Register for our next deep dive! Learn how to equip your team with strategies and tools to detect and dismantle organized crime on Thursday, July 25, 2024, at 16:00 CET.Register now! close
09 Dec 2021

Cryptocurrency Investigations with Maltego: Tips & Tricks for Bitcoin and Ethereum Movement Analysis and Visualization

Vladimir Mikhnovich

Cryptocurrency Fraud and Scams 🔗︎

With the skyrocketing popularity and high adoption of cryptocurrencies, as well as increased interest from the general public, crypto frauds and scams are unfortunately also on the rise today. These illicit activities often entice gullible people on social networks into shady and fraudulent schemes which at the end may cost them a lot of money.

Crypto frauds and scams investigations can be performed from different perspectives. The ultimate goal of online fraudsters is cashing out the stolen funds. In the cryptocurrency world, various exchange services are used for that. This said, the first and foremost problem to investigate is “following the money”: Basically, this means tracing funds until their final destination in an attempt to take a legal action, as licensed crypto exchanges are subject to regulation and compliance with KYC / AML procedures.

Example Cases 🔗︎

Maltego is a powerful tool for link analysis and investigation, and in real life cases, it can be used together with other specific tools (both free and proprietary) which help an investigator in obtaining additional data and building a complete picture.

In this article, we will highlight different methods which can be used for investigating crypto fraud and scam schemes, and following cryptocurrency network activity. We will use only free Maltego Transforms (namely, Transform set), and also complement the investigation by using some free external tools to get additional data related to investigation.

We will go through the investigation process of a few cases:

  • Investigating activity and flow of funds related to two scammer’s Bitcoin addresses
  • Visualizing activity of a fraud related address in Ethereum network

Bitcoin Investigation Concepts 🔗︎

Some of the readers have probably met this kind of scam activity on Instagram and other social networks. A stranger approaches you in the chat and talks you into “investing” in Bitcoin trading or mining, with promises of immediate sky-high returns.

Actual schemes can vary, but at the end they all boil down to talking a victim into sending bitcoins to some Bitcoin address controlled by the attacker. In our case, a scammer uses Instagram chat to encourage victims to register on a website they share, which then requires the victim to send a “deposit” to a specified Bitcoin address. It’s very easy to guess that a victim will never see their money again once they send it.

Below are some screenshots from a chat as it happened on Instagram, where a scammer reveals a Bitcoin address to which a victim is expected to send money:

Bitcoin address revealed on Instagram

As the first example, we will investigate this scam address. The actual scam attempt happened in April, so we need to investigate April activity and money flow related to the scammer’s Bitcoin address.

Aims of the Blockchain Investigation 🔗︎

As we already mentioned, the main objective an investigator must keep in mind is to follow the money and understand the relation of the investigated scammer’s address with key entities of interest on the Bitcoin network, like crypto exchanges which are used for cashing out the funds.

Below is an example of one graph we came up with, which shows a logical connection between the investigated wallet and the Binance crypto exchange, which in our case can be a place for cashing out the funds originated from scammer’s address:

Connection between investigated wallet and Binance crypto exchange.

In the following chapters, we will follow a step-by-step process to see how this certain graph is built starting from a single Entity, in our case a scammer’s Bitcoin address.

We will also learn how to work with large graphs in Maltego (containing thousands of Entities) representing Bitcoin transactions and narrow down the most interesting and important Entities.

How do you think we will be able to extract valuable information from the following graph with over 8000 Entities?

Extract valuable information from Maltego graph with over 8000 Entities.

Transaction-based Network Concept 🔗︎

One must have noticed that Bitcoin transactions presented in the Maltego graph follow the same concept: Bitcoin Address Entities are connected with each other through Transaction Entities.

One may ask, why bother putting on the graph bitcoin transactions and addresses using separate transforms? Cannot we make it simpler and trace the bitcoins movement directly from address to address? Actually, no, and there’s a reason for that.

Remember that the Bitcoin network is transaction-based, and it is essentially a transaction which is recorded into the blockchain. Each transaction may have multiple input and output addresses, so nominally any bitcoin address (unlike for example, a bank account) does not hold any bitcoins: its “balance,” hence the spending ability, is only defined by the sum of all input transactions.

Let’s take a look at a very simple example to illustrate this concept.

Consider a single bitcoin address to which we apply To Destination Addresses Transform:

Run To Destination Addresses transform in Maltego

This graph shows that address 17vbVho6aEGT7kam1fknv7cRaAYQPcsQFm has sent some funds to addresses 3NnbNTFTQRBaQrg9vScT7QsJPFGpoKKMXG and 13FzgbegEAUhE1GcsLYiJ8BiXLrEdwCshV, but we don’t know the exact amounts sent, and we also don’t know if they were sent at the same or different times.

Now let’s actually see how we can add transaction entities to this graph.

On first step we run the To Outbound Transactions [] Transform for 17vb… address and get one Transaction Entity, which is 8e19f01bea18872fbc05af889b60c5c91ecd2f2c7264f803b16bb28c650a4775:

Run To Outbound Transactions [] Transform in Maltego

On the next step we run the To Destination Addresses [] Transform on this transaction:

Run To Destination Addresses [] Transform in Maltego

Voila! Now we have a transaction on the graph which is connected to the same destination addresses, but we also see the amounts (shown as links labels) and understand that bitcoins were moved in the course of a single transaction with one input 17vb… and two outputs 3Nnb… and 13Fz….

Tip: We can switch the links labels from custom format which shows transaction amount (uncheck Show Custom Link Labels) to transform names (check Show Transform Link Labels) in View menu:

 Switch the links labels from custom format within Maltego

Using this tip, the logic of using blockchain Transforms in a proper way (Address → Transaction → Address) is illustrated even more clearly by the corresponding labels:

the logic of using blockchain transforms illustrated in more clearly way.

In order not to overload the picture with redundant information, in real life cases we actually don’t need to use any links “Address → Address” on the graph. This said, the final correct graph view would be this:

Maltego graph without links ‘Address → Address’

So far, for all following graphs we will follow the same principle of tracing flow of funds: Address → Transaction → Address.

More on Building Graphs of Bitcoin Transactions and Visualizing Ethereum Activities 🔗︎

Download the complete whitepaper now to learn more about how to conduct follow-the-money investigations on the Bitcoin and Ethereum blockchains. In this whitepaper, you will learn:

Bitcoin Investigations 🔗︎

  1. How to trace and build comprehensive graphs of Bitcoin transactions
  2. The step-by-step process of finding important Bitcoin addresses
  3. Case Study: Analyzing large Bitcoin graphs

Ethereum Investigations 🔗︎

  1. How to visualize activities on the Ethereum network
  2. Working with and importing external data sources into Maltego
  3. Case Study: Analyzing large Ethereum graphs

Other Useful Cryptocurrency Integrations in Maltego 🔗︎

Besides, Maltego also integrates with cryptocurrency intelligence data sources like CipherTrace and Tatum. Both CipherTrace and Tatum allows investigators to expand their cryptocurrency analysis to blockchain infrastructures other than Bitcoin, such as Ethereum, Bitcoin Cash, Litecoin, and more.

Check out CipherTrace and our flexible data subscriptions, or try out Tatum for free!

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua And Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia and Herzegovina +387
Botswana +267
Brazil +55
Brunei Darussalam +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Cote d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus +90392
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands (Malvinas) +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea-Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran, Islamic Republic of +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea, Democratic People's Republic of +850
Korea, Republic of +82
Kuwait +965
Kyrgyzstan +996
Lao People's Democratic Republic +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libyan Arab Jamahiriya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia, the former Yugoslav Republic of +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mauritius +230
Mayotte +269
Mexico +52
Micronesia, Federated States of +691
Moldova, Republic of +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Island +672
Northern Mariana Islands +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russian Federation +7
Rwanda +250
San Marino +378
Sao Tome and Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovakia +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
Saint Helena +290
Saint Kitts and Nevis +1869
Saint Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syrian Arab Republic +963
Taiwan +886
Tajikistan +7
Thailand +66
Togo +228
Tonga +676
Trinidad and Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +993
Turks and Caicos Islands +1649
Tuvalu +688
Uganda +256
United Kingdom +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
United States +1
Uzbekistan +7
Vanuatu +678
Holy See (Vatican City State) +379
Venezuela +58
Viet Nam +84
Virgin Islands, British +84
Virgin Islands, U.S. +84
Wallis and Futuna +681
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

Don’t forget to follow us on Twitter and LinkedIn or subscribe to our email newsletter to stay tuned to more updates, tutorials, and use cases.

Happy investigating!

About Vladimir Mikhnovich 🔗︎

Vladimir is an expert and consultant in data science, fraud detection, blockchain investigations and open source intelligence (OSINT). His current research interest is in the field of online scam prevention and awareness, which includes both technical and social aspects of modern con artistry involving cryptocurrencies. He runs a consulting company and is also involved in public speaking, writing articles and educating on the subject matters.

To learn more about Vladimir’s work, visit his LinkedIn profile.

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.