Tax Forensics

While cryptocurrency promises financial privacy, underground markets often leave digital breadcrumbs that trained investigators can follow. I recently put my OSINT skills to the test by systematically investigating 35 active underground markets to extract their cryptocurrency addresses. This provided intelligence that blockchain analysis firms desperately need to enhance their attribution capabilities.
This was practical intelligence gathering with a clear purpose: helping blockchain analysis platforms identify and trace illegal cryptocurrency flows more effectively. The results exceeded expectations and demonstrated how systematic OSINT can directly support advanced blockchain analysis efforts.

The Investigation Challenge

Underground markets represent billions in illegal transactions annually, but blockchain analysis firms face a fundamental problem: they can trace cryptocurrency transactions with incredible precision, but they need to know which addresses belong to illegal entities in the first place.
I wanted to help solve this attribution gap using systematic OSINT methodology. The challenge: investigate underground markets across multiple categories and extract cryptocurrency addresses that blockchain analysis platforms could use to enhance their attribution databases and improve transaction tracing capabilities.



My OSINT Methodology

I structured this as a systematic intelligence operation with clear objectives and measurable outcomes. Here’s the framework that delivered results:

Investigation Scope:
35 markets total: 10 carding shops, 11 cybercrime services, and 14 darknet markets
Primary tools: Onion Search for discovery, manual investigation for payment intelligence
OPSEC protocol: Full operational security with VMs, VPNs, and isolated environments
Data collection: Structured approach focusing on payment infrastructure patterns

Intelligence Targets:

  • Cryptocurrency addresses used by illegal market operations

  • Payment method preferences across different market types

  • Address generation patterns that indicate operational sophistication

  • Multi-currency payment infrastructure mapping


The goal was building attribution intelligence that blockchain analysis firms could integrate into their platforms. Every address collected would potentially help trace illegal cryptocurrency flows and identify connected criminal operations.