Blockchain Forensics Careers Hub: How to Become a Crypto Investigator

Blockchain forensics is one of the more open Web3 roles if you come from fraud, AML, audit or cyber work. Hiring teams look for one thing above tool access: a short public case write-up showing how you trace funds and separate evidence from assumption. This hub routes you to the AOB threads and guides that cover each step.

Part of AOB's Crypto Compliance & Forensics hub.

Start here

1. Find your background below and read the matching thread.

2. Pick an entry role. Most people start as a crypto risk analyst, transaction monitoring analyst or junior investigations analyst.

3. Build one proof piece and post it in the community for feedback.

Route by background

From bank fraud, AML investigations or audit. You already know alerts, case notes and escalation. What changes is the evidence: you often start from a wallet instead of a known customer. Read does bank fraud experience count in blockchain forensics? and Khagesh Chaturvedi's move from TradFi compliance to Web3.

From cybersecurity or threat intel. You know incident timelines and evidence handling. What you'll add is wallet tracing and mapping how scams move money. Start with moving from pentesting into crypto fraud investigation. If you'd rather prevent exploits than trace them, see the smart contract security audits hub.

From compliance or KYC. Forensics work often starts inside compliance teams, so transaction monitoring is a natural first step. See the crypto AML analyst hub.

Not sure yet. This guide to moving into crypto compliance from bank AML, fraud or cyber compares the paths side by side.

Route by question

Which role should I apply for first? 

Common entry points are crypto risk analyst, transaction monitoring specialist and junior investigations analyst at an exchange or analytics firm. Senior investigator roles usually expect prior case experience. Members who do the job share what it looks like in anyone working as a crypto risk analyst?

Do I need paid tools like Chainalysis or TRM? 

Not to get started. A block explorer such as Etherscan, plus free tools like Breadcrumbs or Arkham, is enough to trace a public case. Employers train you on their paid platforms. The bank-fraud thread above has a good discussion of working without paid access.

Which certification helps? 

Chainalysis Certified Investigator is the best-known forensics credential, but full access comes through employers that hold a Chainalysis licence; the foundational modules are free. ACAMS CCAS, updated with Chainalysis content from 19 November 2026, covers crypto AML more broadly. One credential is enough, and proof matters more. See which certification actually helps and

How do I show case work without breaking confidentiality? 

Use public hacks or invented scenarios, and say so at the top of the sample. The full discussion is in case notes without client data.

What a forensics proof piece looks like

Pick one that fits the role you want:

• Wallet-risk walkthrough: one page on a public wallet's history, noting any exposure to mixers, sanctioned addresses or high-risk exchanges.

• Tracing memo: follow funds from a public hack across addresses and bridges to the point where they left, listing each hop.

• Scam-flow case note: explain how a public scam worked, for example a phishing contract, so a non-technical manager can follow it.

Whatever you build, state what's confirmed, what's only likely and what you'd check next. Don't call a wallet criminal; describe what the evidence shows.

Live roles

Browse current openings on the AOB job board, or read a real example: this Financial Crimes Program Manager role.

Getting help

• Candidates: if your CV isn't getting replies, the Web3 CV review focuses on making investigation experience readable.

• Hiring teams: if your job posts attract the wrong applicants, the JD review service helps spell out the casework you need.

What this hub is not

This is a career-navigation page. It isn't a tool tutorial, investigation training or legal advice.

Frequently asked questions

Do I need to code to work in blockchain forensics? 

Not for entry roles. SQL and Python help at senior levels, mainly for working with large datasets.

Can I get into forensics without law enforcement experience? 

Yes. Many people come from bank fraud, AML, audit and cyber. What matters is showing case reasoning on public on-chain data.

Is blockchain forensics work remote? 

Often, especially at analytics firms and exchanges. Roles tied to law enforcement or a licensed entity may need you in a specific country.

More on AOB: Web3 Career Hub for candidates · Crypto compliance jobs: roles, pay and certifications