Paper Overview: Police Systematically Reveal Virtual Currency Forensics Tools
According to ChainCatcher, citing the South China Morning Post, researchers including Sun Shengbin from Wenzhou Public Security Bureau and Lou Yandi from Zhejiang Provincial Public Security Department's Criminal Investigation Corps published a technical paper on June 4, 2026, in the journal Criminal Technology. The paper systematically discloses Chinese police forensic tools and procedures for virtual currency assets such as Bitcoin (BTC) and Ethereum (ETH), covering device cracking, evidence collection, on-chain transaction tracking, and asset freezing and seizure. This is the first public insight into the operational methods of Chinese law enforcement agencies in the crypto space.
Tracking Methods: Transaction Fee Tracing and Exchange Cooperation
The paper outlines several tracking methods, with one key approach being the analysis of transaction fees. By examining fee patterns, police can trace transactions back to centralized exchanges like Binance, where they can legally obtain user data. Specifically, they can request Know-Your-Customer (KYC) records—including identity information and transaction history—from major exchanges such as Binance, OKX, and HTX through formal legal channels. This process emphasizes adherence to legal procedures, reflecting a balance between privacy concerns and law enforcement needs.
Asset Freeze: Account Freeze Period and Extension Mechanism
For funds held on exchanges, police have the authority to freeze accounts for six months, with the possibility of extension. This aligns with Anti-Money Laundering (AML) regulatory frameworks, aiming to prevent the transfer or dissipation of suspected assets during investigations. The paper notes that freeze operations must be coordinated with case progress, ensuring both investigation efficiency and minimal impact on legitimate users.
Operational Boundaries: No Private Key Holding and Chain of Custody Requirements
The paper emphasizes strict operational boundaries: investigators are prohibited from personally holding private keys, and must adhere to a 'case handling and custody separation' principle. This means officers cannot simultaneously manage the case and handle private keys, preventing abuse of power. Additionally, comprehensive supervision and a clear chain of custody record are required to ensure every step—from evidence acquisition to asset disposition—is documented and traceable, avoiding evidence contamination or leakage. These guidelines showcase the increasing professionalization and standardization of Chinese police in cryptocurrency enforcement.