A technical paper published on June 4, 2026, by Sun Shengbin of Wenzhou Public Security Bureau and Lou Yandi of Zhejiang Provincial Public Security Department Criminal Investigation Brigade in the journal Criminal Technology has systematically disclosed the forensic tools and operational procedures used by Chinese police to track and seize Bitcoin, Ethereum, and other virtual currencies. The paper was reported by the South China Morning Post, sparking industry-wide attention.
First Step: Scanning Devices for Private Keys
The paper notes that many users store mnemonic phrases or private keys in mobile phone memos, WeChat messages, or plain text files on computers. Therefore, the police first step upon confiscating a suspect's device is to thoroughly scan stored content for any trace of private keys or mnemonic phrases. Investigators also examine cryptocurrency wallet software, browser history, and clipboard snapshots. This methodology is specifically optimized for cryptocurrency storage habits.
On-Chain Tracking: Fee Analysis and Exchange KYC
For blockchain tracing, the paper outlines several techniques. One key method is to trace abnormal transaction fee patterns—for instance, by linking addresses from miners' coinbase transactions or analyzing multi-input/multi-output relationships—to eventually identify deposits or withdrawals from centralized exchanges such as Binance, OKX, and HTX. Once an exchange deposit or withdrawal address is linked, police can obtain KYC records from the exchange through formal legal channels, identifying the suspect's real identity.
For funds already held on exchanges, police can freeze the account for up to six months, with extensions possible based on case needs. The paper stresses that freezing must strictly comply with legal procedures, and assets cannot be appropriated for any other purpose.
Compliance Red Line: No Personal Possession of Private Keys
The paper explicitly prohibits investigators from holding or storing private keys for any reason. It mandates a strict separation between case handling and asset custodianship, along with a complete chain of custody log to ensure every operational step is traceable and auditable. This rule aims to prevent asset misappropriation or internal corruption risks during law enforcement operations.