Investigating Cryptocurrency: Key Questions and Tips for Reporters

Criminal activity tends to thrive where state oversight is weakest, so it’s no wonder that cryptocurrencies are the financial tool of choice for criminals around the world.

“We’re seeing an increasing use of cryptocurrencies. There’s a tremendous growth,” said Federico Paesano, senior financial investigation specialist at the Basel Institute on Governance, a nonprofit focused on strengthening governance and combating corruption.

Cryptocurrency can be an intimidating topic for journalists, and it’s hard to know where to start. A workshop at the 13th Global Investigative Journalism Conference (#GIJC23) — featuring the Basel Institute’s Paesano and moderated by Paul Radu, co-founder and head of innovation at the Organized Crime and Corruption Reporting Project (OCCRP) — discussed key questions and tips to help reporters get their bearings in an increasingly important investigative journalism beat.

Key Questions for Understanding Cryptocurrency

What is a cryptocurrency? Instead of carrying physical coins around, the Yap people of Micronesia measured their wealth according to enormous limestone rocks no individual person could move. Paesano used this analogy to describe cryptocurrencies (crypto, for short). Having crypto amounts to being the next transaction in a ledger: You access your ownership through a password or address to this highly encrypted ledger, which cannot be altered except by irreversible transactions, and which is distributed amongst all cryptocurrency holders. (For more background on crypto, check out the US Federal Trade Commission’s explainer.)

What is a blockchain? A blockchain is the ledger described above, which contains the history of all the transactions made by everyone who has traded in that cryptocurrency. Each cryptocurrency has its own blockchain. Bitcoin’s blockchain size, for example, is 500GB.

What is a cryptocurrency wallet? A wallet is where you store your crypto keys, which are used to confirm your identity and link to your cryptocurrency. When you enter your wallet, you will be able to conduct transactions with these keys.

What is a cryptocurrency cluster? Through clustering, you can link several wallets that all belong to you. Most of the time this cluster is the information publicly shared to receive funds, and it may look like a string of letters and numbers.

Is all crypto Bitcoin? Bitcoin is one type of cryptocurrency, with its own blockchain and features. Not all crypto is created equal: Bitcoin is more decentralized when compared to Ethereum, for example.

What makes crypto attractive? Given that not all crypto are the same, these features don’t apply to all cryptocurrencies, but in general crypto is attractive for several reasons.

• Transactions are irreversible, meaning no institution can block the flow of a transaction.
• It’s decentralized, which means no authority can have control over the assets.
• It’s secured by very complex cryptography, so hackers, theoretically, can’t steal it from you. (In fact, by exploiting various vulnerabilities, hackers stole billions in cryptocurrency in 2022.)
• It’s permissionless, so you don’t need a private or public institution to approve a transaction.
• It protects your privacy to some extent, so a government cannot seize your assets.
• It protects you from the volatility of some national currencies’ inflation, although the value of crypto itself may be highly volatile. (For example, the US dollar value of Bitcoin jumped 300% between November 2020 and November 2021 — from $16,000 to $64,000 — but then collapsed back to its previous value just 12 months later.)

How are criminals advancing in the crypto market and how much do they use crypto? Although the percentage of criminal transactions in crypto compared to the percentage of transactions in traditional currencies is still small, the resources transferred by criminals through crypto is growing. Also, as discussed in other sessions at GIJC23, extremist groups seem to be favoring cryptocurrencies for their transactions, so investigative journalists should be familiar with the basic principles of cryptocurrencies.

Tips for Investigating Cryptocurrencies

• Know what crypto keys and passwords look like and the devices where they might be stored. A password to conduct crypto transactions might be scribbled on a piece of paper, saved in a USB drive, or even stored in the cloud. Familiarize yourself with what passwords look like.
• Try to find physical exchange offices where crypto passwords are sold for cash money. Paul Radu, from OCCRP, suggested finding these exchange offices and buying crypto from them to find out their wallets’ addresses, then going to public sources to try and trace transactions.
• Use open source investigation to track criminal cryptocurrency addresses and clusters. People, including criminals, may post their cluster for several purposes, such as selling products or receiving funds. Searching on forums and platforms on the dark web or the regular internet might give you clues. Be sure to follow online safety procedures when conducting searches in webpages and forums frequented by criminals or extremists. Never navigate without a VPN!
• Familiarize yourself with how transactions take place in the crypto space. If you want to pay 0.5 Bitcoin, you cannot split a crypto address with 1 Bitcoin into two 0.5 Bitcoins. Instead, you must first send 1 Bitcoin, which is called an input, and then the outputs will be the 1 Bitcoin you sent and the 0.5 Bitcoin the sender forces his receiver to send as “change.” Unless you want to send the exact amount of coin in your address, one input produces at least two outputs. The technical term for these procedures is “heuristics.”
• Go from pulling a thread to finding a web. Once you understand the dynamics of heuristics, and that one single person can have several addresses, you can take your searches to the next level and start to follow many different transactions from addresses you know belong to the same person. That’s why the single thread of a crypto address can lead investigators to a whole web of transactions.
• Understand how to use ‘blockchain explorers.’ You will need to use a blockchain explorer software to navigate the transactions conducted with cryptocurrency. Paesano used WalletExplorer as an example during the session.
• Familiarize yourself with the obfuscation techniques used by criminals. Look up obfuscation techniques such as Zk-SNARKs, Ring Signatures, Stealth Addresses, MimbleWimble, Mixing, Lightning Network, Chain Hopping, Exchanges, and CoinJoin. These are not used only by criminals, but if your target criminal wants to hide the transactions then it’s likely done through one of those techniques.
• Look for conferences on criminal finances you can attend. Conferences such as the Global Conference on Criminal Finances and Cryptocurrencies are useful for collecting information and establishing contacts with law enforcement officials.
• Contact organizations that monitor cryptocurrency. Paul Radu, from OCCRP, suggested using and contacting the Elliptic platform when conducting investigations.

Getting familiarized with cryptocurrency may demand a steep learning curve, but a growing number of criminal transactions, and transactions between governments and criminals, are conducted in crypto. As a closing suggestion, Paesano recommended that journalists interested in learning about crypto consult the resources of the Basel Institute on Governance, such as their guide to cryptocurrencies and money laundering investigations.