Reporter’s Guide to Investigating Cryptocurrency

Introduction

Criminals and corrupt actors are using cryptocurrency to move money discreetly across borders, and largely bypass the traditional financial system. Crypto has also become a tool for businesses and wealthy individuals to funnel eye-popping amounts of money to politicians. At the same time, the crimes that crypto facilitates harm victims worldwide, causing hundreds of millions of dollars in losses per year in the United States alone, according to the FBI. All this has made investigating crypto transactions increasingly essential to accountability journalism. But the way this alternative financial system works can make that difficult.

At the core of crypto lies a paradox: while the technology can provide users with significant anonymity, it also permanently records most transactions on public ledgers known as blockchains. With the right investigative tools and techniques, these records can become a powerful source of reporting leads and revelations.

The Challenge

In 2025, ICIJ spearheaded The Coin Laundry, an investigation into dirty money in cryptocurrency. During the investigation, we found four keys to success in blockchain analytics for journalists. First, we gained some very basic knowledge of how to leverage publicly-available cryptocurrency analytics tools to get preliminary findings. Second, we learned where to find crypto addresses. Third, we ended up largely bypassing the major crypto analytics firms and instead cultivated dozens of individual crypto tracing experts who helped us confirm and expand on these preliminary findings. Fourth, we learned how to pull bulk data from APIs (application programming interfaces) from Arkham Intelligence and Tronscan, two free blockchain explorer tools, to analyze crypto transactions at a larger scale.

Before we dive into the weeds, let’s start with some crypto 101.

A blockchain is a decentralized, distributed digital ledger that stores information across a computer network and usually includes its entire transactional history. Crypto assets exist only online and are used for trading, investments, and purchasing goods. Cryptocurrency transaction data is stored in files known as “blocks,” which are saved chronologically to create a digital “chain.” There are different kinds of cryptocurrency: bitcoin, ethereum, tether, etc. Some, like bitcoin, operate only on their own dedicated blockchain, while others, like tether, operate on multiple ones.

A blockchain report for Bitcoin, showing its spot price, price history, top holders, and recent transactions. Image: Screenshot, Arkham Intelligence

When investigating crypto, you need to check which cryptocurrency was used and the blockchain where the transaction took place. This is especially key when converting the value of the cryptocurrency into US dollars, euros, or another traditional currency. You also need to check the timing of the transaction when dealing with cryptocurrencies whose value fluctuates.

The next thing to understand are cryptocurrency wallet addresses. To buy and sell cryptocurrency, users need a digital wallet. Crypto users can get a digital wallet by signing up for an exchange, which controls that wallet on behalf of users, or by creating a so-called self-custody wallet, which only the user has access to. A variety of iPhone apps make the creation of these highly anonymous self-custody wallets easy. Crypto wallets have public and private keys. The public key is similar to a bank account number and it’s what’s visible in the transaction data recorded on blockchains. This is the string of numbers and letters published, for example, in sanctions lists. This is what you’ll use on blockchain explorers like Arkham Intelligence. The private key is more like a password, so it’s not visible. Whoever holds the private key controls the cryptocurrency linked to it.

To trace scam transactions, you need a wallet address. You can find crypto wallet addresses in police reports, court records, and sanctions lists. You can also find addresses in complaints filed with financial regulators and by talking to scam victims (or the lawyers who represent them) who sometimes have receipts of transactions that will show which wallet address the victim’s crypto was sent to. Crypto users may publish addresses to collect funds on social media, which is another way to connect crypto activity to illicit funds. (For example, crypto addresses were used to collect money to support Russia’s war on Ukraine). You can also find addresses by converting cash to crypto at specific crypto-to-cash shops.

For the main story of The Coin Laundry project, ICIJ looked at transactions between centralized exchanges and Huione Group — a Cambodian firm that US authorities claim moved money for scam farm operators and North Korean hackers. We found the Huione addresses in the firm’s Chinese-language quarterly financial reports.

Centralized exchanges are crypto trading platforms that use their own wallets to collect and pool user deposits. Many of these wallets are publicly identified by the exchanges (they’re listed in their periodic “Proof of Reserves” or “PoR” reports), and blockchain explorers will tag those wallets as being owned by the exchanges. That helped us to verify which wallets belong to the exchanges and, ultimately, to analyze transactions between exchange wallet addresses and the crime-linked ones we collected.

These centralized exchanges churn trillions of dollars worth of crypto transactions per year; many users’ funds will find their way to a centralized exchange at some point. Focusing on centralized exchange accounts helps to quantify specific volumes of transactions. We chose to analyze incoming flows, (i.e., transactions sent towards centralized exchange accounts), rather than outgoing flows (from centralized exchange accounts towards users accounts). We picked one direction because incoming and outgoing flows have to be quantified separately. With incoming flows, we can verify the starting point, an illicit wallet address, and the destination, an exchange-controlled wallet. But we can’t see what happens after crypto enters an exchange. The activity within centralized exchanges occurs off-chain and isn’t visible on blockchain records using blockchain explorer tools. Inside an exchange, crypto from different sources can get mixed together, so you can’t make any definitive conclusions about outgoing flows based on incoming ones.

Image: Screenshot, Coingecko

Tips and Tools 

Basics of Crypto Tracing and Analysis 

Most of the crypto analysis that ICIJ performed on its own was basic. But the insights gained from hands-on crypto analytics can be revelatory. Say, for instance, you find a politician’s cryptocurrency address. At minimum, wouldn’t it be nice to know how much crypto that person has owned and what they’ve done with it?

The idea at the center of our methodology was always the same: For each transaction, there’s a sender and a receiver. We wanted to figure out who they were. We also needed to be able to fact-check our findings. As part of that, we turned to blockchain experts to verify our work.

ICIJ relied heavily on a free blockchain explorer called Arkham Intelligence and trained our partners on how to use it.

Here is a step-by-step overview of basic crypto tracing:

1. Identify a wallet address.
2. Choose a universe of transactions you want to analyze. For example, you can start with the recipient addresses (the ones receiving the crypto sent from the address you’re checking), or the sending addresses.
3. Focus on a time period that is relevant for your story.
4. If you include wallets hosted on an exchange, you need to choose to focus on either the crypto flowing into it or the crypto flowing out of it. You can’t do both because exchanges pool deposits. What goes into them doesn’t necessarily come out.
5. Be careful not to duplicate amounts. Describe how much was either sent or how much was received over a period of time. Sometimes several pass-through addresses are used to obfuscate the trail of crypto.
6. Check your results with a crypto firm or expert. There are cryptocurrency experts who work at major blockchain analytics firms of all sizes, as well as independent experts, crypto experts who work for nonprofits and law enforcement. Many crypto experts are highly active on LinkedIn.

Once you have a cryptocurrency address to explore, or a transaction ID (each transaction has its own ID, a string of numbers and letters), enter it into Arkham and make sure there are no spaces before or after the address. The app is user friendly. Arkham will display the activity of a cryptocurrency address over time, and the data can be downloaded into a csv format for further analysis or visualization. At the time of The Coin Laundry investigation, ICIJ also obtained API access so that we’d be able to query the data without being limited by the interface. Nowadays more and more blockchain exploration tools are integrating AI-driven tools that make it easier for users to query the data.

Blockchain exploration tools identify the owners of wallet addresses. But this isn’t always reliable (for example, in a story we wrote, an address identified as owned by an exchange, HTX, was used by another exchange, Kyrrex). You should always get an expert to verify what you see. You should also think about the wording you use to describe crypto transactional activity.

Where to Find Addresses  

Scam Victims 

Reporters can find addresses linked to scams by interviewing scam victims. For The Coin Laundry, ICIJ and partners interviewed dozens of scam victims across 12 countries. However, you need to plan this carefully. Talking to victims can require patience and understanding. Scam victims may feel embarrassed or ashamed that they were tricked by scammers and may be reluctant to come forward. Also, some of the people we talked to were approached by or sought the help of private investigators or firms that promised to recover their stolen funds, only to be scammed again. Victims can also be confused about the chain of events as scam operations can last for months, during which they are led to believe that their money is going towards a legitimate investment. Building a timeline can help reporters unfold the chain of events and also provide important context for analyzing the activity of a crypto wallet address.

Victims of scams often have extensive records of their scammers’ activity, including cryptocurrency addresses that scammers relied on to steal funds. The addresses used by scammers can be found through the messages, emails, and other documents the victims have kept. Some of them had receipts for transactions they made at crypto ATMs or had screenshots of the apps they used to make the transactions, which also contained wallet addresses for tracing. In other cases, they had tracing reports prepared by experts as part of legal proceedings, which helped us to cross-reference our findings. Addresses can also be found through traditional reporting in police reports, financial filings, court filings, complaints to regulators, etc. For The Coin Laundry investigation, we focused on the central role played by exchanges and highlighted cases where we traced victims’ stolen crypto to them.

In some instances, ICIJ found crypto addresses through public records requests. Many jurisdictions appear to redact such addresses by default, but some do not. The state of Florida for instance, appears to permit release of full cryptocurrency addresses in public records. ICIJ received cryptocurrency addresses in consumer complaints and police reports in Florida.

Cash Desk Transactions 

In one of ICIJ’s stories, we exposed a global array of so-called cash desks and courier services that allow people to anonymously cash out huge sums of cryptocurrency outside the view of financial regulators and law enforcement. Police and prosecutors told us these services make it even more difficult for them to track or recover stolen funds because they often use wallet addresses unknown to authorities. Criminals walk away with a wad of bills, while investigators see the blockchain trail go cold.

To fully explore this new money laundering frontier, an ICIJ reporter embedded with Richard Sanders, an independent researcher who travels the world collecting intelligence on these abuse-prone crypto services. Sanders cashes out crypto at desks around the world in order to collect their wallet addresses for law enforcement. By doing in-person transactions, reporters can also gather digital receipts with crypto wallet addresses on them.

Crypto ATMs

If you’re interested in digging into crypto ATMs and the businesses that host them, the Coin ATM Radar website is a good place to start. Previously the largest operator, Bitcoin Depot, is a publicly traded company and has SEC filings. It also recently filed for bankruptcy in Texas and the filings in that case can also be a resource. For The Coin Laundry project, ICIJ scraped Coin ATM Radar for the physical addresses of Bitcoin Depot ATMs. The website includes physical addresses for ATMs in the United States, as well as other countries.

US federal and local court records provide ample resources for helping reporters find victims of cryptocurrency scams. The CourtListener archive of federal court records can be searched by company name to surface examples of scams and other crimes allegedly committed with crypto ATMs). Criminal cases do not usually identify victims by name, but they do often provide the addresses for wallets used in the scam. Docket Alarm can be used to locate some cases at the state level.

Civil suits often provide much more information, including the names of victims. Lawyers in those cases are often happy to share their knowledge, including wallet addresses, and put reporters in touch with their clients. These cases can also be found on CourtListener or via the US federal court system’s PACER website, by searching the name of the company you are investigating.

Public records requests are another way to get into the story. Many states have a consumer protection agency that collects complaints about specific companies and requesting those records can turn up many cases of scams, including wallet information and details about how the companies responded to them. Reporters can also ask for police reports from addresses where machines are located.

Perhaps the best source of information about the machines themselves, however, are the retailers who host them. Reporters can use Coin ATM Radar to locate nearby stores with crypto ATMs and contact the owners by phone or visit them in person. In our experience, store owners and managers were often happy to discuss the problems they were seeing with the machines.

Working with Experts 

Crypto Analytics Firms

Major analytics firms like Chainalysis and Elliptic will sometimes provide major publications with reports describing illicit fund flows. But these firms are busy and have an array of considerations to navigate. So, after getting limited help from some of the top analytics firms, we took a different approach. We cultivated individual experts on crypto tracing, who could expand on our findings and fact-check them. Because the blockchain is publicly accessible, we could have multiple experts replicate these findings and fact-check the results. Some of the experts who helped us had to remain anonymous in our reporting.

Dealing with Statistics

Major crypto investigative platforms like Chainalysis and TRM Labs regularly publish figures about how much crypto is tied to illicit or criminal activity, sometimes with a year-on-year comparison. Reporters should use these numbers with caution: as additional wallet addresses are tied to sanctions, scams, money laundering schemes, or other illicit or illegal activity, more transactional volume is added to the tally. This means that reporters shouldn’t necessarily compare a newly released report to the previous year’s result; instead they should explain that this is an “at least” estimate that is likely to rise in the months or years following publication.

Academics

We also reported on the accused crypto fraudster and mastermind of an alleged pyramid and Ponzi scheme, Vladimir Okhotnikov. We exposed the inner workings of some of the crypto investment platforms he launched from Dubai after he was indicted in the US for allegedly defrauding investors of more than US$340 million and convicted of money laundering by a Georgian court. Okhotnikov has promoted his ventures at events featuring celebrities and co-produced and starred in a Marvel-Multiverse-inspired movie directed by Kevin Spacey. Okhotnikov’s platforms weaponized so-called smart contracts, self-executing pieces of code written on the blockchain, to allegedly divert money to the contracts’ developers. (He has denied wrongdoing.)

Experts were key to understanding how the schemes worked. We asked several academics to analyze the smart contracts underlying Okhotnikov’s latest platform, Meta Whale, and they found some similarities with Forsage, the crypto investment platform at the center of the US indictment. ICIJ’s investigation also relied on crypto transactions, court documents from Georgia and elsewhere, bank records, and corporate filings of companies used by Okhotnikov and others as part of his schemes. (Okhotnikov didn’t respond to ICIJ’s requests for comment.)

Former Employees

Compliance officers and other previous employees of crypto companies have seen how the sausage is made and are often motivated to speak out about the problems they saw firsthand. (Current employees are also potential sources, but we found former employees felt more comfortable speaking to us and going on the record.) For our stories, they were an invaluable resource for understanding how companies do (or don’t) vet clients and monitor cryptocurrency flows for potential criminal activity. LinkedIn is the best resource for identifying former employees and also provides an easy way to contact them. But their names can also be found in other places, including Facebook and Twitter, as well as in official documents such as corporate filings and press releases.

How to Leverage APIs for Analysis at Scale

Blockchain technology creates terabytes of data that require a lot of computing power to process. Most transactional data is available on public blockchains, but tracing crypto transactions can quickly become overwhelming. While we recommend cross-checking your findings with trustworthy crypto experts, our purpose is to help journalists to develop more confidence in understanding and quantifying crypto flows on their own, so they don’t have to rely solely on external sources for research.

Image: Screenshot, ICIJ

For The Coin Laundry, ICIJ focused on the activities of wallets tied to Huione Group, a Cambodian firm that US authorities say moved money for scam farm operators and North Korean hackers.  Huione did not respond to requests for comment. The data team wanted to develop a methodology that other data journalists could replicate using free or inexpensive resources. We drew a perimeter for our analysis:

1. We focused on the crypto sent by three of these addresses.
2. Those addresses were all on the TRON blockchain.
3. We focused on amounts sent in tether (USDT), a cryptocurrency known as a stablecoin, whose value is pegged one-to-one to the US dollar, making calculating the value of the crypto simple.
4. We knew from previous checks that some of the crypto landed at accounts held by exchanges Binance and OKX. We focused on these two and chose to quantify crypto activity that took place between November 2023 and July 2025 in the case of Binance, and from February 2025 to July 2025 in the case of OKX.

In the case of Binance, the reviewed activity occurred after the company’s 2023 guilty plea and US$4 billion penalty for what then-US Treasury Secretary Janet Yellen called, “willful failures” that “allowed money to flow to terrorists, cybercriminals, and child abusers.” In the case of OKX, the transactions occurred after the company pleaded guilty to violating US anti-money laundering laws in February 2025. Our final aim was to calculate how much crypto flowed from these three Huione Group addresses to accounts at Binance and OKX.

We used data publicly available through the APIs of Arkham Intelligence and Tronscan. Exported data showed transactions in USDT (tether) sent from Huione Group to addresses that Arkham labeled as deposit addresses at Binance and OKX. We verified those labels by analyzing the flow of funds from those addresses to so-called hot wallets that exchanges use to manage deposits and withdrawals. Then the team calculated the hundreds of millions of dollars’ worth of transactions that Huione had sent to accounts at the exchanges in the relevant time periods.

We verified that the exchanges controlled the deposit wallets by including only ones that sent 99 percent of their funds to so-called hot wallets that exchanges use to pool customer funds. We confirmed Binance and OKX controlled those hot wallets with “proof of reserves,” data that the firms post online to assure users they have enough assets to cover customer deposits.

Our data team used Python to program the workflow; one team member stored data in a PostgreSQL database managed by Django whereas the other used makefiles, command line pipelines with pandas, VisiData, and notebooks. The team also used the Python pandas statistical computing library.

Image: Screenshot, ICIJ

Case Studies

Africa

In Kenya, Africa Uncensored investigated how a scam morphed from click-for-pay schemes into a fake crypto investment, preying on trust, local networks, and emerging technologies. This piece looks into how victims were manipulated and exploited.

Asia

The Indian Express covered the investigations of crypto exchanges carried out by Indian authorities and some of the recent “mega crypto scams” allegedly involving Indian operators that were busted by agencies in India and the United States. Reporters also showed how the lack of a legislative framework exposed nearly 120 million Indian investors to financial fraud.

South America

In Ecuador and Colombia, CONNECTAS, along with Vistazo and El Espectador, detailed a multimillion-dollar cryptocurrency investment scheme involving a former television actress, a Christian church, and an allegedly fraudulent online business school that promoted easy money for investors. In reality, thousands of people were reportedly saddled with debt. The ADN Business School promised to help participants earn money quickly with questionable business tactics such as foreign exchange trading, sports betting, and buying up cryptocurrency tokens, according to the outlets. CONNECTAS and Vistazo determined that 176 million in at least 36 different cryptocurrencies was lost before prosecutors could seize the funds in the accounts. The prosecutor’s office in Ecuador confirmed that it had successfully traced those losses to Binance, where the accused masterminds of the ADN Business School scheme had registered several wallets.

In Uruguay, Búsqueda examined a separate criminal complaint against a former rugby player-turned-accused crypto fraudster who fled the country after allegedly stealing millions of dollars from wealthy investors. In Chile, CIPER and LaBot covered the work done by prosecutors to seize funds tied to illicit crypto activity and how crypto scams are multiplying in the country with promises of unrealistic returns.

North America

CBC News, the Toronto Star, and La Presse covered the rise of crypto-to-cash services in Canada and how anyone can use them to wire cryptocurrency to a foreign, unregulated digital wallet and then go collect tens of thousands of dollars in cash anonymously. Two international platforms contacted by an undercover journalist proposed to deliver as much as CAN$1 million (US$712,000) in cash to a location in Montreal in exchange for cryptocurrency.

CNN and the ICIJ found that Circle K, a chain of convenience stores, has made millions by renting space to crypto ATMs – even amid mounting evidence that the machines are playing a key role in international fraud schemes that exasperate local police called repeatedly to the same stores. CNN and ICIJ reviewed more than 150 cases of crypto ATM scams at Circle K stores and spoke to 17 employees who said they witnessed – and sometimes tried to prevent – the fraud while at work, including one who saw a man attack a machine with a sledgehammer to try to retrieve his stolen money. Some said they have discussed the problem with management but have seen little response.

Europe

Several media outlets investigated the connections between US President Trump and the crypto industry, including L’Espresso in Italy and Süddeutsche Zeitung in Germany. Süddeutsche Zeitung covered the rise of crypto scams, the links between crypto and organized crime, and, together with Austrian outlet profil,” the exchange BitPanda. De Tijd and Knack found that Binance, the world’s largest cryptocurrency exchange, had stopped cooperating with the Belgian police and judicial authorities in criminal investigations, and that other major exchanges were also creating barriers when requests came from European law enforcement. Het Financieele Dagblad covered the plight of 25 Dutch victims taking a Caribbean-registered crypto exchange to court for failing to adequately protect users against scammers.

Middle East

Shomrim investigated the activity of Hamas and Iranian-related crypto wallet addresses and their connections to major exchanges.

Spencer Woodman is a reporter at ICIJ based in the US. He was the lead reporter on The Coin Laundry investigation and continues to report on financial crime, including crypto-related crime.

Scilla Alecci is an investigative reporter and video journalist for ICIJ. She is also partnership coordinator for Asia and Europe and an ICIJ member. She has led several investigative projects for ICIJ, including Deforestation Inc. and China Targets. 

Ben Dooley is a reporter for ICIJ based in Washington, DC. He has covered Asia for over a decade, starting as a reporter in Washington and Beijing for Japan’s Kyodo News.

Annys Shin is ICIJ’s deputy managing editor, based in Washington, DC. Previously, Annys worked for The Washington Post as a business reporter, an editor for The Washington Post Magazine, and most recently as social issues editor for the newspaper.

Agustin Armendariz (Augie) is a senior data reporter at ICIJ, based in the US. Prior to joining ICIJ Augie was a reporter at The New York Times, contributing data analysis to investigative stories and the daily report. He’s also worked for the Center for Investigative Reporting, San Diego Union-Tribune and the Center for Public Integrity.

Miguel Fiandor Gutiérrez is a data engineer at ICIJ, based in Spain. Since joining ICIJ in 2015, Miguel has been involved in technical projects for ICIJ’s Data Unit, including ICIJ’s Panama Papers investigation. He has developed tools for data cleaning, transformation and analysis, and also works on web and database development and other data processing.

Delphine Reuter is ICIJ’s head of data and research since 2023. She’s coordinated the work of ICIJ’s Data Unit on several investigative projects. Prior to leading it, she worked as a data journalist on the team. She’s based in Spain.