Search a set of bank statements for the word “bitcoin” and you will usually find nothing. That is not because the money never went there. It is because the bank record describes how the money left, not where it ended up.
Cryptocurrency lives outside the banking system, but almost everyone gets into it through a bank account. Money moves from an account to an exchange, a payment processor, a card purchase or a cash machine — and from there onto a blockchain. The bank statement records the first step and nothing after it.
That first step is the one that matters most to an investigator working from bank records, because it is the hand-off point. Everything downstream belongs to blockchain analysis. Everything upstream is in the statements, if you can recognize it.
01Where crypto actually appears
In bank and card records, money heading into crypto tends to leave by one of a handful of routes:
A transfer to an exchange, often under a corporate or banking-partner name rather than the brand the account holder would recognize.
A payment through a processor or money transmitter whose name means nothing to anyone reading the statement.
A card purchase at what looks like an unfamiliar online merchant.
A cash withdrawal, followed the same day by a deposit into a crypto kiosk — which the bank never sees at all.
None of these descriptors says “crypto.” Several of them would not mean anything to the person who made the payment, let alone to someone reviewing the account years later.
02Why it gets missed
Crypto exits are easy to overlook for the same reason disguised vendors are: they look like ordinary descriptor noise. A transaction register is full of unfamiliar names — payment platforms, processor prefixes, truncated merchant strings — and an examiner reviewing thousands of lines learns, reasonably, to skim past them.
The amounts don’t help either. Crypto activity in a personal account is often a series of modest transfers rather than one large one, and modest transfers to an unknown name rarely rise to the top of any report. Each one looks like a bill.
03The elder-exploitation pattern
In cases involving older account holders, the pattern is often painfully clear once you know to look for it. A counterparty the account holder has never paid before appears suddenly. The payments repeat. They grow. And they often begin shortly after a phone call, a new online acquaintance, or a “new investment opportunity.”
Sometimes the exit is not a transfer at all. Large cash withdrawals, out of character for the account, can be the only trace in the bank records of money fed into a crypto kiosk. The statement shows the withdrawal. What happened next is somewhere else entirely.
By the time anyone reviews the account, the individual payments look small and unremarkable. It is the sequence that tells the story — and the sequence only becomes visible once the counterparties are recognized for what they are.
04Finding the exit is the bank analyst’s job
There is a natural division of labour here. Blockchain tracing tools follow funds across wallets and exchanges once the money is on-chain. What they cannot do is tell you which of a few thousand bank transactions sent it there in the first place.
That identification has to happen in the bank records, and it has to happen early. An investigator who knows on day one that an account sent money to three crypto counterparties can request exchange records, preserve evidence and bring in tracing support while the trail is still fresh. One who discovers it the week before a deposition cannot.
05How eFraud Investigator handles it
Every counterparty in a case is checked against a maintained list of known crypto counterparties. Matches are flagged for review on the Counterparty Flow diagrams and in the transfer grid, listed together on their own review page, and included as a separate sheet in the case’s Excel download.
A flag is a prompt to look, not a conclusion. A match says that a counterparty is known to be associated with crypto; it does not say what the money was for, or whether anything was wrong. That determination stays with the investigator, as every determination in the platform does.
Crypto counterparties change constantly, so no list is ever complete. When an investigator spots one the list has missed, a link in the platform sends it to us, and once confirmed it is added to the list for every user. Crypto flags are included in every case, at no extra charge.
06Practical handling
- Don’t search for the word “crypto.” Look at the counterparty list instead, and treat unfamiliar processors and platforms as questions rather than noise.
- Look at sequences, not single transactions. A new counterparty with repeated, growing payments matters more than any one payment to it.
- Read cash withdrawals in context. Large, out-of-character withdrawals may be the only trace of a kiosk deposit.
- Identify crypto exits early, so exchange records can be requested and tracing support brought in while the trail is fresh.
07The short version
Money almost always enters crypto through a bank account, so the evidence of where it left is usually in the bank records — just not under any name that says crypto. Recognizing those exits is the step that makes everything after it possible, and it is a step that belongs at the start of an investigation, not the end.
