Crypto scams — rug pulls, fake tokens, giveaway fraud — leave a permanent trail, because public blockchains record every transaction forever. Investigating one means following the money on-chain and connecting it to off-chain identities, a task where the ledger's transparency works firmly in your favour.
What you'll need
- The scam's smart-contract or wallet address, and any related website or social handles
- Explorers and analytics from the Cryptocurrencies category
- Domain Names & Usernames and Threat Intelligence tools for the off-chain side
Steps
- Confirm and document the scam address. Pin down the exact token contract or wallet, capture the promotional site and posts, and record everything before it disappears.
- Read the ledger. Use a blockchain explorer to inspect the address — its balance, holders, and every transaction in and out.
- Follow the funds. Trace where the stolen money flowed, watching for the classic pattern of liquidity being pulled and dispersed across many wallets.
- Watch for obfuscation. Note when funds enter a cryptocurrency mixer or bridge — the clean trail may end there, but that entry is itself significant.
- Pivot to identity. Follow funds to exchange deposit addresses (which carry KYC), and link the scam's domain and social accounts to the operators through off-chain OSINT.
Common pitfalls
- Interacting with the scam. Never connect a personal wallet or sign anything — you can lose funds or expose yourself.
- Assuming a mixer is a dead end. It often is for the coins, but the entry is a finding, and other trails may remain.
- Confusing volume with theft. Not every large transfer is loss; understand the contract before concluding.
Verify your result
You have a solid investigation when you can show the flow of funds from victims to cash-out points, mark where the trail was obscured, and support any real-world attribution with documented off-chain evidence.