AI is increasingly being utilized in blockchain investigations by both amateurs and professionals. Major professional blockchain analytics software providers have been investing heavily in AI assistants as well; Chainalysis Agents AI, TRM Co-Case Agent, Elliptic Copilot, while other software providers like Caudena have given users the ability to integrate with their own AI Agents (through Prism MCP).
AI Tools like ChatGPT & Claude meanwhile give amateur investigators (and fraud victims as well) the ability to trace cryptocurrency for free or at a relatively low cost.
In this article, we explain where AI tools, primarily free & low cost AI tools like ChatGPT, excel in blockchain investigations and where there are notable issues or room for improvement.
When AI Excels in Blockchain Investigations
Widely known AI tools like ChatGPT tend to be effective and useful tools for blockchain investigations for amateur investigators in the following situations:
- Tracing Cryptocurrency To Major Attributed Exchanges
While there are exceptions, (free) AI tools tend to do a pretty good job at tracing cryptocurrency until such cryptocurrency reaches exchange(s) the tool recognizes or which it is able to identify (typically major exchanges like Binance and OKX). The tools also provide supporting blockchain transaction data to support that flow of cryptocurrency to said exchange and exchange deposit transaction data.
An important caveat to this tracing is that it’s only accurate and relevant when funds have been sent to an exchange or service that the AI tool has been able to identify or attribute. It is somewhat common (particularly in theft, fraud, and money laundering investigations) for such tools to fail to identify an exchange or service of some sort along the way before the cryptocurrency was thereafter sent to the applicable exchange the tool was able to identify. This can easily result in inaccurate or irrelevant results produced by AI tool in some cases. - Wallet Analytics
AI tools usually do a good job gathering and producing analytical data of cryptocurrency wallets, including throughput, identifying addresses that can be said to be part of a wallet, identifying counterparty addresses transacted with, and gathering wallet fingerprint data. This is all data that a user might find difficult or cumbersome to gather on their own e.g., through the use of blockchain explorers. - Statistical Analysis & Big Data
Commonly used LLMs are usually effective at gathering relevant statistics that might be useful in certain types of investigations, such as the total amount of funds being deposited or withdrawn from a given exchange in a given time period, or even identifying overall industry trends, such as a higher proportion of cryptocurrency being moved to self-custody instead of being held on exchanges. - Cross-Chain tracing & Decentralized Exchanges
The majority of the time, free AI tools are able to trace through decentralized exchanges and cross-chain bridges correctly, but there are undoubtedly exceptions. Users can expect to encounter such DEXs and bridges in the vast majority of cases involving illicitly obtained cryptocurrency. Being able to trace through such services promptly and correctly is important so the trace can continue to other destinations; this is a critical part of any diligent investigation. - Cost-Saving & Time-Saving Measure
Utilizing AI can undoubtedly prove to be a cost-saving measure for an amateur investigator or even a fraud victim that wants to try and trace funds themselves, compared to the costs of hiring a professional blockchain investigator. It also significantly reduces the amount of time a fraud victim would need to spend analyzing relevant data to produce findings or results.
Such tools can also help to minimize time expenditure for professional investigators as well – this is no doubt a core reason why the professional analytics software providers have also been developing AI tools to supplement their platforms.
However, in many cases the amount of time an AI tool would save a professional investigator is usually modest. This is because in most cases, the amount of time a professional investigator spends tracing cryptocurrency on a given case can usually be measured anywhere between a few minutes to a few hours without using AI tools at all – it is quite rare for an investigator to need many hours just for forensic analysis in a given case without the use of AI.
There are occasionally exceptions to this in some particularly large-scale hacks, such as the Bybit hack by DPRK, where the funds are split up and laundered through an incredibly large number of wallets and where many different obfuscation techniques are used along the way. In the vast majority of hacks and frauds, the laundering of funds is not so sophisticated or intricate.
Where AI Falls Short
Most of the areas where AI is lacking in blockchain investigations, or where there is notable room for improvement, fit into one of the following categories:
- Failure To Identify, Recognize, and/or Attribute Services/Exchanges Before the Identified Exchange
This is not a problem exclusive to AI tools; it often happens with less experienced investigators as well. And it is still very much an issue with some more experienced investigators too. AI is good at tracing from address to address and eventually identifies an exchange funds go to, but when working on fraud investigations, a decent portion of the time there will already be a change of custody (or even multiple changes of custody) of the cryptocurrency before the funds reach the exchange the AI is able to identify, and worse yet, the AI often doesn’t recognize it. This leads to inaccurate or irrelevant results, and often leads to failure to identify ‘nested’ services.
There are a couple of reasons why this problem is so acute. First because of the underlying exchange/service attribution an AI tool has access to. Claude or ChatGPT’s LLMs, rely on publicly available attribution data from free sources, like Arkham, or public explorers like Etherscan. Exchange attribution data in professional and proprietary forensics software tools is typically superior, containing additional information not freely available. Some professional forensic software tools also have considerably better attribution data than other professional tools. Secondly, even professional forensics tools do not contain perfect or complete attribution – far from it, but a competent professional investigator will often be familiar with indicia of various nested services, that may allow them to deduce and explain what has likely happened in a given transaction, or recognize that there has been a change of custody even if the tool does not provide clear attribution.
These are amongst the reasons that AI isn’t going to replace blockchain analytics software providers either. AI tools are not a substitute without sufficient attribution data, or other types of data aggregated by the analytics tools. AI tools can supplement work that an investigator does, even when using professional forensic software tools, which is undoubtedly why AI-integration tools and AI assistants are being offered by blockchain analytics software providers. - Unable To Provide a Meaningful Explanation of What Happened
AIs are able to analyze and present raw data effectively, but all too often they won’t be able to assess that data to provide helpful explanations to a user. Put another way, AI tools generally won’t provide sufficient interpretation of that data to answer underlying questions a user might have about what has occurred. - Unable to Handle Incident Response
AI tools can tell a user what has happened to funds after the fact, but usually in theft and fraud investigations, time is very much of the essence, with funds being moved or laundered very quickly. The best chance of obtaining a positive outcome (such as by getting some funds frozen) is a combination of both being prepared and monitoring the situation in advance, and taking immediate action when funds do move in an effort to get funds frozen. Given how time sensitive such investigations are, particularly at the early stage, these investigations could justifiably be considered ‘incident response’ work.
The incident response actions that would typically be taken by a competent and qualified investigator at such early stages, such as flagging addresses and promptly notifying relevant exchanges are generally not things that can be substituted by an autonomous AI agent reliably. - Contacts, Experience, Credibility, Accuracy & Reputation
Experienced investigators generally have a few important advantages I’ve decided to lump together that can’t be substituted by AI. This typically includes contacts & connections e.g. compliance staff at various cryptocurrency exchanges. It also hopefully includes demonstrated experience, reputation and credibility that the findings have been correctly analyzed and that accurate conclusions have been reached from that.
Compliance & AML staff at cryptocurrency exchanges regularly get contacted by people they’ve never heard from before who will make claims about stolen funds being sent to said exchange, and they often make demands that the exchange returns the purportedly stolen funds. It is common for users contacting exchanges to make mistakes in their analysis that has led them to the exchange, or they make mistakes about data they provide, or misunderstand critical aspects of information. Below are a few examples that regularly occur that exchange compliance/AML staff encounter:
- Demanding that an exchange freeze and/or return funds in the exchange’s hot wallet (which may contain balances in the billions of dollars in some cases)
- Claim (whether correct or incorrect) that the funds are still in the exchange account because the exchange deposit address has a balance according to the blockchain
- Tracing through an unidentified service or exchange along the way to the identified exchange, that makes the identified exchange irrelevant to the flow of purportedly illicit funds
- Fake thefts – funds that were not stolen as claimed after all.
- Mistaking inflows to a given wallet with outflows, leading to inaccurate results
Some exchanges rightfully treat certain investigators or firms as being more credible and trustworthy than other firms or from random people that contact them out of the blue, since the exchange can feel more confident knowing that said investigator has already done some due diligence and can potentially trust the analysis isn’t flawed. - Mixer Analysis
Freely available AI tools generally don’t have a sufficient understanding of demixing funds sent to mixers, or do a poor job when attempting to demix in situations where mixer use occurs. However, some LLMs are better than others in this regard. Depending on the mixer, and an investigator’s knowledge of how that mixer operates, AI tools can sometimes do certain tasks to assist an investigator in demixing.
While LLMs will probably improve in the future, as things currently stand, most free AI tools can only sometimes play a supporting role in demixing by assisting an experienced investigator; at this time, they can almost never do demixing autonomously, both accurately or consistently.