Crypto assets can seem intimidating to investigators encountering it for the first time in one of their cases. The perception that crypto provides criminals with anonymity and protection from law enforcement has led to assumptions that these cases require specialized technical expertise and skills that differ significantly from traditional financial investigations.
But this is not the case. The core characteristics of blockchain technology are transparency, permanence, and immutability. These do the opposite of hindering investigations; they create investigative advantages that don’t exist in traditional financial crime. Criminal enterprises that believe they’re operating in the shadows are actually using a technology where every financial decision is unchangeable and documented forever.
To illustrate how blockchain technology aids rather than hinders criminal investigations, we’ll follow the case of Helix, a bitcoin mixing service that operated from 2014 to 2017. Larry Dean Harmon launched Helix as a tumbler designed to help its customers launder their digital assets by obscuring the source of their funds.
Operating through Helix on Tor, Harmon marketed his service as providing customers with clean bitcoin that had never been to the darknet before. He partnered with major criminal marketplaces like AlphaBay, developed APIs for its seamless integration and built what appeared to be a successful criminal enterprise that processed 354,468 bitcoins in total, worth approximately $311 million at the time.
Harmon’s entire business model was built around providing his customers with financial obscurity, helping them hide the origins of their crypto transactions. But every bitcoin that flowed through his service, including his commission payments, was recorded permanently on the blockchain.
Traditional crime investigations rely on piecing together evidence from multiple sources: bank records, witness testimony, documents and digital evidence that may be incomplete, destroyed or fragmented. Each piece provides part of the picture and investigators must work to put everything together into a coherent narrative.
Blockchain technology adds a powerful new piece to this investigative puzzle. When an undercover law enforcement agent transferred 0.16 bitcoin from an AlphaBay wallet through Helix, the entire transaction was visible on the blockchain. Helix had exchanged the agent’s bitcoin for an equivalent amount of bitcoin, minus 2.5%. Following the financial breadcrumbs, investigators would later discover that this 2.5% was Harmon’s commission fee, recorded permanently on the blockchain.
This level of transparency extended across Harmon’s entire operation. All 354,468 bitcoins that flowed through Helix left permanent traces on the Bitcoin blockchain that no one could alter or delete after the fact. Investigators had access to a comprehensive transaction history spanning three and a half years that could be correlated with other evidence sources.
There was more evidence to be found. When the blockchain transaction data showed regular large volumes flowing between Helix and AlphaBay, investigators found corresponding evidence in forum discussions where AlphaBay administrators publicly recommended bitcoin tumblers to their customers, with direct links to Helix.
Harmon’s extensive marketing efforts across darknet forums provided significant additional evidence. He had actively promoted Helix with detailed explanations of how the service worked, its technical capabilities and its intended use for evading law enforcement. These forum posts were direct marketing materials that clearly established criminal intent.
This combination of transparent blockchain transactions with preserved digital communications created a comprehensive package of evidence. Investigators now had both financial evidence and communications evidence, with each source reinforcing the other.
Most importantly, the blockchain data served as a roadmap for expanding the investigation. Each transaction showed investigators which darknet markets, exchanges and wallet addresses had interacted with Helix over its three and a half years.
Rather than starting with a single suspect and trying to identify their network, investigators had a complete map of financial relationships that could guide subpoenas, additional undercover operations and parallel investigations into other criminal enterprises that had used the service.
The Helix investigation demonstrates that traditional investigative methods work effectively in cryptocurrency cases, especially when combined with cyber investigative techniques that blockchain technology enables.
The law enforcement undercover purchase was straightforward: an agent transferred a small amount of bitcoin from AlphaBay through Helix. Investigators then followed the commission payment across the blockchain to cryptocurrency exchanges and payment processors, which in turn allowed them to identify Harmon as the individual behind it all.
Proving regulatory violations was similarly direct. Harmon facilitated laundering of over $300 million in illicit proceeds, much of which either came from or was sent to darknet drug markets. In August 2021, he pleaded guilty to conspiracy to launder monetary instruments. In November 2024, he was sentenced to three years in prison.
From manual analysis to automated intelligence
Because the criminal investigation of Helix began in 2016, when blockchain intelligence was not nearly as mature as it is today, it still required investigators to manually review hundreds of thousands of transactions to identify the commission payment patterns that led to Harmon’s identification. While time-consuming, it was doable because of blockchain’s inherent transparency.
Thankfully, modern blockchain analytics tools have evolved to automate much of this pattern recognition, allowing investigators to identify similar operational signatures without requiring years of manual transaction review. The permanent nature of blockchain records means that these investigative techniques will only become more powerful over time, as patterns and relationships become clearer with additional data and analysis capabilities.
The Helix case illustrates how blockchain technology can provide investigators with advantages rather than obstacles. The permanent, transparent nature of blockchain transactions preserves evidence in a way that often exceeds what’s available in traditional financial systems, where evidence can be destroyed, communications can be encrypted and financial records might be incomplete or deliberately obscured.
Criminals are attracted to blockchain technology because it allows them to transfer value without traditional financial intermediaries. But it also creates a comprehensive audit trail that investigators can follow. Instead of relying on the cooperation of multiple financial institutions across different jurisdictions, investigators can access complete transaction histories through blockchain analysis.
Investigators should not be intimidated by cryptocurrency. Instead, the transparency and permanence of blockchain technology gives them the ability to investigate criminal enterprises with unprecedented detail and accuracy. It’s not an obstacle, but an opportunity to build incredibly strong cases.
