Bitfinex’s six-year trace ran through records that banks keep

The week

In August 2016, hackers broke into Bitfinex, a virtual currency exchange, and stole roughly 120,000 bitcoin through more than 2,000 unauthorized transactions. At the time the haul was worth around $70 million. The exchange spread the loss across its customers, cutting balances by about a third and issuing tokens it later redeemed. For years the money seemed to have vanished into the digital fog that many people assume surrounds cryptocurrency. In February 2022, it turned out the fog had been thinner than it looked.

On February 8, 2022, the Justice Department announced the arrest of two people in New York on charges of conspiring to launder cryptocurrency stolen in the 2016 hack of Bitfinex. Laundering means moving and disguising stolen or criminal money so that it looks legitimate and can be spent. The defendants were also charged with conspiring to defraud the United States. The case was brought in federal court in Washington, D.C., although the arrests took place in Manhattan. The department announced the seizure of about 94,000 bitcoin, then worth roughly $3.6 billion, which it called the department’s largest financial seizure to date. By then the total stolen was worth about $4.5 billion, because the price of bitcoin had risen so far since 2016.

How do you find stolen bitcoin six years later? According to the department’s filings, investigators traced the stolen funds through thousands of transactions on the bitcoin blockchain, across many laundering techniques, to accounts linked to the defendants. A blockchain is a shared public record of every bitcoin transaction ever made, copied across thousands of computers around the world. It does not list people’s names, but it does list every movement of funds between digital addresses, permanently. Investigators can study it at leisure.

Most of the stolen coins had never moved far. The bulk stayed in the wallet that first received them, while a smaller portion, about 25,000 bitcoin according to the department, went through a long laundering process. The filings described the techniques used on that portion. They included accounts opened under false identities and many small transfers automated by software. Funds went into and out of a variety of exchanges and darknet markets, and were converted into other cryptocurrencies, including ones designed to hide transaction details. That last step is called chain hopping. The department also said the defendants used US business accounts to make their banking activity look legitimate.

The trail did not stay on the blockchain. Some funds had passed through accounts at virtual currency exchanges and other financial services, the businesses where people swap crypto for dollars and back. Those firms know their customers, and that is where an anonymous-looking address can meet a real name.

The recovery itself depended on something very concrete. Agents obtained search warrants for an online storage account and found files holding private keys, which they decrypted. A private key is the secret code that controls a bitcoin holding; whoever has it can move the funds. With the keys in hand, the government could take control of the coins still sitting in the original wallet. Tracing found the people. The keys returned the money. Bitfinex said it would work with the authorities to establish its rights to the recovered coins, a process that would run for years through the courts.

IRS Criminal Investigation, the FBI and Homeland Security Investigations worked the case. In announcing it, the department presented the seizure as evidence that cryptocurrency was no safe haven for criminals, and that patient tracing could reach funds years after a theft. Each brought something different: IRS-CI’s long experience with financial records, the FBI’s cyber investigators and HSI’s reach into cross-border trade and darknet markets. The agencies had built up blockchain tracing skills over several years of darknet and ransomware cases.

The timing mattered too. In late 2021 and early 2022, US authorities were stepping up pressure on the services that turn crypto into cash. Treasury had sanctioned its first virtual currency exchange, Suex, in September 2021, and a second, Chatex, that November, for handling ransomware proceeds. The Bitfinex arrests showed the same idea from the enforcement side: crypto crime eventually has to pass through a regulated door.

For banks and credit unions, the more instructive part of the case was the role that ordinary financial records played in connecting a public ledger to the people behind it.

A common view of cryptocurrency held that it was anonymous and so suited to crime. The Bitfinex case showed the other side. The bitcoin ledger is public and permanent. It does not record names, but it records every movement of funds, and anyone can analyze it at any time. Investigators with patience and better tools could return to 2016 transactions in 2022 and follow them.

Banks and credit unions see a growing share of their customers’ money pass to and from crypto platforms. For them, the case carried a practical message about their own data. It comes down to three things: what the trace relied on, where it met regulated institutions, and what a bank’s records need to hold.

The sections below begin with how the ledger works, because the rest depends on it. The three parts follow in order. Between the second and third is a look at the alert process, since that is where a bank’s memory of crypto-linked activity is made or lost. A hypothetical case then shows the difference good records make. After it come the strongest objections to this approach, how exposure differs by type of institution, the features a well-prepared bank shares and the questions that test them.

A ledger posted in the town square

The bitcoin blockchain works like a giant ledger posted in a town square, with every payment written in it. The ledger does not say “Alice paid Bob.” It says “account 7XQ paid account 4LM.” Anyone can read it, copy it and study it forever. Nobody can erase a line.

The “accounts” in that ledger are called addresses: long strings of letters and numbers. Anyone can create as many as they like, for free, without giving a name. Each address is controlled by a private key, the secret that authorizes payments from it. A “wallet” is software, or sometimes a file or device, that holds a person’s private keys and keeps track of their addresses.

How a payment is recorded

A bitcoin payment works more like handing over banknotes than like a bank transfer. Each address holds discrete amounts received in earlier transactions. To pay, the wallet gathers enough of those amounts as inputs, sends the payment to the recipient’s address and sends the remainder, called change, back to a new address the payer controls. Every transaction thus shows which earlier amounts were spent and where all of the value went.

That structure leaves fingerprints. When a transaction combines inputs from several addresses, all of them usually had to be signed by the same wallet. The change output usually goes to an address the payer controls. Wallet software tends to have habits in how it builds transactions, sets fees and orders outputs. Each of these small regularities can link addresses to one another.

Pseudonymous, not anonymous

This is why bitcoin is better described as pseudonymous than anonymous. Your name is not on the ledger, but everything your addresses do is. Suppose one of your addresses is ever linked to you, for example through a deposit at an exchange that checked your passport. A great deal of history can then acquire a name at once.

Exchanges are the bridge between this world and ordinary money. They let customers buy and sell crypto for dollars, and they connect to the banking system through bank accounts and card processors. In the United States, many of them are regulated as money services businesses, a category that also includes check cashers and money transmitters, and they must follow anti-money laundering rules.

What the trace relied on

Blockchain tracing combines the public ledger with analysis that groups addresses likely controlled by the same party and follows funds through attempts to obscure them. Grouping addresses this way is called clustering. If two addresses are repeatedly used together in ways that only a single owner could arrange, an analyst can infer that they belong to the same wallet.

From clusters to names

Clustering on its own produces groups of addresses, not people. The next step is attribution: labeling clusters with the real-world service or person behind them. Analytics firms build those labels over years. They open accounts at exchanges and record the deposit addresses they are given. They collect addresses published in ransom notes, court filings and sanctions lists. They record the addresses of darknet markets and mixing services. Once a cluster is labeled “Exchange X,” any funds that flow into it can be followed to a business that holds customer records.

A law enforcement agency adds what no commercial firm has: legal process. With a subpoena or warrant, it can ask an exchange who owned the account that received a particular deposit and what identity documents were provided. It can also ask which IP addresses were used to log in and where withdrawals went. That combination of ledger, labels and legal process is what turns a pattern into a case.

How launderers try to break the trail

Launderers try to break the trail. Their attempts include:

• splitting amounts across many addresses, so no single trail stands out;
• peel chains, where a large balance is moved step by step and a small amount is peeled off at each hop;
• passing funds through mixing services, which pool coins from many users and pay out different coins of similar value;
• converting between currencies, including privacy-focused coins that hide amounts and parties;
• moving across blockchains, from one crypto network to another;
• routing funds through darknet markets or exchanges with weak customer checks.

Each technique adds cost and delay for the investigator. None is perfect. Automated transfers repeat patterns. Peel chains leave a visible trunk. Conversions happen at services that keep records. Every exit to ordinary money has to pass through someone who can be asked questions.

Government investigators and commercial analytics firms had refined tracing methods for years. They are probabilistic. A clustering result is a strong inference, not proof, which is why investigators combine it with records from institutions, devices and accounts.

Why time favored the investigators

Time favored the investigators. A launderer has to avoid every mistake, indefinitely, because the record stays. An investigator can wait for a new technique, a new lead or a seized device. Methods unavailable in 2016 could be applied to 2016 transactions.

That asymmetry is unusual in financial crime. Most evidence decays: records are purged, people forget, systems are retired. On a public ledger, the trail stays put while the tools for reading it improve, so activity that could not be attributed years ago can be attributed once better software arrives.

Seizures of other services added to the effect. When law enforcement takes down a darknet market or an unlicensed exchange, its servers can reveal which deposit addresses belonged to which users. Each such seizure labels a new slice of old ledger history. A launderer who used that service years earlier can find that a gap in the trail has closed behind them.

Where it met regulated institutions

Stolen crypto is of limited use until it becomes ordinary money or goods. That conversion usually happens at exchanges and other virtual asset service providers, the regulators’ term for businesses that exchange, transfer or hold crypto for others. In the United States, many of these firms are money services businesses that must verify customers, keep records and file suspicious activity reports.

Three duties

Those three duties are the backbone of anti-money laundering compliance. Verifying customers, often called know your customer, means confirming who someone is when they open an account. Record-keeping means holding the details of transactions for a set period. A suspicious activity report, or SAR, is a confidential filing to the Financial Crimes Enforcement Network, Treasury’s financial intelligence unit, when a firm sees activity that may involve crime.

FinCEN had made its expectations for crypto businesses explicit in May 2019 guidance. It explained which business models made a firm a money transmitter, and confirmed that the rule requiring certain information to travel with funds transfers of $3,000 or more applied to transfers of virtual currency. A transfer between two regulated exchanges should therefore carry the identity of the sender and recipient, at least in principle.

When laundered funds touched such an account, the ledger trail met a name, an address and a bank account. Those were the joins that turned a chain of pseudonymous addresses into a case.

Where the bank stands in the chain

Banks are one step further out. They rarely see the blockchain. They see wires and card payments to and from exchanges, deposits that follow crypto sales, and customers who act as informal brokers for others. A bank’s record of those flows, its due diligence on the customer and its alert history are the next links in the chain. An investigator who traces funds to an exchange account, and from there to a bank transfer, will eventually ask the bank what it knew.

The question usually arrives through legal process. A grand jury subpoena or other formal request asks for account records, signature cards, transaction histories and sometimes the bank’s own investigation files. Separately, FinCEN can send banks lists of subjects under its section 314(a) program, asking them to search their records for matching accounts and transactions. Under section 314(b), banks and other covered firms that register can share information with each other about suspected money laundering. Each of these routes depends on the bank’s records being searchable and complete.

That is also where a bank adds detection value. Combining a customer’s transfers to exchanges with information about the on-chain activity behind them can show patterns that neither view reveals alone. Examples include rapid round trips, funds arriving from addresses linked to hacks or sanctioned services, and customers whose crypto activity bears no relation to their stated business.

The Bitfinex filings described business accounts used to give banking activity a legitimate look. Any bank will recognize the pattern. A small company with a plausible website, modest revenue and a reason to receive payments from abroad is a natural shell for converted crypto. The bank’s ordinary business due diligence, on expected activity, counterparties and source of funds, is its main defense against that pattern.

Alerts, queues and the bank’s memory

Most banks run a transaction monitoring system: software that scans payments against rules and models. Typical rules look for unusually large cash deposits, rapid movement of funds in and out, or transfers that don’t fit a customer’s profile. When something trips a rule, the system creates an alert.

An alert lands in a queue, where an analyst reviews it. The analyst looks at the customer’s history, the transactions, what the bank learned when the account was opened, and sometimes asks the customer for an explanation. Most alerts turn out to be harmless and are closed. Some are escalated to a case, a fuller investigation, and some of those lead to a suspicious activity report. All of this is recorded in a case management system, which is the bank’s memory of what it noticed and what it decided.

Where the memory fails

The weak points are well known to anyone who has run such a team. Alert volumes are high, so analysts are under pressure to close them quickly. Rules written for traditional fraud may not recognize crypto-linked patterns. And the case management system is only as good as what analysts type into it. A system that stores a decision without the reasons behind it preserves the outcome and loses the judgment.

Crypto adds one more wrinkle. The most revealing information about a transfer to an exchange is often not in the bank’s own data at all, but on the public ledger behind the exchange account. Unless someone deliberately looks there and writes down what they found, the bank’s record will show only a wire to a platform and nothing about where the money went next.

Rules that recognize crypto patterns

Several crypto-linked patterns can be written as rules once the bank can tag exchange counterparties. Cash deposits followed quickly by transfers to an exchange suggest structuring into crypto. Many small incoming transfers from unrelated people, followed by a single transfer to an exchange, suggest a customer buying crypto on others’ behalf, sometimes as a money mule. Large inflows from an exchange to a customer with no history of outflows to one suggest funds of unknown origin. Each rule needs tuning against the bank’s own data, and each will produce false positives that analysts must be able to resolve.

The SAR narrative

When a case does lead to a SAR, the narrative section is the part investigators read first. Banks generally have 30 days from initial detection of suspicious facts to file. A useful narrative names the exchanges involved, gives the dates and amounts of the transfers, includes any wallet addresses known and explains why the activity looked suspicious. A narrative that says only that the customer sent funds to a crypto platform helps no one. The same discipline should apply to alerts that do not lead to a filing, because those are the decisions a bank is most likely to be asked to explain years later.

What a bank’s records need to hold

Visibility of exposure

The first need is visibility of exposure. Many banks in early 2022 could not say which customers transacted regularly with crypto platforms, how much, or with which ones. That segmentation can be built from existing payment data by maintaining a list of exchange counterparties, their account and routing details, and their card merchant identifiers.

When a customer wires money to an exchange, the wire carries the exchange’s bank details; when they pay by card, the transaction carries a merchant code. A maintained list of those identifiers lets the bank tag the transactions automatically. That tag belongs in the customer risk model alongside other risk attributes. The customer risk model is the scoring system a bank uses to decide how closely to watch each customer. The list needs an owner and a refresh cycle, since platforms open new banking relationships, change processors and close often.

Some flows are harder to see. Payments may go through a payment processor or an intermediary bank rather than directly to the exchange, so the counterparty name on the wire is the processor’s. Peer-to-peer apps and prepaid cards add further layers. A good list therefore includes the processors and intermediaries that platforms are known to use, with a note of how confident the bank is in each match.

A route to on-chain analysis

The second is a defined route to on-chain analysis. Few banks need an in-house blockchain team. Investigators do need a way to examine a suspicious transfer in context, through a vendor tool, a shared service or an escalation path to a specialist. The results, including addresses examined and conclusions drawn, should be stored in the case file in structured form, not pasted as screenshots. Structured form means recorded in defined fields that can be searched and reported on later, rather than as an image a future reader must squint at.

The route should be cheap enough to use. If every on-chain review requires a specialist ticket and a week’s wait, analysts will not ask. A tiered approach works for most banks: front-line analysts run a simple lookup of an address against a vendor’s risk labels, and a smaller team handles deeper tracing when the lookup raises concern.

Records built to be read later

The third is records built to be read later. The Bitfinex case was charged nearly six years after the theft. Bank Secrecy Act records generally must be kept for five years, and many institutions keep some longer. The Bank Secrecy Act is the main US anti-money laundering law, and it sets the record-keeping duties for banks.

The issue is less the retention period than whether records can still be found and understood when someone asks. A case file that records why an alert was closed, which exchange was involved, and what the customer said is useful years later. A disposition reading “reviewed, no concern” is not. A disposition is the analyst’s final decision on an alert, and it is often written in a hurry at the end of a long queue.

A record that survives a system change

Many banks change their monitoring or case management system every several years, often during a merger or a core conversion. Migration projects tend to carry over the decisions and drop the notes, attachments and alert history that explain them. Old systems are switched off, and their data sits in an archive nobody can query. A records plan should name which fields must survive migration and test, before the old system is retired, that a sample of old cases can still be read in full.

A minimal data model for crypto-linked activity might hold six things. They are the platform and how it was identified; flow direction and size; any wallet addresses known; any on-chain lookup, with the vendor’s label and date; the customer’s explanation; and the analyst’s reasoning. Each field is cheap to capture at the time and very expensive to reconstruct later.

Who owns the records

Records of this kind fall between several owners, which is one reason they decay. The BSA officer owns the monitoring program and its procedures. The investigations team owns the case files. Model risk management owns validation of vendor scores and the bank’s own models. Records management owns retention schedules and destruction. IT owns the systems and their migrations. Each can reasonably assume that another has the long view.

A short written standard, signed by the BSA officer and the head of records management, settles the matter. It names which fields in a crypto-linked case are mandatory, how long they are kept, who checks completeness, and which test must pass before any system holding them is retired. Quality assurance reviews of closed alerts can then check against that standard, sampling the dispositions that touch tagged counterparties.

Retention beyond the minimum

Five years is the general Bank Secrecy Act minimum, and many records reach it and are destroyed on schedule. Destruction is legitimate and often required by a bank’s own privacy commitments. But when a bank receives a subpoena, a law enforcement request or notice of litigation, the relevant records must be placed on legal hold and kept until the matter closes. A hold works only if the bank can find every system that holds the customer’s data, including archives from retired platforms. Some institutions choose a longer retention period for case files on filed SARs and high-risk customers, weighing the cost of storage against the cost of being unable to answer.

Knowing the limits

These capabilities carry limits. Analytics vendors attribute addresses with varying confidence, and some assets and techniques defeat tracing. A risk score from a provider is a model output and should be validated and documented like other compliance models. Validation means testing whether the model does what it claims and understanding where it is weak, the same discipline banks apply to credit models.

Vendor labels also change. An address labeled low risk today may be relabeled next year when a new seizure reveals who controlled it. Storing the label with the date it was retrieved lets the bank show what it knew at the time, which matters more in a later inquiry than what the vendor says now.

Banks also need to avoid treating every customer who buys crypto as suspect. Many uses are lawful, and blanket de-risking pushes activity to less transparent channels. De-risking is the practice of closing accounts for whole categories of customers rather than judging each one. Analytics should inform an investigator’s judgment, not replace it.

The phone call that comes years later

Suppose a regional bank has a business customer, a small import company, that years ago began sending regular wires to a crypto exchange and receiving deposits back from it. The bank’s monitoring system raised an alert. An analyst, working through a full queue, looked at the account, saw that the company was long-standing and closed the alert with the note “reviewed, no concern.”

Now an investigator calls. They have traced stolen funds across the blockchain to an account at that exchange and then, through the exchange’s records, to wires involving the import company’s account at the bank. They want to know what the bank knew, and when.

The bank can find the wires; payment records are retained. But it cannot say why the alert was closed, whether anyone asked the customer about the crypto activity, or whether the amounts fit the business. It never tagged the customer as having crypto exposure, because it had no list of exchange counterparties. The analyst has since left, and the case management system was replaced in a merger, taking the alert’s attachments with it. Nobody blames the bank for missing a crime it could not see; its discomfort comes from being unable to show what it did.

Run the story again with better records. The bank maintains a list of exchange counterparties, so the wires were tagged automatically and the customer’s risk score reflected it. The alert disposition names the exchange, records the customer’s explanation and notes that the analyst escalated a sample of transfers for on-chain review through the bank’s vendor. The addresses, the vendor’s labels and the date of the lookup are stored in the case file, and they survived the migration. Years later, the investigator gets a clear, credible answer, and the bank looks like what it was: a careful institution.

The difference between the two versions is not sophistication. Neither bank detected the crime. The second simply wrote down, in a form that lasted, what it saw and why it decided as it did. Almost any institution can afford to do the same.

The case against building for the long trace

The strongest objection is cost. Alert volumes are already high, and asking analysts to write fuller dispositions and run on-chain lookups slows every queue. A bank with modest crypto exposure may reasonably ask why it should invest for a rare investigator’s call. The answer is proportion. Tagging exchange counterparties is largely automatic once the list exists. Fuller dispositions can be required only for alerts that touch tagged counterparties. On-chain lookups can be limited to cases above a threshold. The effort scales with the exposure.

A second objection concerns privacy and data minimization. Keeping more detail about customers’ crypto activity for longer creates its own risk if the bank is breached, and it can sit uneasily with a principle of collecting no more than needed. The concern is fair. The records proposed here are about transactions the bank already processes and decisions it already makes. They add reasoning, not new surveillance, and they stay under the same retention and access controls as other compliance records.

A third objection holds that vendor attribution is too uncertain to rely on. Labels can be wrong, and a bank that acts on a mistaken label may harm an innocent customer. The risk is real. It is the reason to store the label, its source and its date alongside the analyst’s own judgment, rather than to act on scores automatically. A recorded uncertainty is more defensible than an unrecorded certainty.

A fourth objection points to the swings in policy. Regulators’ stance on crypto changed more than once after 2022, and specific services moved on and off sanctions lists. Building elaborate controls around a moving target can look wasteful. Yet the swings strengthen the case for records. When the rules change, a bank needs to show what applied at the time of each decision, and only a dated record can do that.

The argument is weakest for an institution whose customers have almost no crypto-linked activity. For such a bank, a counterparty list and a sentence in the procedures may be enough. The point is to know which kind of bank you are, from data, rather than to assume it.

How exposure differs by institution

The Bitfinex case reframes crypto risk for a bank’s board and executives. Whether the bank offers crypto products matters less than its existing customers, whose money already moves to and from crypto platforms through ordinary wires and cards. How that plays out depends on the kind of institution.

Credit unions and community banks

A credit union or community bank usually has a smaller compliance team and relies more on its core processor’s monitoring tools. Its crypto exposure tends to come from members and customers buying crypto through consumer apps, plus the occasional small business. The priority is visibility: a counterparty list loaded into the monitoring system and a short procedure for alerts that touch it. A shared service or a vendor lookup tool, rather than in-house analysts, is usually the right route to on-chain analysis. Credit unions answer to the NCUA and state supervisors, banks to their own federal and state regulators, but the Bank Secrecy Act record-keeping duties are broadly the same.

Regional banks and fintech partners

A regional bank may serve crypto businesses directly, or provide accounts to fintechs whose customers trade crypto. Here exposure is concentrated and indirect at the same time. The bank needs to know its direct crypto clients well. It also needs contractual access to its fintech partners’ customer and transaction data, because an investigator’s question about a partner’s customer will still arrive at the bank. Agreements should state what records the partner keeps, for how long and how fast the bank can get them.

Broker-dealers and wealth managers

Broker-dealers have their own SAR obligations under FinCEN’s rules and their own record-keeping rules from the SEC and FINRA. Their exposure grew as crypto-linked products entered ordinary brokerage accounts. A client funding an account with the proceeds of a crypto sale, or moving between crypto exchange-traded products and direct holdings, creates the same need to record the source of funds. Wealth managers that are not broker-dealers were not generally subject to FinCEN’s anti-money laundering program rules in 2022. Those that custody client assets through a bank or broker will find the question arriving through that partner.

What it costs when records are thin

The money and risk dimensions are straightforward. Weak records can lead to regulatory criticism, costly remediation projects and, in serious cases, enforcement. Staff spend time reconstructing old cases instead of handling new ones. Customers can be harmed both ways: by fraud the bank failed to spot, and by blunt account closures when the bank cannot tell good activity from bad. Regulators expect the bank to understand its exposure, and a bank that cannot say which customers use crypto platforms will find that hard to demonstrate. And the reputational question, “what did the bank know?”, can arrive many years after the fact, when the people who made the decisions have moved on.

The deeper point is about time. Most organizations design their records for the next audit. The Bitfinex case suggests designing some of them for an investigator who might call long after the transaction, perhaps with better tools than the bank has today.

Records written for a distant reader

A bank that could answer that call well has:

• A maintained list of crypto platform counterparties, including processors and intermediaries, with account, routing and merchant identifiers, owned and refreshed.
• Exposure in the risk model, so crypto-linked activity informs how closely each customer is watched.
• Rules that recognize crypto patterns, tuned on the bank’s own data.
• A defined route to on-chain analysis, with results, vendor labels and dates stored in structured form.
• Dispositions that explain themselves: the platform, the reasoning, the customer’s explanation.
• Records that survive migration, tested before any old system is switched off.
• Validated vendor scores, documented like any other compliance model.
• Decisions based on behavior, not on the mere fact that a customer uses crypto.

The usual failures run the other way. Banks treat crypto as someone else’s problem because they do not offer it, and let the counterparty list go stale. Analysts paste screenshots of blockchain tools into case files, accept a vendor’s risk score without understanding it and write one-line dispositions. Case history is lost in a system migration. Whole categories of accounts are closed instead of behavior being judged.

Each feature also produces evidence an examiner can test. That evidence includes the list and its refresh log, the risk model documentation, the rule tuning records, sample case files with on-chain results, migration test results and the model validation report. A bank that can assemble that file quickly has, in effect, already answered the investigator’s call.

Whether the files would survive a trace

• Can we say today which of our customers send or receive money from crypto platforms, how much, and through which platforms?
• When an alert involves crypto, how does an investigator look at the on-chain activity behind it, and where are the results stored?
• If an investigator asked about an alert we closed years ago, could we explain why we closed it, even after a system change?
• Have we validated the risk scores our blockchain analytics provider gives us, and do we know their limits?
• Are our decisions to exit customers based on what they do, or on the fact that they use crypto at all?

With hindsight

The prosecution ran its course. Both defendants pleaded guilty in August 2023, and one admitted to carrying out the 2016 hack himself. Both were sentenced in November 2024. The case that began with a public ledger ended with the ordinary machinery of plea agreements and sentencing, built on records from exchanges and financial institutions.

Blockchain tracing featured in later large cases. In April 2022, the FBI attributed the theft of roughly $620 million from the Ronin network, a bridge used by an online game, to North Korea’s Lazarus Group. In February 2025, the FBI attributed the theft of about $1.5 billion from the exchange Bybit to North Korean actors within days. The kind of patient ledger analysis that followed the Bitfinex funds was by then part of how authorities approached large crypto thefts, and attribution had become much faster.

Enforcement against the services that launder crypto intensified. In April 2022, German authorities shut down Hydra, a large Russian-language darknet market, and Treasury sanctioned it on the same day, along with the exchange Garantex. In January 2023, FinCEN used a new power for the first time to bar US firms from dealing with Bitzlato, an exchange it called a primary money laundering concern. In October 2023, FinCEN proposed treating crypto mixing as a class of transactions of primary money laundering concern, which would require covered firms to collect and report more information on transactions involving mixers.

Policy moved in both directions. Treasury sanctioned the Tornado Cash mixing service in August 2022. After a federal appeals court ruled in late 2024 that the service’s immutable smart contracts could not be blocked as property, Treasury lifted the sanctions in March 2025. Sanctions bar US persons from dealing with a listed party, so for that period, funds touching the service carried a clear legal risk for any institution that handled them. The reversal shows that the rules around particular crypto services can change, which is one more reason for banks to record what they knew and why at the time of each decision.

Bank regulators’ stance shifted too. In January 2023, the federal banking agencies issued a joint statement warning banks about crypto-asset risks, and supervisors pressed banks to justify their crypto activities. In 2025, the agencies withdrew several of those cautionary statements and said banks could engage in crypto-asset activities subject to sound risk management. In January 2024, the SEC approved spot bitcoin exchange-traded products, which put crypto exposure into ordinary brokerage and retirement accounts. Across all of these changes, the duty to keep usable records of what a customer did and what the institution decided stayed constant.

The GENIUS Act, signed in July 2025, brought payment stablecoin issuers under Bank Secrecy Act obligations. Stablecoins are cryptocurrencies designed to hold a steady value, typically tied to the dollar. Bringing their issuers under the same anti-money laundering law that governs banks narrows the gap between the crypto world and the regulated financial system. It also adds more points where a ledger trail can meet a name.

By this point in 2026, the open question for many banks is less whether crypto exposure belongs in the customer risk model than whether their own files could support a trace years from now.

The permanence of the blockchain sets a standard the rest of the financial system will be measured against. The ledger will still be readable in a decade. If the bank’s notes on the same activity are thin, scattered or unreadable, the weak link in the investigation will be the bank, and that is a position no institution wants to explain.