Skip to content
CIM-190 Cyber Incidents & Offender Methods

What can a cryptocurrency payment prove?

The practical answer

A cryptocurrency payment can show that a transaction occurred between blockchain addresses under the rules of the relevant network.

The key evidential caution

The dangerous assumption is that the payment address identifies the offender personally.

It does not.

A transaction may show:

Key points

  • the amount
  • sending and receiving addresses
  • time or block position
  • transaction identifier
  • later movement of funds
  • links to other addresses or services

It does not automatically show:

  • who controlled the wallet
  • who authorised the payment
  • who received the economic benefit
  • whether the address belonged exclusively to one group
  • whether funds were later cashed out by the offender

Evidence to preserve

Investigators should preserve:

Key points

  • the exact address
  • transaction identifier
  • currency and network
  • amount
  • time
  • exchange or payment-service records
  • negotiation context
  • wallet screenshots or exports
  • later tracing results

Addresses may be reused, generated per victim, controlled by affiliates or held by intermediaries.

Attribution may require provider records, seized devices, exchange data and wider financial analysis.

Evidential limits

Do not describe blockchain records as anonymous or as direct personal identification.

Blockchain analysis should also distinguish direct receipt from later movement through exchanges, mixers, bridges, services or intermediary wallets. A payment path may support linkage and investigative requests, but each hop has its own attribution limits and may involve automated or pooled transactions.

Where an exchange or payment service is involved, obtain preservation using the precise address, transaction identifier, asset, network and time. Similar-looking assets may operate on different networks, and an address copied incorrectly can direct enquiries towards the wrong service or transaction.

Operational takeaway

Use the transaction to prove movement between addresses, then build personal and organisational attribution from provider, device, negotiation and financial evidence.

Keep moving

Where this question leads

These links explain why the next page may matter, rather than presenting an undifferentiated list.