# Guglielmo Anfossi Blockchain investigations and investigative systems. Tracing digital assets across mixers, bridges, DeFi and services for legal and compliance teams. I gather information from adversarial systems. Today, my focus is blockchain investigation. I trace illicit funds across mixers, bridges, DeFi and exchanges, identify the services used to move and launder them, and turn on-chain activity into evidence that investigators, compliance teams and legal professionals can act on. My work has involved investigations alongside Swiss law enforcement, the US Secret Service, UK law enforcement, compliance teams, legal professionals and cryptoasset businesses. Over time, my work moved from investigating transactions to understanding the systems behind investigations: how behaviour can be represented, how patterns can be formalised, and how investigative reasoning can be made reproducible. ## Investigative systems I design deterministic systems for structuring blockchain investigations, formalising investigative patterns and reducing repetitive analytical work. My work in this area includes: - ontology engineering - graph-based investigation - pattern classification - deterministic tracing - knowledge representation - automated reporting The question behind this work predates blockchain. I trained at the Brera Academy of Fine Arts in Milan, where I also tutored semiotics and pedagogy, and graduated with highest honors with a thesis on semiotic relationships across systems. Its question was simple: how can we infer the structure and behaviour of one system from what it leaves behind? An investigation is that question under a deadline. I continue exploring it in Constraints, my newsletter on what blockchains reveal and conceal, and through research projects and prototypes such as Container NFTs, Atomic Barter and Portable Sentinel. Each explores, in a different way, what can be proven, exchanged or observed between systems. I am interested in what remains when a system is adversarial, incomplete or deliberately opaque. Blockchains happen to be a particularly good place to look because even when activity is deliberately obscured, the traces remain. Outside blockchain, I write short stories and poetry in Italian, and I have created installations and other artistic work. ## Credentials - Crystal Expert EVM Investigator (CEEI), Crystal Intelligence, 2026 - Crystal Expert UTXO Investigator (CEUI), Crystal Intelligence, 2026 - Neo4j Certified Professional, Neo4j, 2026 ## Public case notes - $10.5M USDT: Investigative work behind a single-case freeze and recovery of $10.5M in stolen USDT, with Swiss authorities. (Work carried out as part of a small team.) - 11.7K BTC: Bitcoin traced through a mixer. Overflow analysis narrowed the window; volume isolated the cluster. (Work carried out as part of a small team.) - Inferno Drainer: One campaign’s operator, isolated among thousands sharing the same contracts, from on-chain data alone. ## Profiles - [Website](https://anfossi.systems/) - [LinkedIn](https://www.linkedin.com/in/sincronik) - [GitHub](https://github.com/Bottegatecnologica) - [Constraints newsletter](https://www.linkedin.com/newsletters/constraints-7476766685643919360/) - [Are.na](https://www.are.na/guglielmo-anfossi) ## Essays - [The Transfer That Never Happened (Delta-Neutral Siphoning)](https://anfossi.systems/writing/the-transfer-that-never-happened/): Delta-neutral siphoning moves value without a single transfer, which is why it walks straight past the method most investigations start with. - [The Strings Stay Public (Why Tracing Is Not Enough)](https://anfossi.systems/writing/the-strings-stay-public-why-tracing-is-not-enough/): Tracing funds walks edges until they end in a mixer, a nested service, a deposit address you cannot compel. It sees what moved. - [A Finding Stands Without You](https://anfossi.systems/writing/a-finding-stands-without-you/): A report leaves my desk on a Tuesday and arrives, weeks later, in a room I have never seen. Opposing counsel reads it. - [The Magic of Flash Loans (Part 2): The Next Octave](https://anfossi.systems/writing/the-magic-of-flash-loans-part-2-the-next-octave/): A wall taken down at one layer has a way of reappearing at the next. Silence it in one octave, and it returns in another. - [The Magic of Flash Loans (Part 1): Capital Was Never the Constraint](https://anfossi.systems/writing/the-magic-of-flash-loans-part-1-capital-was-never-the-constraint/): Flash loans look like free money. They are a primitive that removes the constraint everyone assumed was fundamental. - [Two Sweeps Pointed at the Same Address](https://anfossi.systems/writing/two-sweeps-pointed-at-the-same-address/): The tracing was done and the report was already with law enforcement when the client told me the part that reopened the case. - [The Desk Opens on Monday](https://anfossi.systems/writing/the-desk-opens-on-monday/): The stolen value lands at an exchange on a Saturday night. You watch the deposit confirm. That desk opens on Monday. - [Achilles Catches the Tortoise Where It Has to Stop](https://anfossi.systems/writing/achilles-catches-the-tortoise-where-it-has-to-stop/): An investigation moves in steps. What it chases appears not to. Every action is discrete: you pull transactions, map a cluster, document a finding. - [Why Blind Experts Fail, and How Great Teams Connect the Dots](https://anfossi.systems/writing/why-blind-experts-fail-and-how-great-teams-connect-the-dots/): Imagine a world where everyone is an expert in a different cheese, yet no one knows how to pair them, or even notices when one has gone bad. - [Second-Hand World (Part 2): The Role of Knowing](https://anfossi.systems/writing/second-hand-world-part-2-the-role-of-knowing/): The argument so far leaves us in an uncomfortable place. The old question returns: is the model merely manipulating symbols, or does it know something? - [Second-Hand World (Part 1): What LLMs Inherit From the World They Never Touched](https://anfossi.systems/writing/second-hand-world-part-1-what-llms-inherit-from-the-world-they-never-touched/): A formal system derives its conclusions because they follow from its axioms: its starting rules, assumed true without proof. - [A Scam Made to Measure](https://anfossi.systems/writing/a-scam-made-to-measure/): The client I remember most was a smart contract developer. He signed a single drainer transaction. Everything gone. - [A Powerful Tool Will Not Save You](https://anfossi.systems/writing/a-powerful-tool-will-not-save-you/): Complexity is not chaos. Chaos has no handles. Complexity does: it is a dialogue of dependencies, tensions, and patterns awaiting interpretation. - [What a USDT Recovery Actually Looks Like](https://anfossi.systems/writing/what-a-usdt-recovery-actually-looks-like/): People hear "we recovered stolen Tether" and picture a heist in reverse. A key cracked, the thief's wallet broken back into, the funds yanked out. - [Welcome to Constraints](https://anfossi.systems/writing/welcome-to-constraints/): Every investigation hits a point where the evidence runs out. The graph ends. The wallet has no owner. What's left looks like too little to know anything. - [Guess Who? (On-chain)](https://anfossi.systems/writing/guess-who-on-chain/): He had a profile picture. That was the whole case. An X account. One avatar, an NFT, the kind people wear like a face. - [Wallet Balances](https://anfossi.systems/writing/wallet-balances/): He sent me a screenshot. One wallet. A Solana balance. A few memecoins. Find the wallet, he said. No address. No transaction hash. - [A Special Demixing Case](https://anfossi.systems/writing/a-special-demixing-case/): Thousands of bitcoins walked out of a virtual asset service provider years ago. The wallets went quiet for a long time. - [Inside Inferno Drainer](https://anfossi.systems/writing/inside-inferno-drainer/): A DeFi protocol's social media account got hijacked. Fake airdrop, cloned site, one phishing link, one malicious signature, wallets drained. ## Glossary - [Blockchain](https://anfossi.systems/glossary/blockchain/): A ledger replicated across a network of nodes, where each block references the previous one, making past records tamper-evident. - [Block](https://anfossi.systems/glossary/block/): A batch of transactions added to the chain at once, with a header linking it to the previous block. - [Transaction](https://anfossi.systems/glossary/transaction/): A signed instruction recorded in a block that changes the ledger, usually by moving value or calling a smart contract. - [Transaction hash (TxID)](https://anfossi.systems/glossary/transaction-hash/): The unique identifier of a transaction; the standard reference that lets anyone verify on-chain evidence independently. - [Mempool](https://anfossi.systems/glossary/mempool/): The set of broadcast but unconfirmed transactions held by nodes; public, watched by bots, and bypassed by private relays. - [UTXO model](https://anfossi.systems/glossary/utxo-model/): The Bitcoin-style accounting model in which funds exist as discrete unspent outputs that must be spent in full. - [Account model](https://anfossi.systems/glossary/account-model/): The Ethereum-style accounting model in which each address holds a balance that transactions debit and credit directly. - [Nonce](https://anfossi.systems/glossary/nonce/): In account-based networks, the sequence number of each transaction an address sends; it fixes order and enables replacement. - [Fork](https://anfossi.systems/glossary/fork/): A split in a blockchain’s history; after a hard fork, the same keys control balances on both resulting chains. - [Block explorer](https://anfossi.systems/glossary/block-explorer/): A tool that displays blockchain data in readable form, allowing independent verification. - [Privacy coin](https://anfossi.systems/glossary/privacy-coin/): A cryptocurrency that hides some or all transaction details, such as Monero or shielded Zcash, severely limiting tracing. - [Smart contract](https://anfossi.systems/glossary/smart-contract/): A program deployed on a blockchain that executes automatically when called, implementing tokens, exchanges and protocols. - [Native coin](https://anfossi.systems/glossary/native-coin/): The base asset of a blockchain, used to pay fees and secured directly by the protocol, such as BTC or ETH. - [Token](https://anfossi.systems/glossary/token/): An asset issued by a smart contract on an existing blockchain, distinct from the network's native coin. - [Token approval](https://anfossi.systems/glossary/token-approval/): A permission letting another address or contract spend a holder’s tokens; the main mechanism abused by drainers. - [Stablecoin](https://anfossi.systems/glossary/stablecoin/): A token designed to hold a stable value, usually one US dollar; centrally issued stablecoins can typically be frozen. - [Tether (USDT)](https://anfossi.systems/glossary/tether-usdt/): The most widely used dollar stablecoin; its issuer can freeze USDT held at specific addresses. - [Wrapped token](https://anfossi.systems/glossary/wrapped-token/): A token representing another asset, redeemable for it, backed by a custodian or by funds locked in a contract, usually a bridge. - [Counterfeit token](https://anfossi.systems/glossary/counterfeit-token/): A token that imitates the name, ticker or logo of a legitimate asset to deceive victims. - [Non-fungible token (NFT)](https://anfossi.systems/glossary/nft/): A token whose units are unique; it proves control of the token, not legal ownership of the item it refers to. - [Seed phrase](https://anfossi.systems/glossary/seed-phrase/): A 12- or 24-word backup from which a wallet derives all its keys; an optional passphrase can hide additional wallets. - [Private key](https://anfossi.systems/glossary/private-key/): The secret that authorises spending from an address; whoever holds it controls the funds. - [Public key](https://anfossi.systems/glossary/public-key/): The key derived from a private key and used to verify signatures; it cannot be reversed to obtain the private key. - [Address](https://anfossi.systems/glossary/address/): The pseudonymous identifier used to send and receive funds; its format depends on the network. - [Change address](https://anfossi.systems/glossary/change-address/): In UTXO networks, the address receiving the leftover value of a transaction, controlled by the sender. - [Deposit address](https://anfossi.systems/glossary/deposit-address/): An address a service assigns to a customer for incoming funds; identifying it allows KYC data to be requested. - [Memo / destination tag](https://anfossi.systems/glossary/memo-destination-tag/): A transaction field identifying the customer when a service uses one shared deposit address, as on XRP or Stellar. - [Wallet](https://anfossi.systems/glossary/wallet/): The software or device that manages keys and builds transactions; not to be confused with an analytical cluster. - [Hot wallet](https://anfossi.systems/glossary/hot-wallet/): A wallet with keys on an online system; for services, the operational address where deposits are swept. - [Cold wallet](https://anfossi.systems/glossary/cold-wallet/): A wallet with keys kept offline, used by individuals and services to store funds securely. - [Hardware wallet](https://anfossi.systems/glossary/hardware-wallet/): A device that stores keys on a secure chip; seizing it is not enough without the PIN, seed phrase or passphrase. - [Custodial and non-custodial wallet](https://anfossi.systems/glossary/custodial-wallet/): Custodial: a provider holds the keys and can identify or freeze. Non-custodial: only the user holds the keys. - [Multisignature (multisig)](https://anfossi.systems/glossary/multisig/): An address requiring signatures from several keys (m-of-n); actual control may still be centralised. - [Virtual asset service provider (VASP)](https://anfossi.systems/glossary/vasp/): The FATF term for persons or businesses that exchange, transfer or safeguard virtual assets for others; classification turns on the activities performed. - [Crypto-asset service provider (CASP)](https://anfossi.systems/glossary/casp/): The EU MiCA category of authorised crypto-asset service providers; it overlaps with, but differs from, the FATF VASP concept. - [Know your customer (KYC)](https://anfossi.systems/glossary/know-your-customer/): The identification and verification of customers by regulated entities, including VASPs, under AML/CFT rules. - [Know your business (KYB)](https://anfossi.systems/glossary/know-your-business/): Due diligence on corporate customers: legal entity, directors, beneficial owners and business activity. - [Know your transaction (KYT)](https://anfossi.systems/glossary/know-your-transaction/): Commercial screening of transactions for risk signals such as sanctions, darknet markets, scams or stolen funds; not a defined regulatory term. - [Travel Rule](https://anfossi.systems/glossary/travel-rule/): The FATF standard requiring service providers to exchange originator and beneficiary data on qualifying transfers. - [Centralised exchange (CEX)](https://anfossi.systems/glossary/centralised-exchange/): A custodial trading platform where users deposit into platform-controlled addresses and trade through an internal order book. - [Nested service](https://anfossi.systems/glossary/nested-service/): A smaller exchange, OTC desk, payment processor or broker that routes virtual-asset activity through accounts at a larger host. - [Decentralised finance (DeFi)](https://anfossi.systems/glossary/defi/): Financial services such as trading, lending and yield products implemented through smart contracts rather than solely by a conventional intermediary. - [Liquidity pool](https://anfossi.systems/glossary/liquidity-pool/): A smart-contract reserve of tokens used to facilitate trades on a DEX; LP claims track a share of the pool. - [Decentralised exchange (DEX)](https://anfossi.systems/glossary/decentralised-exchange/): Smart contracts that let users swap tokens from their own wallets, without a custodian or account registration. - [DEX and bridge aggregator](https://anfossi.systems/glossary/aggregator/): A router that splits a swap or cross-chain transfer across many DEXs or bridges; the funds only pass through it. - [Instant exchange service](https://anfossi.systems/glossary/instant-exchange/): A custodial swap service that receives one crypto-asset at a deposit address and sends another, often on a different network. - [Over-the-counter (OTC) desk](https://anfossi.systems/glossary/otc-desk/): A broker executing large trades directly with clients, often converting crypto to fiat outside public order books. - [Coin mixer](https://anfossi.systems/glossary/coin-mixer/): A service or protocol that pools users’ funds to break the link between deposits and withdrawals. - [Transfer](https://anfossi.systems/glossary/transfer/): An on-chain movement of value between addresses or accounts; under UTXO, individual flows are analytically inferred. - [Internal transaction](https://anfossi.systems/glossary/internal-transaction/): An operation triggered by a smart contract during execution, not separately signed; visible only through traces. - [Swap](https://anfossi.systems/glossary/swap/): The exchange of one crypto-asset for another, either on-chain via a DEX or custodially via an exchange or instant service. - [Cross-chain bridge](https://anfossi.systems/glossary/cross-chain-bridge/): A protocol that transfers assets or value between blockchains; the two legs sit on separate ledgers and must be matched. - [Bridge explorer](https://anfossi.systems/glossary/bridge-explorer/): A website or tool that tracks transfers through one or more cross-chain bridges and presents their source and destination transactions in a readable form. - [Chain-hopping](https://anfossi.systems/glossary/chain-hopping/): The movement of funds across multiple blockchains through bridges, crosschain swaps and exchange services. - [Flash loan](https://anfossi.systems/glossary/flash-loan/): An uncollateralised loan borrowed and repaid within one transaction; if not repaid, the whole transaction is reversed. - [Maximal extractable value (MEV)](https://anfossi.systems/glossary/mev/): Value captured by including, excluding or reordering transactions in a block, e.g., arbitrage or front-running. - [Airdrop](https://anfossi.systems/glossary/airdrop/): The distribution of tokens to multiple addresses, typically to promote a project or reward users for past activity. - [Dusting](https://anfossi.systems/glossary/dusting/): The sending of very small amounts of cryptocurrency (“dust”) to target addresses, sometimes to encourage activity that may reveal links between addresses. - [Address poisoning](https://anfossi.systems/glossary/address-poisoning/): Fraud that plants a lookalike address matching the ends of one the victim used, so it appears in history and is copied for a later payment. - [Drainer](https://anfossi.systems/glossary/drainer/): A malicious toolkit of scripts and contracts that steals assets by tricking victims into authorising transactions or signing malicious messages. - [Sweeper bot](https://anfossi.systems/glossary/sweeper-bot/): An automated script that instantly moves out any funds arriving at an address whose keys have been compromised. - [Peel chain](https://anfossi.systems/glossary/peel-chain/): A sequence of transactions that peel off value to another destination, often a deposit address, while the remainder continues to a new address. - [CoinJoin](https://anfossi.systems/glossary/coinjoin/): A collaborative UTXO transaction in which multiple users combine inputs into a single transaction to obscure which outputs belong to which participants. - [Freeze request](https://anfossi.systems/glossary/freeze-request/): A request to an exchange, custodian or stablecoin issuer to block funds believed stolen or subject to legal action. - [Tracing](https://anfossi.systems/glossary/tracing/): Following value forward or backward from a start point across transactions, addresses, swaps and bridges, with a stated method where funds mix. - [Tracing methods](https://anfossi.systems/glossary/tracing-methods/): Analytical rules used to allocate illicit and legitimate funds when they are commingled at an address or within a transaction. - [Address clustering](https://anfossi.systems/glossary/address-clustering/): Grouping addresses likely controlled by the same entity using heuristics; results are probabilistic. - [Cluster](https://anfossi.systems/glossary/cluster/): A set of addresses attributed to a single controller; a service cluster contains many customers’ deposit addresses. - [Attribution](https://anfossi.systems/glossary/attribution/): Determining who controls and who benefits from a cluster, combining on-chain analysis with off-chain sources. - [Taint](https://anfossi.systems/glossary/taint/): The amount or share of value at an address or in a transfer attributed to an illicit source under a given method. - [Source of funds](https://anfossi.systems/glossary/source-of-funds/): Backward tracing: identifying the origins of funds received by an address or cluster under investigation, tracing them through preceding transactions. - [Destination of funds](https://anfossi.systems/glossary/destination-of-funds/): Forward tracing from an investigative start point to the paths, addresses, clusters or services that received the funds. - [Service exposure](https://anfossi.systems/glossary/service-exposure/): Identifying and measuring interactions between addresses under investigation and services such as exchanges, mixers or payment processors. - [Demixing](https://anfossi.systems/glossary/demixing/): Linking mixer or CoinJoin deposits to later withdrawals using amounts, timing, address reuse, fees and behavioural patterns. - [Risk report](https://anfossi.systems/glossary/risk-report/): An assessment scoring an address or cluster by direct and indirect exposure to sanctions, darknet, scams, ransomware, mixers and behaviour.