A technical paper published on June 4 in China’s Criminal Science and Technology journal laid out how Chinese police handle crypto seizure cases from start to finish. Reported by the South China Morning Post, the paper was written by experts from the Zhejiang Provincial Public Security Department and the Wenzhou Public Security Bureau. It describes a workflow built around device forensics, on-chain tracing, exchange data requests, and multisig custody.
Investigators first look for private keys and seed phrases
The paper says the first step is to examine seized physical devices for wallet credentials. Once computers, phones, or hardware wallets are collected, investigators focus on locating private keys or seed phrases that can give direct control over the assets. For desktop and laptop storage, the paper names FileLocator and Meiya Pico’s Forensics Master as scanning tools, with filters such as strings matching “12 consecutive English words.”
Mobile forensics goes deeper into the operating system. According to the paper, police use Pinghang PF5200 to inspect iOS and Android devices, including messaging apps and note-taking tools. If a seed phrase has been saved as a screenshot, OCR-capable tools such as Pinghang X501 and the Meiya Pico Spark platform can extract the text directly from images. The paper also notes that if officers find a watch-only wallet, they should continue searching the scene for a separately stored cold wallet.
Cross-chain transfers and mixers are traced through transaction patterns
If no usable wallet credentials are found on devices, investigators shift to blockchain analysis. The paper says tracing does not stop at simple transfers. It covers cross-chain movement, token swaps, and mixer usage by comparing timestamps, amounts, and the origin of fee payments. One method described is matching transaction times and values across sub-addresses controlled by the same wallet to identify where mixer outputs eventually land.
Gas fee analysis is another piece of the process. By following the account that funded transaction fees, investigators try to reconnect obscured wallet activity to a broader transaction network. The paper says that once funds are traced to centralized exchanges such as Binance, OKX, and HTX, police can use formal legal channels to request KYC identity records tied to those accounts.
Frozen exchange accounts and police-controlled multisig wallets
The paper separates seizure handling into two categories: assets held on exchanges and assets held in on-chain wallets. For exchange balances, police can request an account freeze for six months, with the option to extend it. For assets in self-custodied wallets, officers who have obtained the relevant keys can transfer the funds into a police-controlled multisig wallet.
The custody section is unusually specific. The paper says frontline investigators are not allowed to hold private keys on their own, and the entire confiscation process must follow a separation between case handling and asset custody, with a complete chain of custody recorded throughout. Taken together, the paper shows that crypto enforcement in these cases is not limited to wallet tracing alone. It spans device extraction, on-chain analysis, identity requests to exchanges, and structured control over seized digital assets.