InvestigationCompliance

Crypto Crime Typologies: 10 Patterns and How to Spot Them On-Chain

Ten ways criminals use crypto, from Ponzi schemes to ransomware and fake tokens, each with a real case measured on the blockchain and the check that finds it.

By Gaurav Agrawal · Blockchain Intelligence

Cover Image for Crypto Crime Typologies: 10 Patterns and How to Spot Them On-Chain

A crime typology is a pattern: the way a kind of crime moves money. Investigators and compliance teams use typologies so they know what to look for before they know who is behind it. Below are ten patterns that leave a trace on a public blockchain, each with a real case and the check that finds it. Every case figure was measured with the Bitquery MCP server, most of them in our own full traces, which are linked.

#	Typology	Case	What the ledger shows
1	Ponzi scheme	FairWin, 2019	Old deposits paid from new ones, and a fee wallet on every payment
2	Giveaway and impersonation scam	Twitter hack, 2020	Hundreds of small payments into one address, then fresh addresses
3	Splitting into fresh wallets	Upbit hack, 2019	One wallet, then 3, 6 and 18 pieces of exactly the same size
4	Mixers	Ronin bridge hack, 2022	Equal 100 ETH deposits into Tornado Cash
5	Bridges and chain hopping	"OpenAI" NEA token, 2024	Proceeds swapped to USDT and sent into a cross-chain bridge
6	Ransomware	Colonial Pipeline, 2021	A ransom payment that moved to an address the FBI controlled
7	Sanctioned and unlicensed exchanges	Garantex, 2019 to 2025	Deposits to addresses on sanctions lists
8	Stablecoins	Garantex, Ronin	Issuer freezes and block lists
9	Rug pulls and fake tokens	"OpenAI" NEA token, 2023	A deployer that removes the pool's liquidity
10	Address poisoning	USDT and USDC, 2026	Zero-value transfers from look-alike addresses

1. Ponzi schemes

A Ponzi scheme pays early investors with money from later ones. On a blockchain, the giveaway is that payouts track deposits rather than any outside income.

Case: FairWin. In 2019 the FairWin contract on Ethereum took in 693,151 ETH and paid all of it back out. 10,115 depositing addresses lost 96,975 ETH between them, and one wallet took 4% of every deposit: 27,617 ETH in 57,675 payments. Full trace.

The check: ask for a contract's inflows and outflows by address. A contract whose outflows follow its inflows, with one address collecting a fixed share of each deposit, is paying old investors with new money.

2. Giveaway and impersonation scams

A scammer poses as someone trusted, a celebrity, a company or an official, and asks for crypto with a promise of something in return.

Case: the 2020 Twitter hack. Hacked accounts promised to double any Bitcoin sent to an address. Victims sent 13.15 BTC. Within hours the hackers moved the coins on, and every large branch then passed through chains of fresh addresses, most used for a day or two and never again. Full trace.

The check: an address that receives hundreds of small payments from unrelated senders in a few hours, then empties into new addresses, fits this pattern. Look at the address's senders and its first spends.

3. Splitting into fresh wallets

Launderers break stolen funds into pieces and move each through new addresses. The aim is to make every path look small and new. Investigators also call the Bitcoin form of this a peel chain: each payment peels off a small amount and sends the rest on to the next address.

Case: the Upbit hack. North Korean hackers stole 342,000 ETH from the Upbit exchange in November 2019. The stolen funds went from one wallet to 3, then 6, and then into 18 pieces of exactly 11,001 ETH, each paid in two parts to a new address. No exchange appeared within five steps on the paths we followed. Full trace.

The check: many transfers of identical size from one wallet to new addresses, within hours, is layering. Labels on each new address show which pieces later reach a service.

4. Mixers

A mixer pools coins from many users and pays them out to new addresses, cutting the link between sender and receiver.

Case: the Ronin bridge hack. Attackers stole 173,600 ETH from the Ronin bridge in March 2022, and the FBI attributed the theft to North Korea's Lazarus Group. In one branch, eight wallets sent 33,400 ETH into the Tornado Cash router in 334 deposits of exactly 100 ETH between 5 and 10 May 2022. Full trace.

The check: deposits into a known mixer in its fixed sizes (0.1, 1, 10 or 100 ETH for Tornado Cash) from a wallet that was funded by a labelled theft. Withdrawals from the mixer can then be matched by size and timing.

5. Bridges and chain hopping

Moving funds to another blockchain means an investigator must follow a second set of records. Bridges and swaps make that move in minutes.

Case: the "OpenAI" NEA token. After the deployer of a fake token on BNB Chain pulled its last liquidity on 2 January 2024, it split 1,621.6 BNB across three new wallets. Those wallets swapped 1,320 BNB through PancakeSwap and sent 325,000 USDT into the Socket bridge between 3 and 25 January. Full trace.

The check: label the counterparties at each step. A bridge contract on the path means the trail continues on another chain, and the bridge's own records on the far side are the next step.

6. Ransomware

Ransomware locks a victim's systems and demands payment, usually in Bitcoin.

Case: Colonial Pipeline. In May 2021 Colonial Pipeline paid a Bitcoin ransom to the DarkSide group. On 7 June 2021 the Justice Department announced it had seized 63.7 BTC of it. The ledger shows the path: address bc1qq2euq8pw950klpjcawuy4uj39ym43hs6cfsegq received the traced coins on 28 May 2021, and 63.7 BTC left it on 7 June, the day of the seizure. Bitquery's labels mark it as the US government's DarkSide seizure address.

The check: follow the ransom payment forward and label each address. Ransomware groups often cash out through exchanges with weak checks, which is where the next typology comes in.

7. Sanctioned and unlicensed exchanges

Some exchanges serve customers no regulated exchange will take. Once a government sanctions one, any transfer to its addresses is a red flag for every exchange that deals with it.

Case: Garantex. The US Treasury sanctioned the Russia-based exchange in April 2022 for laundering ransomware and darknet-market proceeds. In March 2025, US, German and Finnish authorities seized its domains and servers. The Justice Department said Garantex had processed at least $96 billion since 2019, and charged two of its administrators, The Block reported.

The check: screen counterparties against sanctions labels. Bitquery's label directory carries Garantex addresses from the sanctions lists of the US, the EU, France and the UK, alongside other sanctioned exchanges and darknet markets.

8. Stablecoins

Criminals use USDT and USDC because they hold their value. But a stablecoin's issuer can freeze an address, which plain coins like Bitcoin do not allow.

Cases: Tether helped freeze $23 million tied to Garantex during the 2025 takedown, The Block reported. The Ronin exploiter's address sits on both Tether's and Circle's block lists. A thief holding a freezable stablecoin has a reason to swap it quickly.

The check: look up issuer-block labels on an address, and watch for fast swaps out of a freezable stablecoin right after a theft.

9. Rug pulls and fake tokens

A rug pull is a token whose creator draws buyers in and then removes the money from its trading pool.

Case: the "OpenAI" NEA token. The deployer put 60 BNB into a PancakeSwap pool on 27 December 2023 and took 535.8 BNB out in 12 withdrawals over the next week. 112 wallets bought NEA, paying in about 479 BNB, and sales returned about 3. The same deployer and the wallet that funded it created 22 tokens with near-identical code in six weeks. Full trace.

The check: before buying, ask who deployed the token, what else that wallet created, and whether the pool's liquidity tokens still sit in the deployer's wallet.

10. Address poisoning

A scammer sends a zero-value or tiny transfer from an address whose first and last characters match one the victim uses, hoping the victim copies it from their history next time.

Case: stablecoin spam on Ethereum. Over 30 days from 15 September 2026, 27% of USDC transfers and 31% of USDT transfers on Ethereum were for zero or less than $1. Our measurement counts about 11.5 million such transfers of the two tokens.

The check: zero-value transfers between addresses that never otherwise deal with each other, from senders that make thousands of them, are the usual sign of poisoning. Wallets and exchanges can hide them or warn before a user pays a look-alike address.

Patterns that are harder to see on-chain

Some typologies leave little on the ledger: fake identities and money mules at regulated exchanges, crowdfunding through front charities, and trafficking paid in crypto. In these cases the evidence sits in an exchange's customer records and in police work. A trace can still name the exchange that holds those records.

Run these checks yourself

Connect the Bitquery MCP server to your AI client with one URL: https://mcp.bitquery.io. Tracing and labels sit on the AI Investigation MCP plan, at $149 per month on our pricing page. The setup guide covers each client.

Who deployed this token, what else did that wallet deploy, and
does it still hold the pool's liquidity tokens?

Follow the funds from this address three steps. Label every
address and stop at any exchange, mixer or bridge.

Check these addresses against sanctions, ransomware, mixer and
issuer-block labels.

AI investigations

Trace the money by asking an AI

Connect the Bitquery MCP server to Claude, Cursor or ChatGPT and ask in plain English where funds from an address went. The agent follows each hop, names the exchanges and mixers on the path, and returns the transactions behind every step.

Bitcoin, Ethereum, Tron, Solanamulti-hop tracingentity labelsplain English

Try AI Investigations →

Frequently asked questions

What is a crypto crime typology?

A typology describes how a type of crime moves money: a Ponzi scheme, ransomware, a rug pull, laundering through a mixer. Investigators use typologies to know which transfers to look at before they know who is behind them.

Which crypto crimes can be traced on the blockchain?

Most crimes that move money on-chain: scams, thefts, ransomware, rug pulls and laundering through mixers or bridges. Crimes built on fake identities or off-chain cash need an exchange's records to trace.

Can stolen stablecoins be frozen?

Often. Tether and Circle can freeze addresses that hold USDT or USDC, and both have frozen funds tied to crimes. Bitcoin and ETH have no issuer that can do this.