How do Chinese police track and seize cryptocurrency? Rare paper reveals forensic tools

Chinese police have published a detailed technical report on tracking, seizing, and freezing cryptocurrency – revealing a sophisticated arsenal of forensic tools. Bitcoin, Ethereum and the like may be household names, but they are illegal in China. A 2021 government notice banned their use as currency, and new rules from earlier this year went even further, cracking down on stablecoins and the tokenisation of real-world assets. Yet despite the ban, criminals still favour virtual coins for scams, gambling and money laundering because crypto transfers hide identities and do not require approval by central authorities. A rare technical paper published on June 4 in the journal Forensic Science and Technology offers an unprecedented glimpse into how Chinese law enforcement agencies pursue illicit virtual assets. The authors – Sun Shengbin of the Wenzhou Public Security Bureau, Lou Yandi of the Zhejiang Provincial Public Security Department’s Criminal Investigation Corps, and their colleagues – outline the process of evidence collection, transaction tracing and asset seizure. To understand how they track crypto, one must first grasp how it is stored. Every bitcoin and Ethereum wallet holds a private key – a 64‑digit hexadecimal string generated by a secure random number generator. Whoever controls that key controls the wallet’s contents. Because memorising such a string is impractical, wallets generate a mnemonic phrase consisting of 12 to 24 common English words, such as “apple dog river sky”, that can reconstruct the full private key. Since virtual currencies exist as electronic data, they often live on physical devices such as phones, hard drives or Bluetooth wallets. The investigative process thus begins with cracking the keys and pinpointing the funds. Many users stash their mnemonic phrases in phone memos, WeChat messages or plain text files on their computers. So the first step for investigators, upon seizing a suspect’s device, is to comb through it for any trace of private keys or seed words. Specialised forensic software automates this in three passes: a full‑disk scan using tools such as FileLocator and Meiya Pico’s Forensics Master, intelligent filtering using preset rules such as “12 English words in a row” and automatic validation involving dedicated script checks to weed out gibberish and irrelevant text. For mobile devices, purpose‑built software such as Pinghang PF5200 can scour Android and iOS systems for suspected mnemonics and addresses buried in messaging apps and notes. More advanced platforms – such as Pinghang X501 and Meiya Pico’s Xinghuo – go further by extracting text from images, so even screenshots hidden in photo albums can be uncovered. The authors point out that some wallets come in two modes – cold wallet and watch wallet. Cold wallets are offline devices resembling small USB drives that hold private keys in isolation, while watch wallets are mobile apps that show balances but require the cold wallet’s offline signature to transfer funds. “During on‑site searches, if a watch wallet requiring offline signatures is discovered, investigators must continue searching for the physically isolated cold wallet,” the paper states. If no keys are found on the devices, police have another avenue: tracing the money on the public blockchain, analysing fund flows and identity clues. But this is far trickier than traditional bank‑transfer queries. Smart contracts embedded in the blockchain – designed to throw trackers off the scent – can obfuscate the trail through cross‑chain transfers, token swaps and delegated authorisations. The paper outlines several tracing methods. The first method is tracking transaction fees back to exchanges such as Binance, enabling police to request user data. Cross‑chain analysis comes into play when criminals hop between different blockchains – for instance, from bitcoin to Ethereum – to create a labyrinth. By examining transaction logs, police can map the eventual destination of the funds as if reading a route map. For mixers – services that pool and shuffle coins from many users – investigators compare timestamps and amounts across sub-addresses under the same wallet to trace the ultimate outflow. And through formal legal channels, police can obtain Know Your Customer (KYC) records from major exchanges such as Binance, OKX and HTX. Once the funds are located, the real challenge is seizure and freezing. The direct method is private‑key replacement – moving the illicit crypto into a police‑controlled multisignature wallet and generating a new key, effectively shifting the suspect’s assets into police custody. For funds held on exchanges, police can freeze the account for six months, and the freeze period can be extended. Crucially, the paper underscores strict operational red lines: investigators are forbidden from personally retaining private keys. The principle of “separation of case handling and custody” must be upheld, with full oversight and clear chain‑of‑custody records.

How do Chinese police track and seize cryptocurrency? Rare paper reveals forensic tools

.css-1c6uqr6{color:inherit;font-weight:inherit;font-size:inherit;font-family:inherit;line-height:inherit;overflow-wrap:break-word;}Technical report offers unprecedented glimpse into how investigators crack devices, pinpoint funds and freeze illicit virtual assets

Technical report offers unprecedented glimpse into how investigators crack devices, pinpoint funds and freeze illicit virtual assets