A public blockchain gives investigators a permanent, searchable record of transfers, and machine learning can help sort very large sets of those transfers, but evidence still has to meet the older rules of digital forensics: preserved integrity and a documented chain of custody. In the best-documented US case, the Justice Department seized 63.7 bitcoins on June 7, 2021 after reviewing the Bitcoin public ledger. The announcement did not say that AI was used.
Key takeaways
- A blockchain records addresses and amounts, not names, so linking an address to a person needs other evidence.
- The Justice Department's June 7, 2021 Colonial Pipeline seizure relied on following transfers on the public ledger and on the FBI holding the private key for one address.
- NIST SP 800-86 defines digital forensics as work that preserves the integrity of information and maintains a strict chain of custody.
- Academic work applies graph neural networks to flag unusual Bitcoin transactions, but flags are leads for a human reviewer, not proof.
- Since 2021 the scale of the problem has grown: a January 2026 industry report counts at least USD 154 billion in illicit crypto volume for 2025, and a US Justice Department strike force reported restraining over USD 700 million in April 2026.
What a public ledger gives an investigator
Bitcoin and similar networks keep every transaction in a shared record that anyone can read. Each entry shows the sending and receiving addresses, the amount, and the time. Value can be followed from one address to the next, which cash and closed bank systems do not allow. The record does not show who controls an address. Identity has to come from outside sources, such as the account records of an exchange that holds customer information, or from evidence found on a seized device.
The Justice Department's own description of the Colonial Pipeline case shows the method at its plainest. Colonial reported paying a ransom demand of approximately 75 bitcoins. According to the supporting affidavit, law enforcement reviewed the Bitcoin public ledger, tracked multiple transfers, and identified approximately 63.7 bitcoins that had moved to a specific address for which the FBI had the private key. The department valued the seized amount at approximately USD 2.3 million on the day it announced the seizure.
Where machine learning enters the work
Manual tracing works for one case. Compliance teams face millions of transactions and need some way to decide which ones deserve a person's attention. A 2022 paper by Nadia Pocher and colleagues, posted to the arXiv preprint server, treats a real Bitcoin dataset as a directed graph and applies graph convolutional networks and graph attention networks to classify transactions as anomalous or not. The authors report that the convolutional networks outperformed classic approaches. The abstract gives no accuracy figures, and the work is a research study, not a deployed system.
The same paper stresses explainability and cooperation between public agencies and private firms. In practice, a score from a model cannot be shown to a court as a finding of fact. It works as a lead that an analyst confirms against other records.
Red flags are patterns, not verdicts
The Financial Action Task Force (FATF), the international anti-money laundering standard setter, published red flag indicators for virtual assets in September 2020. They rest on more than one hundred case studies collected since 2017. The report states that a single indicator does not necessarily indicate criminal activity and that suspicion usually arises when several indicators appear together in a transaction with no logical business explanation. Automated screening fits that structure well, because software can count indicators across many accounts. The decision to report or act remains with a person.
The chain-of-custody requirement still applies
NIST Special Publication 800-86, published in August 2006, describes digital forensics as the application of science to the identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody. The guide describes a four-phase process: collection, examination, analysis, and reporting. After a drive is imaged, it advises verifying that the copy is an exact duplicate by computing a message digest, a hash that changes completely if a single bit changes. The specific algorithms named in a 2006 document are dated, but the principle of proving that a copy matches the original is unchanged.
This is the link to blockchain on the evidence side. Some proposals store a hash of an evidence file on a ledger so that later tampering can be detected. The ledger can show that a file existed in a given form at a given time. It cannot show that the file was collected lawfully or that its contents are true.
What changed since 2021
The Colonial Pipeline seizure was small next to what followed. Chainalysis, a blockchain analytics firm, reported on January 8, 2026 that illicit addresses received at least USD 154 billion in 2025, a 162 percent rise over 2024, which it calls a lower-bound estimate. The jump was driven by a 694 percent increase in value received by sanctioned entities, and illicit activity remained under 1 percent of attributed transaction volume. Stablecoins, tokens pegged to a fiat currency, made up 84 percent of illicit volume in that report.
On the enforcement side, the Justice Department announced on April 23, 2026 that its Scam Center Strike Force had restrained more than USD 700 million in cryptocurrency tied to money laundering from scams, along with seized domains and a Telegram channel. The release credits voluntary action by cryptocurrency providers and US legal process, does not describe tracing methods, and does not mention AI. NIST SP 800-86 remains listed as a final publication, dated 2006, with no revision shown on its page. Whether machine learning contributed to these cases is therefore still not documented in the public releases. This page is general information, not legal advice.
Checklist for claims about AI blockchain forensics
| Claim | Question to ask | What a credible answer includes |
|---|---|---|
| The tool identifies the owner of a wallet | What non-ledger evidence supports the link? | Exchange records, device evidence, or a court order |
| The model detects illicit transactions | What was it tested on, and what are its error rates? | Published evaluation with false positives and misses |
| The output is court-ready | Can an examiner explain how the result was produced? | Logs, software version, and a documented method |
| A ledger entry proves the evidence is authentic | What does the entry actually record? | A hash and a time only, with custody records kept separately |
The table is an illustrative review aid, not a standard. Rules on admissibility differ by country and by state or province, and a lawyer should be consulted on any real matter.
FAQ
Does blockchain make crypto transactions anonymous?
No. Bitcoin is pseudonymous: transfers are public but addresses are not tied to names. Linking an address to a person requires additional evidence.
Was AI used to recover the Colonial Pipeline ransom?
The Justice Department's announcement credits review of the public ledger and the FBI's possession of a private key. It does not mention AI.
Can a machine learning flag be used as proof?
Research systems output flags that point reviewers to transactions worth checking. Proof requires corroborating records and a method that an examiner can explain.
Can a blockchain protect digital evidence from tampering?
It can record a hash of a file at a point in time, which helps detect later changes. It does not establish that the evidence was collected properly or is accurate.
Related reading
- What ledgers can and cannot add to AI systems
- AI-generated content and copyright
- Deloitte AI Institute profile
- How AI is changing work
More in AI in finance.
Last verified: October 2026
Sources
- Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists Darkside, US Department of Justice, June 7, 2021
- SP 800-86, Guide to Integrating Forensic Techniques into Incident Response, NIST, August 2006
- Money Laundering and Terrorist Financing Red Flag Indicators Associated with Virtual Assets, Financial Action Task Force, September 2020
- Chainalysis, 2026 Crypto Crime Report, introduction, January 8, 2026
- Scam Center Strike Force Takes Major Actions Against Southeast Asian Scam Centers Targeting Americans, US Department of Justice, April 23, 2026
- Pocher N., Zichichi M., Merizzi F., Shafiq M. Z., Ferretti S., Detecting Anomalous Cryptocurrency Transactions: an AML/CFT Application of Machine Learning-based Forensics, arXiv:2206.04803, 2022 (revised 2023)