1 Introduction
In the context of today's globalized digital economy, the circulation of data elements has become a central force driving economic growth, fostering technological innovation, and achieving social progress
[1]. Through the effective collection, analysis, and sharing of data, businesses and governments can gain insights into market dynamics, optimize decision-making processes, and improve service efficiency, thus gaining an edge in a highly competitive market environment. Data circulation not only promotes the global allocation of resources but also accelerates the spread of knowledge and the iteration of technology
[2], bringing profound impacts on socio-economic development.
However, with the widespread application of data circulation, new challenges and risks have emerged, especially in the realm of virtual currencies
[3, 4]. As an emerging tool for payment and investment, virtual currencies offer transaction flexibility and privacy protection due to their anonymity and decentralization. Yet, these features also facilitate illegal activities such as money laundering, fraud, and financing. Criminals exploiting these characteristics can easily transfer funds across borders, making it more difficult to trace fund flows and combat criminal activities
[4]. Moreover, criminals might obtain sensitive data, including personal identity and financial information, and then conduct anonymous transactions using virtual currencies, thereby laundering illicit gains
[5]. In this scenario, not only is the data security of individuals and businesses threatened, but the stability and trustworthiness of the entire financial system could also be compromised. Therefore, despite the positive role of data element circulation in driving economic and social development, the risks associated with virtual currency crimes cannot be ignored. This calls for joint efforts from regulators, technology developers, and market participants worldwide to formulate and implement stricter data protection policies, strengthen cross-border regulatory cooperation, and employ advanced technological means to identify and mitigate risks.
In recent years, there has been a frequent occurrence of money laundering cases involving virtual currencies, with criminals using virtual currency transactions to conduct laundering activities. For example, On September 21, 2021, the People's Bank of China published a notice on its website titled "Notice on Further Preventing and Disposing of the Risks of Speculation in Virtual Currency Transactions". It stated, "Activities related to virtual currency business are illegal financial activities" and "Services provided by overseas virtual currency exchanges to residents within China through the internet also constitute illegal financial activities." As a result, virtual currency transactions have become illegal activities within Chinese territory. Currently, in current judicial regulatory system, the situation of "illegal or unregulated transactions" involving virtual currencies is prevalent and growing. Disputes over jurisdiction often occur in criminal justice cases involving virtual currencies, hindering the judicial authorities' investigation and solving of these crimes. From a technological perspective, Hataley believes that it is difficult to monitor and detect money laundering crimes involving virtual currencies, confirm identities, collect evidence, and handle the recovery and disposal of stolen funds
[6]. Some scholars suggested to establish a virtual currency tracking and analysis system, combat the entire money laundering industry chain, strengthen the design of professional teams, and enhance the development of early warning and detection technologies
[7, 8]. Irwin and Dawson argued that to combat virtual currency crimes, it should shift from passive to active reconnaissance using big data technology
[9]. Leuprecht, et al. believed that preventing and controlling virtual currency crimes should clarify regulatory positions, improve regulatory facilities, effectively trace and track origins, and enhance early warning and monitoring capabilities
[10].
In addition, cases are not limited by geography, with a significant number of cross-regional crimes involving many participants and provinces
[11], which leads to the challenges in extracting electronic evidence. Electronic evidence consists of digital or virtual space signals made up of 0 and 1, with large volumes of evidence being decentralized, and public security organs lack effective means to extract it
[12, 13]. The volatility of electronic evidence affects its authenticity and integrity, but blockchain can provide better authenticity and integrity, addressing this issue
[14, 15]. Many criminals, funds, and evidence are located abroad, and the cross-border evidence collection process is cumbersome and time-consuming, failing to provide timely and effective evidence for the judicial authorities. Kamal, et al. believe that new evidence collection rules should be developed for new types of cybercrimes, pushing for updates to related norms and preventing criminals from exploiting legal loopholes
[15].
Blockchain evidence refers to the uploading of digital evidence to a blockchain evidence platform, using blockchain characteristics to prevent evidence tampering and destruction, thereby solidifying the evidence
[16]. The electronic data collected by the parties lacks a trustworthy foundation, thus requiring authentication and notarization, a cumbersome process that increases the workload. Blockchain technology can ensure the security and credibility of data on the chain using timestamps, electronic signatures, hash value verification, and other technologies. However, despite the promising application of blockchain technology in enhancing the security and integrity of digital evidence, particularly in the context of virtual currency crimes, a significant research gap persists in understanding the full scope and efficacy of blockchain-based digital forensics tools within the legal and judicial systems. This gap encompasses a lack of comprehensive insights into how the integration of blockchain technology can alter the dynamics of criminal behavior in the digital currency space, especially when analyzed through the lens of game theory. There is a critical need for research that not only constructs a blockchain-based digital forensics platform tailored for virtual currencies but also empirically evaluates its impact on the decision-making processes of potential criminals, using game theory to elucidate the evolutionary direction of criminal strategies in response to enhanced digital evidence mechanisms.
Therefore, this paper will build a blockchain-based digital forensics technology for virtual currencies and use game theory to explore the evolutionary direction of different entities' games and the factors influencing their decision-making, further proving that the decision-making of virtual currency crime criminals will be affected by this electronic evidence mechanism. This paper aims to use blockchain technology to solve current challenges in virtual currency crimes and assist judicial authorities in investigation and evidence collection. Specifically, this paper proposes an electronic evidence storage and retrieval platform based on blockchain technology and demonstrates from a game-theoretical perspective that this platform will deter criminals from committing crimes, offering new approaches for the government to combat virtual currency crimes.
2 Blockchain Technology-Based Mechanism for Digital Forensics in Virtual Currency Crimes
2.1 Automatic Evidence Storage Mechanism Based on Smart Contract Technology
The evidence storage platform based on blockchain technology, with its immutable and decentralized characteristics, provides strong assurances for the security and validity of data
[17, 18]. However, while the integration of smart contract technology automates and streamlines transaction logging and evidence collection, it is not without challenges. One of the key limitations is the initial correctness of the data entering the blockchain
[19, 20]. Smart contracts themselves cannot verify the accuracy of the information being inputted, which still relies on the integrity of external sources and human operators. If false or erroneous data is inputted, the immutability of blockchain ensures that these errors remain permanently recorded, potentially undermining the validity of the evidence. Another technical challenge is the inherent complexity of smart contracts. As contracts become more sophisticated to meet specific forensic and regulatory needs, they require higher levels of precision in coding, making them more susceptible to programming errors or vulnerabilities, which could be exploited. Additionally, smart contracts are difficult to modify once deployed, posing a problem when regulations evolve or new requirements emerge. Furthermore, scalability is a significant concern. As the volume of virtual currency transactions grows, the system must handle increasingly large amounts of data without sacrificing performance. The computational resources required to execute smart contracts on a large scale can lead to higher costs and slower processing times, potentially hindering the systems efficiency. Finally, integrating smart contracts with external systems, such as regulatory databases or financial institutions, requires interoperability solutions that are still under development, further complicating implementation.
Thus, this paper adopts smart contract technology as an effective solution, as shown in
Figure 1. Smart contracts are computer protocols that automatically execute the terms of a contract, ensuring that transactions are not only automatically completed but also immediately recorded on the blockchain, thus achieving the integration of data generation and data entry into the chain
[21]. The specific process is as follows:
Figure 1 Blockchain evidence storage mechanism flowchart |
Full size|PPT slide
1) Smart Contracts and Fund Flow Verification: The system initiates the process by using smart contracts to verify the transaction parties. If both the payer and payee are registered within the alliance chain system, the smart contract validates the transaction, ensuring that it occurs within the secure environment of the platform, thus maintaining transaction security and reliability. This verification confirms that only authorized participants can engage in transactions, establishing a trusted network.
2) Automated Transaction Logging: Once a transaction passes the initial verification, smart contracts are responsible for the automatic generation and recording of transaction data. This includes integrating the transaction into the blockchain, effectively creating an immutable and verifiable record. The platform thereby ensures the integrity and authenticity of transaction information.
3) Smart Contract Assessment for External Transactions: If a transaction involves an external payee not registered within the alliance chain, the smart contract performs an additional assessment to determine the appropriate action. This is essential for ensuring that even external transactions meet the platform's compliance standards.
4) Transaction Tagging for Data Analysis: For transactions within the platform's ecosystem, the smart contract adds encrypted tags to the transaction records. These tags are crucial for future queries and statistical analysis, allowing for enhanced data analysis and greater transparency of transaction activities.
5) Regulatory Approval for External Transactions: In cases where transactions involve external parties beyond the platform's regulatory framework, the smart contract defers to the supervision departments. Regulatory authorities then step in to evaluate, approve, and record the transaction according to set regulations, ensuring that it complies with legal standards.
Overall, the platform uses a combination of smart contract technology and regulatory oversight to significantly improve the security, transparency, and compliance of transactions. This sophisticated system of checks and balances aims to provide a secure environment for virtual currency transactions, establishing a new standard for legal and safe transactions, and reinforcing the digital economy's integrity.
2.2 Blockchain Technology-Based Digital Forensics Platform for Virtual Currency Crimes
Starting from the need for digital forensics in virtual currency crimes, this paper builds a virtual currency digital platform architecture based on the Hyperledger Fabric framework, leveraging blockchain technology. As shown in
Figure 2, the architecture includes the network layer, data layer, business layer, and application layer.
Figure 2 Architecture of virtual currency crime electronic forensic platform based on blockchain technology |
Full size|PPT slide
1) Network Layer: The network layer forms the foundation of the entire system, aiming to establish a secure and trustworthy communication infrastructure. It involves several measures to ensure network security and stability. First, for user identity authentication, public key infrastructure and digital certificates are used. Each user generates a pair of public and private keys upon registration, with the public key verifying user identity and the private key used for digital signing and encrypted communication. This prevents malicious user access and ensures only authorized users can access the platform. Additionally, secure communication protocols (like SSL/TLS) protect data transmission, mitigating risks of man-in-the-middle attacks and data theft. Regular security audits and monitoring, along with a security event response mechanism, are necessary for spotting and addressing anomalies and threats promptly, enhancing overall security.
2) Data Collection Layer: The main goal is to collect, acquire, and maintain data related to virtual currency crimes, including transaction records, wallet addresses, and exchange data. This involves using various data sources like blockchain explorers, exchange APIs, and web crawlers to obtain comprehensive and accurate data. Before data is recorded on the blockchain, smart contract technology ensures the accuracy of data storage. IoT devices, sensors, and monitoring systems also gather real-world data related to virtual currency crimes. Data is verified to ensure its integrity and authenticity through digital signatures, hash algorithms, and data integrity checks. Given the unique nature of virtual currency crimes, privacy protection and anonymity should be considered, adhering to privacy regulations and protecting user privacy while analyzing and associating different transaction data to reveal true identities.
3) Data Storage Layer: Responsible for securely and reliably storing collected data and providing efficient data retrieval and access. Distributed storage systems offer scalability and fault tolerance, encrypting sensitive data to ensure confidentiality and integrity during storage. Strict access control policies prevent unauthorized access and modification. Data backup and disaster recovery measures ensure data reliability and recoverability, with monitoring and alert systems for detecting storage layer anomalies and failures.
4) Business Layer: Develops specific algorithms and models for detecting potential criminal patterns and behaviors in virtual currency crimes, such as machine learning for anomaly detection and network analysis for revealing crime network structures. It also involves devising and implementing forensic strategies and standards to ensure the legality and reliability of the forensic process.
5) Application Layer: The user interface layer of the digital forensics platform, providing APIs for storing, querying, and verifying information to support virtual currency crime forensics. It allows users to set forensic targets and retrieve evidence, offering flexible query conditions and quick responses to improve forensic efficiency. The platform should present evidence clearly and support case management and collaboration, enabling teamwork among users and departments.
2.3 Process Analysis of Blockchain Technology-Based Digital Forensics for Virtual Currency Crimes
The blockchain technology-based platform for digital forensics in virtual currency crimes ensures that each step from data collection, evidence analysis, to result archiving is performed efficiently, securely, and accurately. This platform not only enhances the forensic process by leveraging blockchains immutability and transparency but also integrates advanced mechanisms for managing and analyzing complex virtual currency transactions. Below is a more comprehensive analysis of the forensic process within this platform:
1) Login and Permission Verification: The platform adopts a robust identity authentication mechanism through multi-factor authentication to ensure secure access. Users authenticate their identities by providing usernames, passwords, and often a secondary authentication factor (e.g., a one-time password or biometric scan). Based on the users role (e.g., investigator, analyst, or legal advisor), the platform dynamically assigns permissions, allowing for granular control over data access and operational capabilities. The platform logs all access and activity, ensuring full traceability and accountability, essential for maintaining the integrity of forensic evidence.
2) Setting Forensic Targets: Through the user interface, users specify detailed forensic targets that focus on elements such as blockchain addresses, transaction periods, types of cryptocurrencies involved, or particular transactions suspected of illicit activity. The platform supports the customization of filters to narrow down the scope of investigation, such as by setting minimum and maximum transaction amounts, counterparties, or geolocation metadata of counterpart transactions. This precise targeting enhances the efficiency of investigations by reducing noise and focusing on pertinent blockchain activities.
3) Data Collection and Storage: The platform connects to multiple blockchain networks to collect relevant block and transaction data. The data collection layer is designed to ensure compatibility with both public and private blockchain networks, making it versatile for different crime scenarios. The collected blockchain data is securely stored using encryption techniques in a distributed storage system that ensures data integrity. Additionally, the storage layer supports version control, ensuring that evidence is preserved in its original state and cannot be tampered with, aligning with legal standards for digital forensics.
4) Evidence Analysis: Once the raw blockchain data is gathered, it is processed and analyzed using advanced algorithms, such as clustering, address-linking, and fund-tracing techniques, to identify patterns, connections, and anomalies in the transactions. This involves analyzing transaction histories, detecting hidden or complex multi-hop fund transfers, and tracing connections between involved addresses. Machine learning models further enhance the ability to detect suspicious activity, such as unusually large transactions or patterns indicative of money laundering. By automating parts of the analysis, the platform accelerates the identification of key evidence while reducing the risk of human error.
5) Evidence Presentation: The platform provides a sophisticated, user-friendly interface to present the analyzed data in various formats. Evidence is presented through detailed transaction records, graphs illustrating fund flows, and network diagrams that highlight relationships between entities (addresses, wallets, or exchanges). Investigators can customize these visualizations, and interactive tools allow for real-time manipulation of the data to better understand the context and intricacies of each case. This visual representation simplifies the forensic process, especially in complex cases involving multiple transactions across various cryptocurrencies.
6) Case Management and Collaboration: The platform is equipped with comprehensive case management tools that allow investigators to organize, monitor, and track the progress of forensic investigations. Users can create individual cases, assign tasks to team members, and set deadlines. Collaboration is facilitated through integrated communication tools (e.g., instant messaging, shared workspaces, and file exchange functions) that ensure seamless teamwork between departments or external collaborators. The platform's collaborative capabilities extend to real-time document co-editing, audit trails of user actions, and permission-controlled sharing of case files. This centralized system enhances transparency, efficiency.
7) Review and Archiving of Forensic Results: Once the investigation is complete, the platform provides a structured review process where investigators can validate the findings. Forensic results, including all evidence and analysis steps, are systematically reviewed to ensure accuracy, completeness, and compliance with relevant legal and regulatory standards. After review, the forensic results are archived using blockchains immutable storage to maintain an untampered, verifiable record. This ensures that the evidence can be reliably retrieved for future cases or as legal proof in court, further enhancing the platforms reliability in judicial processes.
Overall, Section 2 has provided a detailed examination of the blockchain-based mechanisms employed to support digital forensics in virtual currency crime investigations. Through the application of blockchain's inherent characteristics, such as immutability and decentralization, the platform ensures the security, integrity, and efficiency of processes related to the collection, storage, and analysis of digital evidence. The discussion covered key operational aspects, including user authentication, setting of forensic targets, data collection, evidence analysis, case management, and the archiving of results. Each step is designed to address the challenges posed by the complex nature of virtual currency crimes, while maintaining stringent standards for evidence handling and analysis.
However, while the blockchain-based platform offers promising solutions for secure digital forensics, its impact on criminal behavior and the decision-making processes of entities involved in virtual currency transactions remains an open question. To further understand how this digital platform affects the strategic decisions of both intermediaries and government entities in the context of virtual currency crimes, we turn to game theory analysis. Thus, Section 3 will build on the foundational concepts discussed in Section 2 by introducing a game-theoretical perspective. We will construct models to analyze the decision-making dynamics between criminals, intermediaries, and regulators. Through this analysis, we aim to provide insights into how the introduction of blockchain-based digital forensics influences the behavior of these key players in the realm of virtual currency crimes.
3 Analysis of Digital Forensics for Cryptocurrency Crimes from a Game Theory Perspective Based on Blockchain Technology
The crux of the digital forensic mechanism for cryptocurrency crimes discussed above lies in data accessibility, with a key focus on the intermediaries in cryptocurrency transactions. Game theory is a common approach in analyzing the incentive mechanisms of blockchain, allowing observation and improvement on how various entities make decisions regarding cooperation and competition under both the improved and original models. This provides a foundation for designing analytical models and solving problems. This section will establish the game relationship between government departments and intermediaries in digital forensics for blockchain-based cryptocurrency crimes, and offer related suggestions.
3.1 Model Construction
This paper constructs a game model around the real-world scenario of digital forensics for cryptocurrency crimes, featuring main characters and interaction modes as shown in
Figure 3.
Figure 3 Model for electronic evidence collection of virtual currency crimes |
Full size|PPT slide
Traditional digital forensics for cryptocurrency crimes involve attempting to recover lost funds by preserving evidence and cooperating with foreign institutions after a crime has occurred. However, foreign intermediary agencies often refuse to cooperate, leading to difficulties in forensic progress. The evidence-gathering mechanism based on blockchain technology controls and adjusts illegal fund flows before they occur, shifting the governance of crimes from passive post-incident solutions to proactive pre-incident control, thus avoiding some difficulties of overseas evidence collection. Additionally, by detecting the fund flows to Scenario one: Without Introducing Blockchain Technologyoreign countries in advance using technology, it can pause or terminate abnormal fund flows for review. If anomalies are found, the evidentiary platform can be used to trace the fund flows and identify the upstream criminals; if criminals directly transfer to foreign institutions, the digital forensic mechanism can directly detect abnormal fund movements in time to organize, directly identifying the criminals.
3.2 Game Analysis
3.2.1 Scenario One: Without Introducing Blockchain Technology
In this traditional scenario, the participants include government departments and intermediaries facilitating virtual currency transactions. Intermediaries, motivated by financial rewards from criminals, decide whether to assist in illegal activities based on the likelihood of being caught and penalized. If the government investigates and discovers that an intermediary assisted a criminal, the intermediary is fined, and the government expends resources to recover the funds. However, there is a significant risk that funds transferred abroad may be unrecoverable. Therefore, intermediaries weigh the financial benefits of assisting criminals against the penalties imposed by the government, and government agencies, operating under resource constraints, decide whether to investigate based on the potential for successful prosecution and asset recovery. In this scenario, government departments face high costs and a low probability of recovering funds once they are transferred internationally. As a result, there is less incentive for the government to investigate all cases, particularly when the expected costs exceed potential gains. This creates an environment where intermediaries may be more inclined to assist criminals, especially if the perceived risk of detection is low.
The model assumes the following:
Assumption 1 Intermediaries assist criminals for financial gain and face penalties if caught. When criminals contact intermediaries for virtual currency transactions, intermediaries can choose to assist the criminals, thereby receiving a reward
from the criminals. If government departments investigate this transaction and find that the intermediary assisted the criminal, the intermediary would then be penalized
. The government department, after funds
are transferred abroad, has a probability
of being unable to recover the funds, spends human and material resources
in investigating the case, and obtains revenue
from fining the intermediary and criminals. In the game matrix, when the intermediary assists the criminal and the government department investigates the case, the government's revenue is
, and the intermediary's revenue is
. This assumption is grounded in established research on intermediary behavior in financial crime. According to studies on virtual currency, intermediaries involved in money laundering and illicit transactions often seek financial gain, but face penalties when detected
[22]. Penalties, typically in the form of fines or legal sanctions, act as a deterrent, though the expected financial rewards may still encourage illegal activities if the perceived risk of punishment is low.
Assumption 2 The government has limited resources and may not always investigate. If the intermediary chooses to assist the criminal and the government does not investigate the transaction, the intermediary receives the criminal's reward
, and the government loses funds
. Government agencies responsible for investigating financial crimes, including those involving virtual currencies, often operate under resource constraints. As found in studies, resource allocation in financial crime investigations is typically influenced by the severity of the crime and the likelihood of asset recovery
[23]. This prioritization ensures that only high-stakes cases with potential for significant asset recovery or financial stability impact receive attention.
Assumption 3 The intermediary earns a regular income if they choose not to assist criminals. If the intermediary chooses not to assist the criminal, the intermediary earns a regular income
, and the government department incurs investigation costs
. This assumption aligns with basic economic theory, including opportunity costs, as discussed in related literature. Studies indicate that intermediaries involved in legal virtual currency transactions maintain stable income streams, avoiding the legal risks associated with criminal activities
[24].
Assumption 4 Government agencies only benefit from investigating if successful in prosecuting criminals. When the intermediary chooses not to assist the criminal and the government does not investigate, the government earns no revenue, and the intermediary earns a regular income
. Studies show that government benefits from investigating are realized primarily through successful prosecution and asset recovery. Research on cross-border crimes and jurisdictional challenges emphasizes that governments are less likely to pursue investigations when the chances of successful prosecution are low
[25].
Assumption 5 Mixed-strategy games occur when neither party has full information. The probability of the government choosing to investigate is
, and the probability of the intermediary choosing to assist the criminal is
. In virtual currency-related crimes, governments and intermediaries are engaged in a mixed-strategy game due to incomplete information. Research supports the relevance of game theory in financial crimes, where uncertainty regarding actions influences decision-making
[26]. The strategic decisions of both parties are shaped by their incomplete knowledge of the other's intentions, reflecting real-world complexities in financial crime investigations.
Table 1 Scenario 1 game matrix |
| | Assisting criminals | Not assisting criminals |
| Investing | | |
| Not investing | | |
Under normal circumstances, the penalty that intermediaries face for being caught assisting criminals typically exceeds the reward they receive, resulting in . According to game theory, intermediaries would choose not to assist criminals when government departments are investigating, and choose to assist criminals when government departments are not investigating. However, when intermediaries assist criminals, if foreign institutions are unwilling to cooperate, it may lead to a success rate of recovering funds that is too low, making less than , thereby reducing the government department's enthusiasm for investigating criminal cases.
Assuming that the entities engage in a mixed-strategy game under bounded rationality. The government investigating is strategy
, the government not investigating is strategy
, intermediaries assisting criminals is strategy
, and intermediaries not assisting criminals is strategy
$ s_{22} $. According to the described model, the expected revenue for the government choosing to investigate the case is:
The expected revenue for the government choosing not to investigate a case is as follows:
The average expected revenue for the government is:
The replication dynamic equation for the government having a strong will to investigate cases is , and for ease of further discussion and analysis, let's simplify the expression by setting as a function of the strategy ratio in the population, and at ,
Similarly, the expected revenue for intermediaries willing to assist criminals is:
The expected revenue for intermediaries not willing to assist criminals is:
The average expected utility for intermediaries is:
The replication dynamic equation for intermediaries willing to assist criminals is , also a function of the decision ratio in the population, and at :
From the above equations (4) and (8), a two-dimensional non-linear dynamic system model composed of the government and intermediaries can be derived:
In this formula, when and is the equilibrium point or singularity. Therefore, this system has five equilibrium points or singularities: , , where . In the phase diagram of this paper, the saddle point is .
To discuss the stability of the model, it's first necessary to determine the range of model parameters, where the strategy ratios and belong to their domain , then , , from which we can derive:
For the government, when , meaning all are in a stable state. When , if we let , we get two stable strategies , with the following conditions for a stable state:
1) When is evolutionarily stable, meaning the government tends toward the strategy of "investigating the case";
2) When is evolutionarily stable, meaning the government tends toward the strategy of "not investigating the case";
For intermediaries, when , meaning all y are in a stable state. When , if we let , we get two stable strategies ;
1) When is evolutionarily stable, meaning intermediaries tend toward the strategy of "assisting criminals";
2) When is evolutionarily stable, meaning intermediaries tend toward the strategy of "not assisting criminals".
The replication dynamic equations describe the population state of the fireworks system, and from Friedman's theory, the local stability of the Jacobian matrix of the population state system can determine the stability of the game system's equilibrium points. If the determinant of the equilibrium point's corresponding Jacobian matrix is greater than 0, and the trace , then this point is a stable ESS; if equals 0, it's a saddle point. From Equation (9), the game model's Jacobian matrix can be known as:
From the
matrix, its determinant and trace tr
can be obtained as in Equation (12), and the stability analysis of each equilibrium point is shown in
Table 2.
Table 2 Stability status of each equilibrium point |
| Equilibrium Point | | | | $ a_{22} $ | | | State |
| | 0 | 0 | | - | 1 | Unstable |
| | 0 | 0 | | - | 1 | Unstable |
| | 0 | 0 | | - | 1 | Unstable |
| | 0 | 0 | | - | - | Unstable |
| 0 | - | - | 0 | - | 0 | saddle point |
To drive the game towards
, it's necessary to increase the probability of both types of entities starting in the state
falling within the
region as much as possible. As shown in the diagram, the larger
is, the larger the area of the triangle
, thereby increasing the probability of
falling within the
area (
Figure 4). Therefore, during the game process, efforts should be made to increase
as much as possible to evolve the game in the direction of
. For example, increasing the penalties
for intermediaries, reducing the costs
of investigating cases, and decreasing the probability
that embezzled funds cannot be recovered.
Figure 4 Phase diagram of equilibrium points in the model |
Full size|PPT slide
3.2.2 Scenario Two: Introducing Blockchain Technology
With the introduction of blockchain technology, the game dynamics change significantly. In this scenario, smart contracts are implemented to automatically record transactions on the blockchain, reducing the probability that illegal fund transfers can occur unnoticed. Blockchain's transparency allows government agencies to monitor transactions in real time, significantly reducing the likelihood of funds being transferred abroad without detection. The government's revenue from investigating such cases improves, as smart contracts can lower the costs of investigation and enhance the probability of identifying suspicious activity. Compared to the traditional model, the blockchain-enabled system increases the government's chances of successful prosecution and asset recovery, while decreasing the intermediaries' incentive to assist criminals, as detailed in the following model (
Table 3).
Table 3 Game matrix after introducing the evidence mechanism |
| Strategy | Helping criminals | Not helping criminals |
| Investigating | | |
| Not investigating | | |
1) When criminals contact intermediaries for virtual currency transactions, intermediaries can choose to assist the criminals, thereby receiving a reward from the criminals. If government departments investigate this transaction and discover the fact that the intermediary assisted the criminal, the intermediary will then be penalized . Compared to traditional game scenarios, funds are not transferred abroad and can be effectively controlled. Government departments only need to spend human and material resources in investigating the case, and obtain revenue from fining the intermediary and criminals. In the game matrix, when the intermediary assists the criminal and the government department investigates the case, the government's revenue is , and the intermediary's revenue is .
2) If the intermediary chooses to assist the criminal and the government does not investigate the transaction, then the intermediary receives the criminal's reward , and the government loses funds .
3) If the intermediary chooses not to assist the criminal, the intermediary earns a standard revenue , and the government department incurs the cost of investigating.
4) When the intermediary chooses not to assist the criminal and the government does not investigate, the government earns no revenue, and the intermediary earns a standard revenue .
Typically, the penalty that an intermediary faces for being caught assisting a criminal is greater than the reward A they receive, resulting in . According to game theory, intermediaries will choose not to assist criminals when government departments are investigating, and opt to assist criminals when government departments are not investigating. Due to the evidence mechanism based on blockchain technology significantly increasing the government's revenue from investigations and because smart contracts, along with certain modern computing technologies, can greatly reduce the cost of government investigations, data science enhances the probability of government departments investigating cases when intermediaries assist criminals. Assuming the government's probability of investigating a transaction when an intermediary assists a criminal is , the expected revenue for the intermediary is . Smart contracts will increase , making much less than the expected revenue when the intermediary does not assist the criminal, thus encouraging intermediaries to choose not to assist criminals during the game, reducing criminal avenues, and thereby purifying the domestic environment.
After introducing the blockchain digital forensic mechanism, it's as if from Section 3.2.1 is reduced to 0, and utilizing the blockchain digital forensic mechanism can also reduce the cost of each investigation, thus increasing the area of , making intermediaries more inclined not to assist criminals.
In Scenario One, the decision-making of intermediaries is driven by the potential reward from assisting criminals and the perceived risk of being caught. Government resources are often overstretched, and the likelihood of successfully recovering funds is low. This creates a high-risk, high-reward environment for intermediaries, incentivizing them to assist criminals when the government is unlikely to investigate. In contrast, Scenario Two fundamentally alters the risk-reward calculus through the implementation of blockchain technology. The increased transparency, reduced costs of investigation, and higher probability of government detection discourage intermediaries from engaging in illegal activities. Blockchain technology shifts the game dynamic in favor of government agencies, making it more likely that intermediaries will choose not to assist criminals, thus reducing the feasibility of financial crimes involving virtual currency.
4 Research Conclusions and Recommendations
This paper has designed a blockchain technology-based mechanism for cryptocurrency electronic evidence collection, aimed at addressing the difficulties in evidence collection and low probability of fund recovery in cryptocurrency crimes. Through detailed elucidation of the mechanism's core steps and underlying technology, and by employing game theory analysis, it has been confirmed that the decision-making of cryptocurrency criminals is influenced by this electronic evidence mechanism. The results indicate that the blockchain technology-based mechanism for cryptocurrency electronic evidence collection plays a positive role in preventing illegal intermediaries from assisting cryptocurrency criminals in laundering activities. However, in real-world scenarios, while blockchain technology offers significant advantages in digital forensics for virtual currency crimes, its implementation faces challenges across different legal and regulatory environments. A primary concern is the inconsistent legal recognition of blockchain-based evidence, with some jurisdictions accepting it as admissible in court, while others have not yet established the necessary legal frameworks. Additionally, the regulatory treatment of virtual currencies varies widely, with some countries, like Japan and Switzerland, supporting blockchain integration, while others, such as China and India, impose restrictions or bans, complicating cross-border investigations. Data privacy regulations, particularly in regions governed by laws like the General Data Protection Regulation, pose further challenges as blockchain's immutability can conflict with the requirement to modify or delete personal data. Cooperation between jurisdictions is also hindered by divergent enforcement practices, creating obstacles for international collaboration in forensic investigations. Finally, as blockchain technology evolves, many legal systems struggle to keep pace, delaying the adoption of blockchain-based forensic tools until clearer international standards are developed, which may further impede progress in leveraging blockchain for digital forensics. Therefore, although this mechanism provides a powerful tool for the prevention and control of cryptocurrency crimes, a comprehensive consideration of these potential challenges and issues is necessary during its full implementation to ensure its effectiveness in various environments. The following policy measures are recommended.
First, the government should consider the implementation of a public prosecutor's law evidence platform, leveraging blockchain technology for evidence collection. This initiative requires legal endorsement, alongside governmental attention and investment, to transition from design to real-life application
[27]. A thorough requirement analysis and system design are pivotal before moving into the implementation phase. To ensure the platform's long-term effectiveness, it is crucial to establish specialized departments responsible for its development, operational maintenance, and periodic updates, backed by continued financial support. The recruitment of skilled project managers and technical personnel with expertise in blockchain technology is vital for the successful design, development, and upkeep of this platform. Drawing insights from the experiences and designs of existing blockchain-based evidence platforms, both domestically and internationally, could provide valuable guidance for mitigating potential challenges during the implementation process. Moreover, regular maintenance and upgrades of the platform are indispensable
[28], requiring active and ongoing involvement from relevant governmental departments to evaluate, enhance, and ensure the system's alignment with new technological developments and evolving economic conditions in China. The platform's design must also accommodate the storage of vast amounts of transaction data, necessitating a careful balance between economic viability and technical efficiency in the choice of storage solutions. The incorporation of a robust smart contract component with scalability and modifiability will enable real-time detection of suspicious fund flows indicative of illicit activities. Consequently, exploring the integration of big data analytics to enhance the identification and monitoring of abnormal transactions is strongly recommended, further underscoring the importance of continuous technological innovation in advancing legal and governmental objectives.
Second, a nationwide initiative for the integration of electronic data and blockchain across various fields should be established. This approach would entail the expansion of regulatory frameworks to encompass a broader range of financial transaction platforms. By extending regulatory oversight, it becomes feasible to efficiently record transaction histories, identify suspicious activities, and enhance the security and integrity of financial operations. Integrating blockchain technology with electronic data platforms will play a crucial role in capturing and monitoring criminals' payment methods, thus significantly hindering their ability to move funds outside the legal financial system
[29]. This would elevate the overall difficulty associated with committing financial crimes. To effectively harness the full potential of the blockchain-based evidence collection platform, it is essential to enact specific policies that bring a wider array of financial transaction platforms under the purview of the platform's regulatory scope. This is particularly critical in preventing criminals from exploiting loopholes to transfer funds undetected. The practical success of such a system is closely linked to its integration into the everyday financial transactions of citizens. For example, integrating blockchain digital forensics into widely-used payment systems such as WeChat, Alipay, and major domestic banks would provide seamless oversight and real-time monitoring. This could be achieved by implementing smart contracts that govern common transactions, including peer-to-peer transfers and "red packet" exchanges among users. Ensuring that these transactions are securely monitored within the regulatory framework would allow for automated recording and detection of irregularities. In instances where funds are transferred to external banks beyond China's regulatory jurisdiction, smart contracts could flag these transactions for further scrutiny, ensuring even the most complex financial operations are reviewed and assessed. Expanding the platform's regulatory coverage would reduce the need for manual transaction reviews, enhancing overall system efficiency and minimizing opportunities for exploitation by criminals. Conversely, if the regulatory scope is too limited, criminals could exploit these gaps, ultimately undermining the efficacy of the platform. This initiative underscores the necessity for comprehensive and adaptive regulatory oversight to protect the financial system from emerging threats.
Third, the government should refine and enhance laws and regulations targeting cryptocurrency-related crimes, with a particular focus on illegal intermediaries. A critical deterrent to illegal intermediaries profiting from assisting in financial crimes is the imposition of more severe penalties
[30, 31]. When the intermediary's revenue
is not less than the intermediary's standard revenue
, even if the government department investigates the transaction, the intermediary department will not suffer losses. Therefore, when the government's punishment
for illegal intermediaries is too close to the reward
received by illegal intermediaries, intermediaries may not necessarily choose not to assist criminals in committing crimes in the game. If financial criminals provide other benefits to illegal intermediaries that other judicial organs miss during the investigation, since the judicial investigation finds
to be less than the actual profit
received by criminals, if the judicial authority bases its punishment on the principle of
slightly higher than
, it can only ensure
, not
, then the actual revenue of illegal intermediaries
may be greater than the intermediary's standard revenue
. To maintain government enthusiasm for pursuing such cases, some restrictions should be placed on how fines exceeding a certain ratio of investigation costs are allocated, with a portion of these funds potentially directed toward public welfare projects. This would not only ensure that the penalties are dissuasive but also align government efforts with societal benefits. Consequently, penalties for illegal intermediaries must be determined by carefully considering the potential rewards, the costs of government investigations, and the broader legal and financial implications. This would motivate intermediaries to refrain from engaging in criminal activities and encourage government authorities to actively investigate suspicious cases.
This study provides a theoretical analysis of blockchain technology in digital forensics for virtual currency crimes, but it has several limitations. First, the analysis lacks empirical validation, as the proposed blockchain-based forensic platform has not been tested through real-world case studies or pilot implementations. This limits the practical applicability of the findings. Additionally, the study primarily addresses technical aspects, leaving gaps in the discussion of cross-jurisdictional legal challenges, particularly regarding the admissibility of blockchain-based evidence across different legal systems. Scalability and data privacy are also underexplored, especially as the volume of blockchain transactions grows, raising concerns about maintaining system efficiency and security. Moreover, the potential impact of emerging technologies like quantum computing on blockchain security is not fully addressed, highlighting the need for research into quantum-resistant cryptography. Lastly, the integration of artificial intelligence and machine learning with blockchain forensics is identified as a promising area but lacks detailed examination. Future research should focus on empirical studies, legal frameworks for cross-border investigations, and the development of scalable, privacy-preserving, and quantum-resistant blockchain solutions.
{{custom_sec.title}}
{{custom_sec.title}}
{{custom_sec.content}}
PDF(281 KB)
Figure 1 Blockchain evidence storage mechanism flowchart
Table 1 Scenario 1 game matrix
