From Patterns to Profiles

Abstract

Cryptocurrencies play an increasingly prominent role in legal financial activities, while simultaneously creating new opportunities for illicit use. Their speed, ease of crossing borders, and pseudo-anonymous nature strongly contribute to their potential for laundering illegal funds. Cryptocurrency exchanges are considered critical financial services that convert cryptocurrencies to fiat money and vice versa, thereby fulfilling a central role within the crypto ecosystem. As a result, increased attention is directed towards such digital infrastructures that may facilitate and scale illicit financial activity. Gaining insights into the users operating on such platforms, as well as the behaviors they perform, may support law enforcement in understanding how these infrastructures are utilized and which behavioral patterns emerge. Moreover, the data obtained from these vital platforms enhances the potential of data-driven approaches that identify broader behavioral structures and aid differentiating between user groups, which can in turn support the prioritization of investigations.
Understanding user profiles and their behavioral patterns within the internal structures of cryptocurrency exchanges has received limited attention in earlier research, yet understanding (criminal) modus operandi is considered essential for effective intervention. Previous studies mostly rely on identifying suspicious activity through machine learning models, using publicly available blockchain data, often without including the context and perspectives of investigative practice. By examining a unique dataset from the cryptocurrency exchange Cryptex acquired through law enforcement operations in 2024, this study aims to fill this knowledge gap.

The central research question guiding this thesis is: To what extent can latent behavioral profiles be identified within the internal records of a seized cryptocurrency exchange, and what insights do these profiles provide for law enforcement investigations?

By applying a mixed-methods approach, this research conducted a Latent Profile Analysis (LPA) to identify distinct behavioral user profiles based on transactional activity indicators related to deposit and withdrawal operations on a seized cryptocurrency exchange.
First, a conceptual lens was developed based on behavioral indicators related to structuring transactions, informed by policy literature on suspicious transactional activity within cryptocurrency ecosystems. Several methodological selection criteria were established to assess the suitability of the empirical dataset for LPA specifically, after which a study population was defined, consisting only of a subset of users who performed both deposits and withdrawals within a limited timeframe.
Next, the obtained profiles were further enriched by analyzing their differences in variables associated with elevated money laundering risk, including withdrawal address-sharing patterns, illicit exposure of incoming transactions, together with adherence to Know-Your-Customer (KYC) regulations and the use of privacy coins, both of which are associated with increased attribution mitigation.
Finally, an exploratory focus group with law enforcement professionals was conducted to assess the relevance, interpretability, and potential investigative value of the obtained behavioral profiles and the methodological approach applied in this thesis.

In answering the main research question this study demonstrates that distinct latent profiles can be identified within cryptocurrency exchange data, reflecting distinguishable behavioral patterns and broader behavioral strategies within the exchange ecosystem. These profiles primarily differ in their activity intensity, variability in transaction sizes and the extent to which multiple cryptocurrencies were exchanged. High-activity profiles on Cryptex are associated with increased interaction on the blockchain, greater overlap with external wallet addresses, and higher exposure to illicit activity, suggesting more complex or potentially coordinated behavioral patterns. In contrast, lower-activity profiles exhibit limited on-chain interaction and appear more aligned with KYC-procedures, indicating towards potential alternative transaction strategies that are less visible within publicly available blockchain data.
These findings show that user behavior within cryptocurrency exchanges is not homogeneous, but can be meaningfully structured into distinct groups that capture relevant behavioral differences from a money laundering perspective. Rather than directly identifying illicit activity, the findings suggest that behavior related to money laundering risk may emerge through broader behavioral configurations which are built upon combinations of transactional and platform-related indicators. While the profiles do not directly identify illicit activity, according to law enforcement professionals they appear to provide a useful abstraction for reducing complexity in large transactional datasets and can support exploratory analysis, prioritization, and hypothesis generation within law enforcement investigations. However, the method is considered unable to capture important nuance or answer cascading questions which are essential in law enforcement investigations, highlighting the remaining importance of human intelligence.

In doing so, this research provides three key contributions. First, it demonstrates the applicability of LPA as a method to uncover latent behavioral structures in cryptocurrency exchange transactional data, by means of a unique empirical dataset. This is considered to provide a more transparent approach to understanding user behavior and clustering. Second, this study demonstrates that cryptocurrency exchange users exhibit distinct behavioral configurations that become visible when transactional, blockchain-related, and risk-related indicators are analyzed in combination instead of isolation. The findings suggest that potentially elevated money laundering risk is therefore not uniformly distributed. Moreover, such risk does not emerge from a single behavioral dimension alone, but rather through broader combinations of interacting indicators across multiple behavioral dimensions. Therefore, the results suggest that blockchain-based indicators alone may not sufficiently capture the full diversity of transactional strategies, which potentially leaves certain modus operandi underrepresented or overlooked. This highlights the added value of combining internal exchange data with blockchain-related indicators for a more context-sensitive understanding.
From an investigative perspective, the findings demonstrate how behavioral profiling approaches may support exploratory analysis, data structuring, prioritization, and hypothesis generation within intelligence-driven cryptocurrency investigations. At the same time, the study emphasizes that the interpretation of such profiles remains highly dependent on contextual understanding, human expertise and nuance by investigators.