From wallet to identity: How OSINT exposes crypto actors

Blockchain intelligence and forensics can map transactions and fund flows. But there is another, more controversial way to connect those digital trails to real-world actors: open-source intelligence, or OSINT.

OSINT has proven useful for investigators and law enforcement in uncovering fraud and tracking laundered funds on-chain. Here's how it works — and why crypto privacy advocates are so opposed to it.

TL;DR

• OSINT connects wallets to identities. It combines publicly available off-chain information with blockchain data to help investigators identify people, companies, and coordinated operations behind crypto activity.
• It complements blockchain analytics. Blockchain analytics tracks transactions, wallets, and fund flows on-chain, while OSINT adds context from social media, websites, public records, forums, and other sources.
• Real cases show its power. Investigators such as ZachXBT have used OSINT alongside wallet analysis to trace stolen funds and identify suspects in major crypto investigations.
• OSINT has uses beyond crime. Journalists can use it to investigate crypto companies, while traders can use public information to track wallet activity and identify potential market signals.
• But attribution isn't foolproof. Public information can be incomplete or misleading, and incorrectly linking a wallet to a real person can create serious privacy and physical-security risks.
• The bottom line: Crypto's transparent blockchain provides the trail; OSINT helps investigators connect that trail to the people and organizations behind it.

What is OSINT in crypto?

Open-source intelligence establishes connections between on-chain activity and real-world identities to investigate fraud, support sanctions screening, and understand the actors behind crypto activity. It answers the questions "Who, why, and how?" by linking a pseudonym, such as an ENS domain or wallet, to a real person, company, or coordinated operation.

OSINT complements blockchain analytics — the process of mapping and tracing transactions, fund flows, and wallet relationships directly on the public ledger. However, the two are technically distinct: blockchain analytics focuses on on-chain data, while OSINT focuses on publicly available off-chain clues.

To understand what makes both methods possible, let's first look at what makes crypto transactions traceable.

How are blockchain transactions tracked?

Cryptocurrencies like Bitcoin and ether are pseudonymous rather than truly anonymous.

Anyone can view the entire transaction history of any public wallet address at any time. Unlike messages or social media posts, blockchain records cannot simply be deleted. And while wallets act as aliases, the details of every transaction are permanently recorded on a public ledger.

These details include:

• wallet addresses involved
• exact amounts
• timestamps

With these details, anyone can perform blockchain analytics — monitoring transactions, smart contracts, balances, and token flows. Etherscan, the leading blockchain explorer for Ethereum, shows transactions, wallet balances, smart contract code, and token movements in real time.

A user can paste a unique identifier for a transaction or wallet to investigate its activity, or enter a smart contract address to inspect its code. On Ethereum, all such identifiers begin with "0x."

• Pasting a transaction hash — a unique 66-character string — reveals the sender and recipient addresses, the transaction time, and the network fees paid. A hash acts as a digital receipt generated when a transaction is submitted.
• Pasting a wallet address — a unique 42-character identifier — reveals its current ETH balance, transaction history, and holdings, including ERC-20 tokens and NFTs.
• Pasting a smart contract address — also a unique 42-character identifier — retrieves information about its underlying code, allowing users to inspect the contract and, where applicable, interact with it directly.

So, how does one bridge the gap between a digital wallet and a real-world identity? When a user makes an exchange deposit linked to a KYC account or publicly posts their wallet address online, they may effectively de-anonymize themselves.

Centralized exchanges require Know Your Customer (KYC) verification from users, giving them access to information such as real names, addresses, and, in some cases, banking details.

OSINT vs. blockchain analytics

Blockchain analytics firms like Chainalysis and TRM Labs monitor transaction patterns and other on-chain signals to identify wallets that may belong to the same entity, potentially linking previously separate transaction networks. In contrast, OSINT uses publicly available off-chain information to uncover the real-world identities or intent behind crypto wallets.

The two disciplines are closely intertwined. For instance, blockchain analytics can identify stolen assets that moved through a crypto mixer and were later deposited into specific exchange accounts. OSINT, in turn, may reveal who orchestrated the hack. Alternatively, OSINT can provide initial leads that shape the direction of a subsequent investigation before more intrusive collection methods are considered.

Generally, any publicly available information that can legally help achieve an intelligence objective — without bypassing security measures — can fall into the OSINT category.

Here are some examples of off-chain data that can help OSINT investigators identify or track suspicious actors:

• social media footprints
• website domain registration data
• news articles
• LinkedIn profiles
• posts on internet forums
• public email addresses
• screenshots
• property records
• satellite imagery

OSINT can provide relatively low-cost intelligence gathered from publicly available sources, without necessarily requiring warrants, interception, or bilateral agreements. It is also highly scalable: using dedicated software tools, one analyst can monitor thousands of accounts and index vast amounts of information across the open web and, in some cases, publicly accessible parts of the dark web.

Example: ZachXBT uncovers Dean Daghita

One of the best-known crypto investigators, ZachXBT, has built his reputation through a combination of wallet analysis and off-chain OSINT. By digging into clues such as social media profiles, Discord screenshots, forum posts, and public email addresses, he has helped identify individuals allegedly behind high-profile crypto heists.

In January 2026, ZachXBT linked a user known as “John” or “Lick” to more than $90 million in suspected illicit funds through real-time wallet activity shared on Telegram. This included $24.9 million tied to a US government-controlled wallet holding assets seized in connection with the 2016 Bitfinex hack.

A crucial piece of evidence came from live wallet activity during a private Telegram exchange. This led ZachXBT to allege that the suspect may have been connected to Dean Daghita, president of Command Services & Support (CMDSS), a firm contracted by the US Marshals Service.

Following the allegations, “John/Lick” began moving the stolen assets through mixers and across blockchains in an apparent attempt to obscure their origin and consolidate them into wallets under his control.

In March 2026, John Daghita was arrested and indicted following a joint operation by the FBI and the French Gendarmerie. Forbes reported that authorities found him with “$239,348 in cash, a Rolex GMT Master, and multiple hardware wallets containing stolen US government cryptocurrency.”

More cases

ZachXBT also revealed that he helped track kidnappers who extorted around $2 million in ransom from streamer TeufeurS after his father was kidnapped. With his assistance, the Binance Security team was able to freeze approximately $800,000 of the funds, with multiple suspects later arrested.

TeufeurS wrote:

“The money they extorted from me was able to be frozen directly thanks to @zachxbt who had helped me — that's the one good thing about crypto, but it still makes me sick.”

Beyond fraud: Other use cases for OSINT

OSINT is useful beyond tracking hacks or sanctions evasion. It can also be combined with on-chain investigations for:

Market intelligence — identifying wallet owners, tracking “smart money,” and anticipating or explaining token movements and transactions to inform trading decisions. For example, discovering that an insider wallet is accumulating a token could signal increasing supply concentration.

Investigative journalism — cross-referencing public corporate filings, blockchain data, and exchange records to verify claims and uncover evidence of wrongdoing. One of the most prominent examples is the FTX collapse.

FTX: Hidden software flaw

Online investigators scoured financial documents linking FTX with Alameda Research and uncovered balance sheets padded with illiquid FTT tokens, along with evidence of customer deposits being misused. A software exemption, first reported by Reuters, gave the hedge fund “a virtually unlimited line of credit,” allowing it to continue borrowing from FTX even when the collateral securing those loans had lost value.

Those software changes were later corroborated and detailed in civil fraud complaints filed by the US Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC) against FTX CEO Sam Bankman-Fried.

Similarly, media outlets and OSINT investigators extensively covered the Terraform Labs collapse.

Criticism of OSINT

For many crypto privacy advocates, the problem with OSINT goes beyond the erosion of financial privacy as a human right. Critics also argue that it can create physical security risks and produce false positives in wallet attribution.

Those criticisms include:

• Threats to physical safety. Bad actors can also use OSINT to link high-profile wallets to real-world identities for “wrench attacks” — physical coercion, kidnapping, or home invasion. In 2025, the value stolen in such attacks peaked at $58 million, with 2026 already reaching $30 million by mid-year. Home invasions now account for 37% of such incidents.
• The de-anonymization dilemma. OSINT methods can expose wallet holders to unwarranted surveillance, targeted phishing, and doxxing — the publication of private or personal information without consent. This can include sharing contact details, places of work, or private photos to harass, shame, or threaten someone.
• False positives. Investigators can draw flawed conclusions by mistaking multiple wallets controlled by a single person for wallets belonging to multiple individuals, or by assuming that activity linked to a centralized exchange account belongs to a single user. Automated smart contracts further complicate attribution, increasing the risk of misidentification.
• Blind spots. Because OSINT relies on publicly available records and surface-web data, it is not enough to identify every sophisticated financial criminal. It cannot directly access private banking systems, layered corporate structures, or over-the-counter (OTC) trades.

OSINT tools: Turning clues into connections

OSINT investigations rarely rely on a single tool. The real advantage comes from combining blockchain data with information scattered across the wider internet — then connecting the dots.

These tools don't magically reveal someone's identity. They help investigators connect pieces of information that are already publicly available. The quality of the conclusion still depends on the evidence, the methodology, and the investigator's ability to distinguish a genuine connection from a coincidence.

• Arkham is built around on-chain attribution, using wallet labels, multi-chain data, and visualizations to help investigators follow entities and fund flows. Its community-sourced intelligence can also add context that raw blockchain data alone doesn't provide.
• Maltego takes a different approach, focusing on relationships. It pulls information from multiple external sources and displays connections as an interactive graph, making it easier to move from one clue to another — including from a wallet address to related off-chain identities and entities.
• For raw blockchain data, Etherscan and other chain-specific block explorers remain essential. They let investigators inspect transactions, wallet balances, token movements, and smart contracts directly on the public ledger.
• On the off-chain side, SpiderFoot automates much of the initial information gathering. Give it a starting point — such as an email address, IP address, or username — and it searches a wide range of public sources for information connected to it.
• IntelligenceX goes further into harder-to-find corners of the internet. Its search engine indexes data leaks, breaches, historical records, and other sources, allowing searches by identifiers such as email addresses, domains, IPs, and Bitcoin addresses. That can surface references that a conventional web search would miss.

Where OSINT fits into crypto

Blockchain transparency makes crypto unusually well suited to open-source investigation. Transactions provide a permanent trail, while the wider internet supplies the context needed to connect wallets, organizations, and people.

That combination can be powerful. Investigators can follow stolen funds on-chain, then use public posts, leaked information, corporate records, or other digital clues to understand who may be behind the activity. The same techniques can help journalists investigate crypto companies and traders analyze market activity.

But OSINT also has clear limits. Public information can be incomplete, outdated, deliberately misleading, or incorrectly attributed. And once a pseudonymous wallet is linked to a real person, the consequences can extend far beyond the blockchain.

That's ultimately what makes OSINT both useful and controversial in crypto. It doesn't break the blockchain's transparency — it turns that transparency, combined with the vast amount of information available online, into a tool for attribution. For privacy advocates, that's precisely the problem. For investigators, it's one of crypto's most powerful features.