • Source grade:
    • Notes: ← (Chainalysis Reactor sanctions overlay; Elliptic sanctions; TRM Labs; OFAC SDN search; World-Check / Refinitiv)

Darknet / ransomware / illicit-activity screening

  • [address / cluster ref]
    • Match type: [Darknet market / Ransomware wallet / Fraud scheme / Hack-theft / Other]
    • List / database:
    • Transaction hash linking subject to match:
    • Value transacted with illicit address:
    • Disposition: [True / False / Inconclusive]
    • Severity: [Critical / High / Medium]
    • Source grade:
    • Notes / tool output: ← (Chainalysis Reactor risk signals; Elliptic darknet flags; TRM Labs illicit-entity database; Crystal Blockchain)

99 · Collection Admin

Working register - not a deliverable section, but the audit trail behind Annex A Sources & Methodology, Appendix B, Appendix F, and Appendix H.

Source register

Every material datum traceable to a graded source. → §22 Annex A, Appendix H Full Source Register.

  • [S-1 - source name / tool / database]
    • Type: [Primary (on-chain immutable) / Secondary (block explorer / licensed tool) / Tertiary (open source / forum)]
    • Reliability (A–F):
    • Credibility (1–6):
    • Coverage scope:
    • As-of date / block height:
    • Limitations noted:
    • Date accessed:

Blockchain tool log

  • [tool - e.g. Chainalysis Reactor / Elliptic Investigator / TRM Labs / Crystal Blockchain / Bitquery / Breadcrumbs / Maltego blockchain plugin]
    • Version:
    • Blockchains covered:
    • Date of analysis / block height:
    • Coverage limitations:

Evidence archive

  • [screenshot / on-chain capture ref + hash + URL + timestamp]:

Open gaps / verification pending

  • [gap - e.g. exchange legal-process response pending → §20]
  • [gap - e.g. privacy-coin holdings not traceable within scope → document in §20]
  • [gap - e.g. OTC channel holdings inferred but unconfirmed → document in §20]

RFIs issued

  • [RFI-001]
    • To:
    • Date issued:
    • Status: [Pending / Returned / Closed]
    • Escalation target if not returned:

Graph View