Leaked Slides Show How Chainalysis Flags Crypto Suspects for Cops

In September 2021 a set of Chainalysis training slides, prepared for Italian police working on dark-web cases, appeared on a leak site and was verified by reporters. They are worth understanding years later, because they show something counterintuitive: the techniques that flag a crypto suspect mostly have nothing to do with the blockchain itself. They collect the ordinary information that leaks around it - which computer asked a question, and when.

The block explorer that watched its visitors

A block explorer is a website where you paste an address and see its transactions. The slides said Chainalysis owns and operates one - walletexplorer.com, online since 2014 - and that it records the internet addresses of people who look things up on it. In the company's own words, that data produced "meaningful leads" tying a network location to a wallet. One slide described catching a suspect's connection hours after they were thought to have moved funds. Imagine a shop that offers free parcel tracking and quietly notes down who keeps checking which parcel.

Nodes that listen

The second technique is similar. Chainalysis runs Bitcoin nodes - ordinary computers that keep a copy of the network. When a lightweight phone wallet connects to one to ask for its balance, it tells that node where it is connecting from and which addresses it cares about, including addresses it has never used. Nothing is broken here. The wallet is simply asking a stranger a very revealing question.

How well does any of it work?

Harder to say than the slides suggest. One claimed usable leads in roughly 65% of cases involving Monero, a coin designed to hide amounts and participants. Privacy researchers pointed out that "usable lead" was never defined and could mean a false name, and that a case counted as a success even when the information came from somewhere else entirely. Marketing slides are marketing.

The practical lesson is small and useful: look up your own addresses in your wallet software rather than pasting them into random websites, and if you run anything that connects to the network, prefer a full node you control. Background in how Chainalysis tracks wallet addresses, and the official pipeline in how governments deanonymize crypto transactions.