Commentary, analysis, and news on Bitcoin forensics, regulation, and investigation practice.
A fake Trezor Suite, promoted through hijacked Google ads, has been harvesting the recovery seeds of hardware wallet users since late October 2026. We traced the bitcoin side: two collector addresses, one sweep, a peel chain and a custodial service where two other scams cash out as well. Plus a trap that catches experienced tracers too.
Read more →
On 29 October 2026, 18,270 BTC left the Binance hot wallet and sat in 19 addresses a quarter of an hour later. Along the way the blockchain shows two different handwritings. What they reveal about the attack, where the tools of forensics reach their limits, and why the fingerprint of the attacker's wallet now matters more than any address list.
Read more →
A wallet opens a Lightning channel with 1 BTC. A day later the channel is closed and 0.04 BTC come back. Where the rest went is written nowhere on the blockchain. Why Lightning does not hide the money trail but moves it, and why both edges remain readable.
Read more →
On 6 September 2026 an attacker created around 4,000 unbacked L-BTC on the Liquid Network and redeemed them as real bitcoin through the regular peg-out. What the case teaches about chain boundaries and why the trail on the Bitcoin side starts at the federation.
Read more →
From 30 July 2026, more than 7,000 Bitcoin addresses belonging to Coldcard users were drained in a few waves, with losses above 130 million US dollars. The cause was not a hack but a random number generator that had not produced real randomness since 2021. An analysis from a forensic perspective.
Read more →
With its 21st Russia sanctions package, the EU bans dealings with 14 crypto platforms, including HTX and EXMO, from 23 August 2026. Why a transaction ban differs from an OFAC listing and what it means for assessing payment flows.
Read more →
From August 2026, the high-risk obligations of the EU AI Act take effect - affecting blockchain forensics tools with ML components as well. What does this mean for authorities, banks and investigators using such systems?
Read more →
On 21 February 2025, 1.5 billion USD vanished from a Bybit cold wallet - the largest crypto theft of all time. One year later, the on-chain data shows how the trail faded into cross-chain swaps toward Bitcoin - and how it resurfaced.
Read more →
A sober look at twelve months of Bitcoin economics: mixer takedowns, mining pool consolidation, cross-chain shifts, and the developments that will shape 2026.
Read more →
THORChain allows direct swaps from BTC to ETH, BNB, and many other coins - without a centralised exchange and therefore without KYC. A challenge for investigators. A technical look at how we reconstruct the trail.
Read more →
With the EU AMLA package and the 6th Anti-Money Laundering Directive, AML rules are being harmonised across Europe. What does this concretely mean for banks with crypto exposure?
Read more →
From 2026, EU CASPs must report extensive tax data about their customers to tax authorities. What exactly does DAC8 require - and what does this mean for tax investigators?
Read more →
In August 2022 the US Treasury placed the Ethereum mixer Tornado Cash on the SDN list. Two years later we ask: how effective was the listing - and what does it mean for European investigators?
Read more →
Since 30 June 2024, the first parts of the Markets in Crypto-Assets Regulation (MiCA) apply. A quick overview of the timeline, KYT obligations, and what it means for investigators.
Read more →