Blockchain analytics
Techniques that trace crypto-asset flows on public ledgers and link addresses to identified actors; they are used to follow ransoms, screen sanctioned wallets and recover funds.
The main blockchains are public ledgers: every transaction is visible, but addresses carry no names. Blockchain analytics consists of clustering addresses controlled by the same actor, following funds from transaction to transaction, and linking these clusters to known entities: exchanges, mixing services, ransomware groups, wallets seized by courts. Specialist firms sell these analyses to law enforcement, platforms and insurers. Their use has become central at the junction of cyber and sanctions. Since 2018, the US Treasury has listed crypto-asset addresses in its sanctions lists; in 2022, it even sanctioned a decentralized mixing service, a decision later challenged in court and lifted in 2025. Before paying a ransom, the negotiator must therefore screen the address supplied by the attacker and its known links, to check that it does not belong to a sanctioned entity. After payment, tracing sometimes lets investigators freeze funds when they reach a regulated platform, and recover part of them, as in the Colonial Pipeline case. The limits are well known: mixing services, cross-chain hops and privacy-enhanced crypto-assets blur the trail.
Textbook case: before authorizing reimbursement of a 400,000 dollar ransom, an insurer has the address supplied by the attackers analyzed. It received funds from a wallet linked to a group sanctioned six months earlier: the payment is blocked, and the insured restores its systems from backups.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.