Background: Chinese Law Enforcement Reveals Technical Details of Crypto Investigation
According to the South China Morning Post, a technical paper authored by Sun Shengbin of the Wenzhou Public Security Bureau and Lou Yandi of the Zhejiang Provincial Public Security Department's Criminal Investigation Corps was published on June 4, 2026, in the journal Criminal Technology. This is seen as the first time Chinese law enforcement systematically disclosed forensic tools and operational procedures for investigating Bitcoin (BTC), Ethereum (ETH), and other cryptocurrencies.
The paper highlights a common vulnerability: many users store their wallet mnemonic phrases in mobile phone notes, WeChat messages, or text files on computers. Therefore, the first step for investigators after seizing a suspect's device is to exhaustively scan these locations for private keys or seed phrases, enabling them to unlock wallets and retrieve asset information.
On-Chain Tracing: Transaction Fee Forensics and Exchange Collaboration
For on-chain tracking, the paper describes a method leveraging “transaction fee” patterns. When suspects deposit or withdraw funds from exchanges, the fee structure (rate, fee payer, etc.) often bears a unique “fingerprint.” By tracing these patterns, police can identify deposit addresses associated with major exchanges such as Binance, OKX, and Huobi (HTX). With proper legal authorization (e.g., court order), investigators can then request KYC (Know Your Customer) records from these exchanges to obtain the suspect's identity.
Funds already held on exchanges can be frozen for up to six months, with the possibility of extension. This provides law enforcement with sufficient time for investigation while imposing strict compliance obligations on exchanges.
Compliance Red Lines: No Private Key Possession, Separation of Case Handling and Custody
The paper explicitly sets three operational boundaries: First, investigators are absolutely forbidden from holding private keys of suspects. Second, a strict “case handling vs. asset custody” separation must be maintained—personnel responsible for investigation shall not manage the seized virtual assets. Third, a complete chain of custody record must be established for every step of evidence seizure and asset confiscation, ensuring full traceability and accountability.
For post-seizure storage, the paper recommends using dedicated offline cold wallets or hardware security modules (HSMs). Private keys should be jointly managed by multiple departments, and any access requires multi-signature or dual-person authorization.
While the paper does not cite specific case numbers or monetary amounts, its publication marks a milestone in the transparency of China's crypto enforcement capabilities. As Chinese police systematically strengthen digital asset investigation, cryptocurrency holders must pay greater attention to private key security and compliance, or face elevated legal risks.