Crypto Address Investigation for SOC Analysts: What the Chain Can and Cannot Tell You

Every scam ends in an address

Sooner or later a wallet address lands in your queue: in a ransom note, a sextortion email, a fake supplier invoice, a malicious browser extension that swaps clipboard contents, or a drainer kit behind a phishing site. The SOC question is rarely "who is this person". It is usually narrower:

• Is this address known (sanctioned, reported, linked to a campaign)?
• Has it received money, and is the money still there?
• Does it connect this incident to others we have seen?
• What do we hand to legal, insurers or law enforcement?

Public blockchains answer more of these than people expect, and fewer than vendors imply. Here is how to work them as an analyst, not a forensic accountant.

Step 1: identify the format

The address format tells you the chain, and the chain tells you what is even possible.

The EVM row deserves emphasis. A 0x address in a phishing kit could be receiving funds on Ethereum, BNB Smart Chain, Polygon or a dozen others. Check them all, and look at token transfers (USDT, USDC), not only the native coin balance.

Step 2: read the address history

For transparent chains (Bitcoin, Ethereum, Tron and most others), every transaction is public. For a single address, note:

• First and last activity. An address created the day before the ransom note was sent is probably single-use for this victim. One active for years is reused infrastructure.
• Total received and current balance. Has anyone paid? Is the money still sitting there (freezable at an exchange) or already moved?
• Counterparties. Where funds came from and went. Labelled services (exchanges, payment processors, known scam clusters) are the most valuable data points.
• Token activity. On EVM and Tron, stablecoin transfers are the usual payload, and some stablecoin issuers can freeze tokens at an address on legal request.

Step 3: clustering, the heuristics behind "this wallet"

An address is not a person. A wallet controls many addresses, and analytics tools group them into clusters with heuristics. Know them, because every attribution you read is built on them.

Common-input ownership (Bitcoin and UTXO chains)

If one transaction spends inputs from addresses A, B and C, the same entity probably holds all three keys, because it had to sign for each. This heuristic is old (the Bitcoin whitepaper itself notes that multi-input transactions reveal common ownership) and it is the backbone of Bitcoin clustering.

It breaks on CoinJoin, where several unrelated users deliberately combine inputs into one transaction, and on some exchange and payjoin flows.

Change detection

A Bitcoin payment typically sends one output to the recipient and one back to the sender as change. Guessing which output is change (fresh address type, non-round amount, matching script type) extends a cluster. It is probabilistic, and errors compound as clusters grow.

Account-model behaviour (Ethereum, Tron)

Account chains reuse one address, so clustering relies on behaviour instead: deposit addresses that forward to the same exchange hot wallet, contracts deployed by the same address, funding of many fresh addresses from one source (typical of drainer operators and airdrop farmers), and timing patterns.

Step 4: where trails go cold

Mixers and CoinJoin

Mixers pool funds from many users and pay out from the pool, breaking the link between deposit and withdrawal. Some are custodial services, others are smart contracts such as Tornado Cash on Ethereum. Sanctions and enforcement have repeatedly targeted them: OFAC sanctioned Tornado Cash in 2022 (later litigated and lifted in 2025), and the founders of the Samourai Wallet project were arrested in 2024. Analysts can still sometimes link deposits and withdrawals through amounts, timing and operational mistakes, but treat such links as weak.

Bridges and chain-hopping

Cross-chain bridges lock funds on one chain and release equivalents on another. Moving stolen ETH to Bitcoin, or USDT from Ethereum to Tron, is routine laundering. Some bridges are traceable (the source and destination transactions reference each other), others use pooled liquidity that behaves like a mixer. North Korean operators are well known for heavy bridge and swap use; the FBI attributed both the 2022 Ronin bridge theft and the February 2025 Bybit theft to DPRK actors.

Privacy coins

Monero hides sender, receiver and amount by default. You can confirm an address is a valid Monero address and little else. When a ransom note demands Monero, on-chain analysis is essentially over and the investigation moves to exchanges and off-chain evidence.

Custodial exchanges

Funds deposited to a centralized exchange disappear into its internal ledger. On-chain, you see the deposit address and the hot wallet, not the account holder. That is where legal process, not analysis, takes over, and it is often the most productive point in the whole trail because exchanges hold KYC data.

Legal care: what an analyst should and should not do

On-chain data is public, but what you do with it is not unregulated.

• Never transact with the address. Do not send "test" payments or dust, do not interact with suspicious contracts, and never connect a wallet to a phishing page to "see what it does". Interacting can expose you to sanctions issues and alerts the operator.
• Screen against sanctions lists. OFAC's SDN list includes crypto addresses, and EU sanctions apply to EU entities. If a ransom address or its cluster is sanctioned, paying may be illegal. That is a decision for counsel, not the SOC.
• Remember GDPR. An address linked to an identifiable person can be personal data. Keep investigation notes inside a case with a clear purpose and retention, not in a shared spreadsheet.
• Preserve evidence properly. Record transaction hashes, block heights, timestamps (UTC) and the explorer or tool used. Screenshots alone are weak; hashes are verifiable by anyone.
• Report early. Law enforcement and exchanges can sometimes freeze funds, but only if they hear about it while the money is still there. Hours matter.
• Stay in your lane on attribution. "This address received funds from a cluster labelled X by tool Y" is a finding. "This is actor Z" needs far more, see from IOC to adversary attribution.

A minimal SOC workflow

1. Extract addresses from the artifact (note, email, kit, clipboard malware config).
2. Identify chain(s); for 0x addresses, check every EVM chain you can.
3. Look up each address: reputation, reports, sanctions hits, balance, activity window.
4. Note first-hop counterparties and any labelled services.
5. Stop at mixers, privacy coins or exchanges; record the handoff point.
6. Log everything in the case with tx hashes and UTC times.
7. Escalate: legal (sanctions, payment decisions), law enforcement, exchange abuse desk.

Use /cases to keep addresses, hashes and notes together, and see our ransomware first 24 hours guide for where crypto fits in the wider response.

Takeaways

• The format tells you the chain; 0x means "every EVM chain", so check them all.
• Clustering is heuristic. Label sources and confidence in every report.
• Trails go cold at mixers, privacy coins and bridges, and resume at exchanges through legal process.
• Never transact, always screen for sanctions, and treat addresses as potentially personal data.
• Speed matters more than depth: a report while funds are still at a freezable address beats a perfect graph a week later.