AdvancedAutomotive / Vehicle ForensicsRecover paired phones, trip logs and events from infotainment and telematics unitsCryptocurrency / Blockchain Forensics
Trace bitcoin and USDT flows, group wallets and prepare requests to exchanges
- Intermediate
- Online or on campus
- 5 hands-on labs
- 7 modules
About this course
Many cyber fraud complaints in India now end in crypto. A victim of a fake trading app or a part-time task scam pays into a bank account, the money moves through mule accounts and within hours it has been used to buy USDT that leaves on the TRON network. Following that trail needs different skills from bank statement analysis. The logic is still the same. Follow the money, find where it touches a regulated business and ask that business who the customer is.
This course starts with how blockchains record value and the difference between the UTXO model used by Bitcoin and the account model used by Ethereum and TRON. You then read real transactions on public block explorers. You learn the clustering heuristics analysts use to group addresses into likely wallets and where those heuristics break down. You trace funds to exchanges and draft requests for KYC and transaction records.
The device side matters just as much. A seized phone or laptop may hold wallet apps, browser extensions, screenshots of addresses or a seed phrase typed into a notes app. You learn to find these, record them properly and never move funds without legal authority.
Transaction tracingWallet clusteringUSDT on TRONExchange requests
After this course you can
- explain the UTXO and account models and read a transaction on Bitcoin, Ethereum and TRON explorers
- trace funds across several hops and present the flow as a clear diagram
- apply common address clustering heuristics and state their limits in your report
- identify transfers to exchanges and draft a request for KYC and transaction records
- recognise mixers, chain hopping and bridges and record where the trail goes cold
- find wallet apps, extensions and seed phrases on seized devices and handle them safely
Syllabus
7 modules · 28 topics
01How Blockchains Record Value4 topics
- Blocks, transactions, hashes and addresses
- Public and private keys and why a wallet is not the same as an address
- The UTXO model: inputs, outputs and change
- The account model: balances, nonces, smart contracts and token transfers
02Reading Block Explorers4 topics
- Bitcoin transactions on Blockchair and mempool.space
- Ethereum internal transactions and ERC-20 token transfers on Etherscan
- TRC-20 USDT transfers on Tronscan
- Explorer times are in UTC, so convert them to IST before matching bank records
03Clustering and Attribution4 topics
- The common-input-ownership heuristic
- Change address detection and peel chains
- Where heuristics fail: CoinJoin and large custodial wallets
- Attribution labels from explorers and analytics platforms and how much weight to give them
04Exchanges, KYC and the Legal Route4 topics
- Recognising exchange deposit addresses and hot wallets
- What an exchange can usually provide: KYC documents, login IPs, linked bank accounts and withdrawals
- Drafting a request that goes out through the investigating agency
- Asking for a freeze quickly in fraud cases, before funds move on
05Mixers, Bridges and Privacy Coins4 topics
- CoinJoin on Bitcoin and smart contract mixers on Ethereum
- Cross-chain bridges and swaps used for chain hopping
- Privacy coins such as Monero and why tracing usually stops there
- Writing up a trail that ends without overstating what it shows
06Stablecoins in Indian Fraud Cases4 topics
- Why USDT on TRON is common in scams: low fees, fast transfers and an active peer-to-peer market
- Peer-to-peer USDT sales and the bank mule accounts behind them
- Stablecoin issuers can freeze addresses on a law enforcement request
- Building one money trail from bank account to blockchain to exchange
07Wallet Evidence on Devices4 topics
- Wallet apps on Android and iOS and the artefacts they leave
- Browser extension wallets such as MetaMask on a PC
- Seed phrases of 12 or 24 words in notes, photos, chats and on paper
- Recording a found seed phrase and why no examiner imports it without written legal authority
Hands-on labs
- Lab 1
Trace a Bitcoin payment through five hops and mark the likely change outputs
- Lab 2
Follow USDT from a victim's address across TRON to an exchange deposit address on Tronscan
- Lab 3
Group a set of addresses with the common-input heuristic and note your confidence in each link
- Lab 4
Draft an exchange request for KYC and transaction records from a case scenario
- Lab 5
Search a phone extraction for wallet apps, addresses and screenshots of seed phrases
Tools you will use
- Blockchair
- mempool.space
- Etherscan
- Tronscan
- WalletExplorer
- GraphSense
- Breadcrumbs
- Maltego
- Magnet AXIOM
- Cellebrite Physical Analyzer
Who it suits
- Officers in cyber crime cells and economic offences wings
- Bank fraud, risk and anti-money laundering teams
- Compliance staff at crypto exchanges
- Forensic examiners who find wallets on seized devices
- Lawyers handling crypto fraud matters
Before you join
- Basics of Cyber Forensics or equivalent experience
- Comfort with spreadsheets for sorting and filtering transaction lists
- No coding or crypto trading experience is needed
Questions about this course
Is cryptocurrency anonymous?
Not fully. Most blockchains are public, so every transaction can be seen by anyone. What is hidden is the name behind an address. That name usually comes out where the money enters or leaves through an exchange that collected KYC.
Can Monero be traced?
In most cases tracing on the chain stops at Monero. Investigators then look at the points where funds went in or came out, the devices of the suspect and exchange records.
Do I need to own any crypto for this course?
No. Block explorers are free and public. You should never use a personal wallet for case work.
What should be done when a seed phrase is found during a search?
Photograph it where it was found, record it in the seizure documents and keep it sealed. Do not type it into any wallet app on the spot. Moving funds to a wallet controlled by the agency needs proper legal authority and a written procedure.
More courses in Advanced & Specialised Forensics
AdvancedAutomotive / Vehicle ForensicsRecover paired phones, trip logs and events from infotainment and telematics units
AdvancedAI / Machine Learning ForensicsUse machine learning to sort large evidence sets and investigate AI systems
AdvancedOSINT / Open Source IntelligenceFind, verify and record public online information in a form a court can checkNot sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.