Yes, the FBI can track most crypto, and it does so routinely. Bitcoin and most other coins run on public ledgers, so every payment stays visible forever. Agents use blockchain-analysis software to follow the money, then subpoena exchanges to put names on the addresses. Monero is different: it hides the sender, receiver and amount on-chain, and there is no public evidence that the feds can routinely trace it from the blockchain alone. But Monero users still get identified through things around the blockchain: KYC exchanges, IP addresses, remote nodes, seized devices and simple mistakes.
This guide explains how crypto tracing actually works, the real cases where it worked, what is publicly known about efforts to trace Monero, and the lawful privacy habits that close the gaps. It is not legal advice.
Can the FBI track crypto?
For transparent coins like Bitcoin, Ethereum and Litecoin, the answer is a clear yes. The Bitcoin whitepaper itself says privacy depends on keeping public keys anonymous, because "the public can see that someone is sending an amount to someone else". Investigators don't need to break any cryptography. They read the ledger like a bank statement that anyone can download.
The FBI does not do this alone. Crypto cases usually involve several agencies:
- FBI, including its Virtual Assets Unit, which worked the Bitfinex case.
- IRS Criminal Investigation (IRS-CI), whose cyber crimes agents traced the payments in some of the biggest cases on record.
- Homeland Security Investigations (HSI), the Secret Service and the DEA, plus foreign police forces.
- Private analytics firms such as Chainalysis, TRM Labs and Elliptic, which sell tracing software and data to government agencies.
How blockchain analysis works on Bitcoin
1. The public ledger
Every Bitcoin transaction shows the sending addresses, the receiving addresses and the exact amounts. That record never goes away. A payment you made in 2017 can be analyzed in 2026 with better tools than existed then.
2. Clustering heuristics
Analytics software groups addresses that probably belong to the same person or service. The best-known rule is the common-input-ownership heuristic: if several addresses are spent together in one transaction, they likely share an owner. Researchers showed back in 2013 how well this works in the paper "A Fistful of Bitcoins". Software also guesses which output is change going back to the sender, and it labels clusters for known exchanges, darknet markets, mixers and scams.
3. Exchange records and subpoenas
Here is where addresses get names. In the US, exchanges that handle customer funds are money services businesses under the Bank Secrecy Act, per FinCEN's 2019 guidance. They collect ID (KYC), keep records and file suspicious activity reports. When a traced payment lands at an exchange, investigators send a subpoena or court order and get the account holder's name, ID scans, bank details and login IPs.
4. Cash-out points
Most people eventually want dollars, goods or a bank balance. Bank wires, card top-ups, gift-card purchases and shipping addresses all connect back to a real identity. Investigators often work backward from the cash-out to the crime.
Real cases where the feds traced crypto
Silk Road (2013)
The FBI arrested Silk Road founder Ross Ulbricht in San Francisco in October 2013. He was later sentenced to life in prison and was pardoned by President Trump in January 2025. Early identification came mostly from old-fashioned detective work: an IRS-CI agent connected an early online post promoting the site to a later post signed with Ulbricht's own Gmail address. Bitcoin tracing kept paying off for years afterward. In 2022, prosecutors announced that James Zhong pleaded guilty to stealing from Silk Road back in 2012. Agents had seized about 50,676 BTC from his home in 2021, nearly a decade after the theft.
Welcome to Video (2019)
In October 2019, the Justice Department announced the takedown of a darknet child sexual abuse site that took payments in Bitcoin. According to the DOJ release, IRS-CI agents traced the Bitcoin payments, helped locate the server in South Korea and identify its operator, Jong Woo Son, and 337 site users around the world were charged. It is one of the clearest examples of blockchain tracing unmasking both an operator and his customers.
Colonial Pipeline ransom (2021)
Colonial Pipeline paid the DarkSide ransomware group about 75 BTC in May 2021. A month later, the DOJ announced it had seized 63.7 BTC, then worth about $2.3 million. Agents followed the ransom across the public ledger to a specific address and obtained a seizure warrant for it. The FBI had the private key for that address; officials have not explained publicly how they got it.
The 2016 Bitfinex hack (2022 arrests)
In 2016, 119,754 BTC was stolen from the Bitfinex exchange. In February 2022, agents arrested Ilya Lichtenstein and Heather Morgan in New York and seized about 94,000 BTC, worth roughly $3.6 billion at the time. Lichtenstein used fake identities, automated transactions, darknet markets, mixers and "chain hopping" into other coins. It still didn't work. In November 2024 he was sentenced to five years in prison; the case was investigated by IRS-CI, the FBI (Chicago and its Virtual Assets Unit) and HSI. Morgan received 18 months. The lesson: years of laundering couldn't erase a trail that started on a public ledger and ended at accounts tied to real people.
Can the feds track Monero?
Not the way they track Bitcoin. Monero was built so that the blockchain doesn't reveal who paid whom or how much. Here is what's on the chain:
- Ring signatures hide the sender. Each input is signed together with 15 decoys pulled from the blockchain, so an outside observer sees 16 possible sources (Moneropedia; ring size 16 since the August 2022 upgrade).
- Stealth addresses hide the receiver. Each payment goes to a fresh one-time address that can't be linked to your public address (Moneropedia).
- RingCT hides the amount, and it has been mandatory for every transaction since 2017 (Moneropedia).
The Monero project's own technical specs are honest about the limits: recipient and amount privacy are rated "strong," while sender privacy from ring signatures is "probabilistic / plausible deniability." Rings are a crowd you hide in, not a wall. For the full on-chain picture, see Is Monero Private? and our honest breakdown of whether Monero is 100% untraceable.
What's publicly known about efforts to trace Monero
The 2020 IRS contracts
In September 2020, the IRS awarded contracts to Chainalysis and Integra FEC to develop tools for tracing Monero and other privacy tech, including Bitcoin's Lightning Network. The federal award notice lists a not-to-exceed value of $625,000 per contract, about $1.25 million combined (Decrypt coverage). Neither the IRS nor the firms have published what came of the work.
The leaked 2024 Chainalysis video
In September 2024, a deleted Chainalysis training video leaked online. According to Cointelegraph and Decrypt, it described Chainalysis running its own Monero nodes that logged the IP addresses and timing of wallets that connected to them and sent transactions through them, then combining that data with its own analysis of the blockchain. In other words, the method described attacks the network layer — who connected to a node controlled by the firm — rather than breaking Monero's cryptography.
Some important caveats:
- Chainalysis has not publicly confirmed or explained the video. A spokesperson said it had "no comment to share at this time."
- Monero community members called the nodes "essentially fake proxy nodes" and argued that users who run their own node or use Tor are not exposed this way.
- Nobody outside Chainalysis knows how accurate or widely used the method is. Treat strong claims in either direction with caution.
Ring signature weaknesses
Rings have known statistical weaknesses. A 2017–2018 academic study found many early transactions (from before 2017, when rings were small and zero-decoy spends were allowed) were traceable; Monero changed its rules since then. The Monero developers also acknowledge the EAE attack: if the same outside party (say, an exchange) sends you funds and later receives them back, it can narrow down which ring member is real. That's one of the reasons Monero is replacing rings, as the project explains in its FCMP++ announcement.
The FCMP++ upgrade
Full-Chain Membership Proofs (FCMP++) replace the 16-member ring with a proof that your input is one of essentially every eligible output on the chain. That would make decoy analysis and EAE-style attacks far less useful. As of November 2026, FCMP++ is not live on mainnet. It is being tested on a public test network, the latest mainnet releases are still version 0.18.5.x, and the official getmonero.org roadmap lists it as upcoming with no date. Read more in What Is FCMP++?
How people actually get caught
Across Bitcoin and Monero cases, the pattern is the same. The weak point is rarely the math. It's the edges.
- KYC on the way in or out. If you buy coins on an ID-verified exchange and send them to your wallet, the exchange knows you own that withdrawal. The same applies when you send coins back to an exchange to sell. Even with Monero, the exchange sees what you deposited and when.
- Remote nodes. A light wallet that connects to someone else's node tells that node your IP address and when you broadcast a transaction. That is exactly the gap the leaked Chainalysis video described. See the Monero docs on remote nodes.
- Timing and amounts. If you swap exactly 0.5 BTC into Monero and an hour later someone receives a matching value, a well-placed observer (like the swap service, under subpoena) can guess the link.
- Reused identity. Same username, same email, same writing style, same home IP. Ross Ulbricht's Gmail post is the classic example.
- Seized devices. An unlocked phone or computer with a wallet on it reveals everything the blockchain hides. Lichtenstein's keys were found in files in his online storage.
- People. Partners, buyers, informants and chat logs. Finnish police said in 2024 they had traced Monero in a high-profile extortion case but did not publish how; Monero community members attributed any link to mistakes when converting between coins (Decrypt).
How to reduce risk with lawful privacy practices
Privacy is legal, and wanting it doesn't make you a criminal. Your salary, savings and shopping habits are nobody else's business. Here's how to keep your ordinary, lawful payments private. (For where Monero stands legally, see Is Monero Legal?)
- Run your own Monero node. Your wallet then talks only to your own software, not to a stranger who may be logging IPs. Our guides: How to Run a Monero Node and Should You Run Your Own Monero Node?
- Use Tor. Route your wallet and node over Tor so your IP isn't exposed. Monero's node software also uses Dandelion++ to hide where a transaction first entered the network, but the Monero docs say full protection requires wrapping it with Tor (Tor/I2P setup guide). Background: What Is Tor? and VPN vs. Tor for Monero.
- Use a new subaddress for each payer. It keeps different people from linking payments to the same address.
- Keep your wallet updated. Upgrades fix privacy bugs and raise the bar, as FCMP++ will when it ships.
- Avoid unnecessary KYC links. Every ID-verified purchase ties coins to your name, so think about where your Monero comes from. Swap services listed on Monerica, such as CCE Cash, SageSwap and GhostSwap, let you swap other coins into Monero; check each Monerica profile for its KYC policy and details. To sell Monero, there's xmr2cex. Browse all Monero exchanges on Monerica.
- Don't round-trip obvious amounts. Let funds sit, and avoid swapping in and out in matching amounts within minutes.
- Spend Monero directly. Paying a merchant in XMR avoids a cash-out point entirely. Find businesses in the Monerica directory.
- Stay legal. Report taxable gains (Monero Taxes). Privacy tools protect your data; they don't change what the law requires of you.
For a full setup, see The Most Private Way to Use Monero. You can also watch our video Bitcoin vs Monero: Only One Is Actually Private (also on Monerica Video).
The bottom line
Bitcoin is a public record, and the FBI, IRS-CI and their contractors are very good at reading it. Years-old cases keep getting solved because the trail never disappears. Monero removes that trail from the blockchain, and there's no public proof that anyone can routinely trace it on-chain. What the feds can do is watch the edges: exchanges, nodes, IP addresses, devices and people. Close those gaps and Monero gives you the financial privacy cash used to.
This article is for general information only and is not legal advice. Facts are current as of November 2026.
FAQ
Can the FBI track crypto?
Yes, for transparent coins like Bitcoin. Every transaction is public, and agents combine blockchain-analysis software with exchange records obtained by subpoena to identify users.
Can the feds track Monero?
Not directly from the blockchain, as far as public evidence shows. Monero hides senders, receivers and amounts. Investigators instead target the edges: KYC exchanges, IP addresses seen by remote nodes, timing, seized devices and user mistakes.
Can Chainalysis trace Monero?
A leaked 2024 training video described Chainalysis using its own Monero nodes to log IP addresses and timing. That is a network-level method, not a break of Monero's cryptography. Chainalysis hasn't publicly explained it, and running your own node or using Tor avoids that exposure.
Is using Monero illegal in the US?
No. Owning and using Monero is legal in the US as of November 2026, though some exchanges don't list it. See Is Monero Legal? This is not legal advice.
Does a VPN make crypto untraceable?
No. A VPN only hides your IP from the sites you connect to, and the VPN company can see it. It does nothing about a public ledger or an exchange that has your ID.
Related Articles
- Is Monero Traceable? (2026 Guide)
- Is Monero Private? (2026 Guide)
- Monero vs. Bitcoin Privacy: What Is Actually Traceable?
- What Is FCMP++? Monero's Next Big Privacy Upgrade
- What Is Tor? How It Really Works (and How People Still Get Caught)
- Is Monero Legal in 2026? US, EU, UK & Where XMR Is Restricted
