Chapter 33 — Key Takeaways

The big idea

A blockchain inverts this book's first theme: where deleted ≠ destroyed describes data that persists until overwritten, a blockchain is a ledger where nothing is ever deleted or overwritten at all — it is public, permanent, and global. The catch is that it records addresses, not names. Cryptocurrency is pseudonymous, not anonymous, and the entire discipline is the science of bridging the gap between a pseudonym and a person. You never have to break the cryptography. You have to read the chain, group addresses into entities, follow the money to the point where it touches the regulated world, and let legal process turn a pseudonym into a KYC identity. The coins and chains keep multiplying; the method does not change.

Read the chain

• Pseudonymous ≠ anonymous. Every action a pseudonym takes is linked forever to that pseudonym; one identification radiates across the whole cluster. The asymmetry favors the investigator — the history is already public, for every address, forever.
• UTXO model. There is no stored "balance"; a balance is the sum of unspent outputs. A transaction consumes inputs (each must be signed) and creates outputs; inputs − outputs = the miner fee. Reason in satoshis (1 BTC = 10⁸), never floating-point BTC.
• TXID = double-SHA-256 of the serialized transaction, 64 hex chars — an integrity check on the whole transaction. Address formats are identifiable on sight: 1… (P2PKH), 3… (P2SH), bc1q… (SegWit), bc1p… (Taproot); 0x… 40-hex (Ethereum); 4…/8… (Monero).

Turn addresses into entities (and know where each heuristic fails)

State every grouping with its heuristic and known failure mode. "High-confidence grouping by the common-input heuristic; no CoinJoin structure present" is defensible — "these are definitely the same person" is not.

Follow the money to a chokepoint

• Laundering shapes: the peeling chain (small peels off a big pot via fresh change addresses — ironically easy to follow because the change heuristic stitches it); mixers/tumblers and CoinJoin (sever the deposit↔withdrawal link); chain-hopping (BTC→XMR→stablecoin to break continuity).
• The strategic truth: crypto is pseudonymous in the middle, but value must enter and exit through the regulated world. Pseudonymity collapses at the on-ramp/off-ramp chokepoint.
• At the chokepoint: a regulated exchange is an MSB under the Bank Secrecy Act — KYC, AML monitoring, SARs/CTRs, and the Travel Rule (FinCEN $3,000; FATF $1,000). It knows the account's name, ID, bank link, and device history. You supply the predicate (specific deposit TXIDs/dates); counsel supplies the instrument (subpoena/order/warrant, or MLAT if the exchange is abroad). Screen against the OFAC SDN list.

Wallet forensics and the dual-purpose crack

• Whoever controls the keys controls the coins. A wallet holds keys, not coins. Identify wallet.dat by header — Berkeley DB magic 0x00053162 (legacy) or SQLite format 3\0 (descriptor); mkey/ckey ⇒ encrypted. The seed phrase is the wallet. MetaMask's encrypted vault lives in LevelDB under extension nkbihfbeogaeaoehlefnkodbefgpgknn; a hardware wallet is a wall for keys but its companion app's xpub lets you trace watch-only.
• One command, two disciplines. hashcat -m 11300 (wallet.dat; 16600 Electrum, 26600 MetaMask) with a targeted wordlist from the custodian's own artifacts serves a 💾 owner-recovery and a 🔍 warranted seizure identically. The only difference is authority — consent of the true owner, or a court's order. That single fact is the whole ethical weight of the work.

Ethereum, privacy coins, and honest limits

Ethereum's account model breaks the common-input heuristic; cluster on deposit reuse and behavior, and exploit the stablecoin freeze (Tether/Circle can blacklist at LE request — an endpoint Bitcoin lacks). Monero (ring signatures + stealth addresses + RingCT) resists on-chain tracing outright today; Zcash shields some value but mostly moves transparently. When the chain goes dark, say so and pivot off-chain — that is theme five, not failure.

You can now…

• ☐ Explain pseudonymous, not anonymous and read a transaction's inputs, outputs, satoshi amounts, fee, and TXID off a public explorer.
• ☐ Cluster addresses with the common-input and change heuristics, and recognize where CoinJoin and the account model defeat them.
• ☐ Trace through peeling chains, mixers, and chain-hops to a chokepoint, and draft the precise, jurisdiction-aware subpoena predicate that turns a deposit into a name.
• ☐ Locate and identify wallet artifacts — wallet.dat, BIP39 seed phrases, the MetaMask vault, hardware-wallet companion data — and frame lawful password recovery for an owner or a seizure.
• ☐ State every clustering, tracing, and attribution finding with its underlying heuristic and known limit, and preserve on-chain evidence (TXID, height, time, hashed export, ideally your own full node) to chain-of-custody standards.

Looking ahead

Chapter 34 — IoT, Vehicle, and Embedded Device Forensics. Leave the global ledger for the physical world of tiny computers everywhere — smart-home hubs, car infotainment and telematics, wearables, raw embedded flash — where the artifacts are weirder and the storage is rawer, and where, once again, technology changes, principles don't.

One sentence to carry forward: The blockchain never forgets — laundering raises suspicion rather than removing it — so you don't break the cryptography, you follow the money to where it touches the regulated world and let the law name the pseudonym.