Background and Core Content of the Paper
According to a report by the South China Morning Post, on June 4, Sun Shengbin of the Wenzhou Public Security Bureau and Lou Yandi of the Zhejiang Provincial Public Security Department's Criminal Investigation Brigade published a technical paper in the peer-reviewed journal Criminal Technology. The paper systematically disclosed, for the first time, the forensic tools and case-handling procedures used by Chinese police for virtual currency assets such as Bitcoin (BTC) and Ethereum (ETH). The content covers the entire chain of evidence: cracking suspect devices, collecting digital evidence, on-chain transaction tracking, and asset freezing and seizure. This publication signals that Chinese law enforcement has established a standardized technical system for cryptocurrency investigations.
On-Chain Tracking Method: Transaction Fee Analysis to Locate Exchanges
The paper outlines several practical tracking methods, with a key technique being the analysis of transaction fees paid to miners. By examining fee patterns in suspicious transactions, police can trace backwards to identify addresses associated with centralized exchanges like Binance. Once an exchange is pinpointed, law enforcement can formally request Know Your Customer (KYC) records through legal channels such as criminal investigation warrants, thereby obtaining the real identities of suspects. This method leverages the public nature of blockchain data and exchanges' compliance obligations, and has become a core tool for Chinese police in combating crypto-related crimes. The paper also notes that transaction fee patterns can reveal unusual behaviors, such as high fees paid to prioritize confirmation in memory pools, which may indicate urgency or attempts to obfuscate.
Exchange Cooperation and Asset Freeze Mechanisms
The paper clearly states that police can lawfully obtain user data from major exchanges including Binance, OKX, and HTX (formerly Huobi). For funds held on these platforms, authorities have the power to freeze accounts. The initial freeze period is six months, and this can be extended as needed based on the progress of the investigation. This mechanism ensures that police can effectively control the involved assets during the inquiry, preventing capital flight. Notably, the paper does not mention methods for freezing assets stored in decentralized wallets (e.g., MetaMask) or through mixers (e.g., Tornado Cash), suggesting that current enforcement actions are primarily targeted at centralized platforms where legal jurisdiction is clearer. The paper also discusses the legal basis for such freezes under Chinese criminal procedure law, emphasizing that due process must be followed.
Operational Standards and Oversight Boundaries
To prevent abuse of power during enforcement, the paper emphasizes strict operational bottom lines: investigators are absolutely prohibited from holding private keys of seized cryptocurrency assets. The principle of "separation between case handling and asset custody" must be adhered to, meaning that different personnel are responsible for investigation and for asset safekeeping, with comprehensive oversight. Additionally, law enforcement agencies must establish a clear chain of custody (监管链) record, ensuring that every step of the process—from seizure to disposal—is documented and traceable. This regulation aims to balance enforcement efficiency with procedural justice, preventing corruption such as investigators misappropriating seized coins. The paper also highlights the need for regular audits and the involvement of third-party custodians in some cases.