According to a report by the South China Morning Post, Sun Shengbin of the Wenzhou Public Security Bureau and Lou Yandi of the Zhejiang Provincial Public Security Department's Criminal Investigation Corps published a technical paper on June 4 in the journal Criminal Technology, systematically revealing Chinese police forensic tools and case-handling procedures for virtual assets such as Bitcoin and Ethereum. The paper covers device forensics, evidence collection, on-chain transaction tracking, and asset freezing and seizure, providing a standardized reference for law enforcement agencies dealing with crypto-related crimes.
On-Chain Tracking and Exchange Data Acquisition
The paper outlines several tracking methods. One core approach involves analyzing anomalous transaction fees (gas fees/miner fees) to trace funds to centralized exchanges such as Binance, OKX, and HTX, thereby enabling police to obtain user data. Through formal legal channels (e.g., criminal investigation warrants or mutual legal assistance requests), law enforcement can acquire Know Your Customer (KYC) records from these exchanges, including real-name information, IP addresses, and deposit/withdrawal histories.
Asset Freezing and Extension Mechanism
For assets held on centralized exchanges, the police can legally freeze the relevant accounts. The paper notes that the initial freeze period is typically six months, with the possibility of extension. This mechanism allows investigative authorities sufficient time without allowing suspects to move assets. For on-chain assets such as self-custodial wallets, police must use technical measures (e.g., private key recovery or seed phrase extraction) to seize them, but such operations must strictly follow legal procedures.
Operational Boundaries and Regulatory Requirements
The paper emphasizes strict operational boundaries: investigators must not hold private keys or control crypto assets personally. The principle of "separation between case handling and asset custody" must be enforced, meaning the team responsible for the investigation and the team responsible for asset custody are independent and subject to comprehensive oversight. A clear chain of custody record must be maintained to ensure every step is traceable and auditable. These rules aim to prevent abuse of power and asset loss during law enforcement operations.