How investigators Trace Crypto Across Chains

5-Minute Read
Jul 13, 2026
Example H2
Example H3
Example H4
Example H5
Example H6
Share Article

Alexander Manev has spent more than a decade investigating cyber and cryptocurrency crime. Here is how he uses Nominis to attribute entities, follow funds across networks, and turn a tangle of transactions into evidence.

A cryptocurrency investigation rarely stays on the blockchain anymore. A modern case moves not only through bridges, swaps, intermediary wallets, and several networks before the money comes to rest, but also requires off-chain observations to understand the full story. 

An investigator's real work begins there: reconstructing the full path across networks, attributing the addresses along it, and presenting the result clearly enough that a colleague, a client, or a regulator can follow it.

Alexander Manev has worked these cases for more than ten years as a senior investigator in cyber and cryptocurrency crime. The Nominis transaction visualization graph is his primary working environment, and his account of why is a useful guide to what investigators actually need from blockchain intelligence software.

To show where stolen funds go in the aftermath of an attack, Manev turns to the transaction visualiser in the Nominis platform, which renders tangled on-chain movement as a single clear graph and traces the money hop by hop as it splits across wallets, bridges, and mixers. Source 

Attribution does most of the work

‘In my view, high-quality entity attribution accounts for up to 90% of success in cryptocurrency transaction investigations and analysis’, says Alexander. Knowing that an address belongs to a particular exchange, service, or illicit operator is what converts a string of hashes into a story about who sent value to whom.

 In his assessment, attribution in Nominis is clear, accurate, implemented at a high-level and built for investigative use rather than for presentation. This distinction is what makes it defensible enough to put into a report.

Following funds across chains

Once an investigation crosses a bridge or a swap, the work usually slows down, and every manual step is a chance to lose the thread. Analyzing different blockchains inside a single case and a single graph removes that friction. 

Autotrace, which Alexander calls one of the strongest features within the NOMINIS platform, accelerates exactly the cases where volume is highest, such as darknet markets where a single address sits behind an enormous transaction history. 

Autotrace through bridges extends that across the seams between networks, with no need to verify transitions through third-party explorers and less risk of missing an important connection. Clustering across networks rounds it out by grouping related addresses and helping an investigator reach the key elements of a case faster.

Working inside the graph

Much of an investigator's day is spent understanding a single address. Alexander singles out the wallet drill-down for this: from inside a wallet he can sort transactions by time or amount, review counterparties, and search within the wallet itself, which is what makes a heavy transaction history readable rather than overwhelming. Quick search cuts the time needed to move between addresses and entities, performance holds up under load with no noticeable delay, and the visualization stays clean enough to serve both the analyst at the screen and the audience when results are shared.

Investigating the USDTBanList, its Telegram Bot and public donation addresses, Manev utilised the platform to recognise links to wallets attributed to IRGC, Terrorist Infrastructure, Xinbi Guarantee, one of the largest illicit marketplaces, and more. Source 

Context and output

Blockchain data answers what moved and where, rarely who. The OSINT integration built into the graph closes that gap, surfacing geo-related and open-source information about an address without the detour of gathering it elsewhere. And an investigation is only as useful as what comes out of it: CSV export pulls data into spreadsheets, internal tools, or AI workflows, while a full graph download preserves results for reporting and for picking the case back up later.

What this tells us

Strong attribution gives the investigation a foundation. Cross-chain tracing, autotrace, and clustering let the investigator follow funds wherever they go. A fast, clear environment keeps the close analysis quick, OSINT supplies the context the chain cannot, and reliable export turns the work into something defensible. For investigators working real cases at real volume, that combination is the difference between a tool that demonstrates well and one that holds up under pressure.

Nominis is a Know Your Transaction and blockchain intelligence platform. To use the transaction graphs in your own investigations, visit nominis.io to start a trial or request a demo.