Summary

• Criminals are increasingly turning to novel digital asset classes, like Bitcoin Ordinals and BRC-20 tokens, to generate and conceal wealth from tax authorities.
• Investigators in Italy uncovered a multi-year scheme where a suspect accrued over €1 million in undeclared capital gains using Ordinals, while unlawfully receiving public subsidies.
• Using Chainalysis Reactor, law enforcement traced funds from a seized hardware wallet, mapping complex transaction cycles and linking them to centralized exchanges.
• No matter how new or technically complex an asset class may be, the fundamental transparency of the blockchain — paired with advanced blockchain intelligence — ensures that illicit financial flows can always be traced.

Tax evasion and unreported income are age-old financial crimes, but the methods used to commit them are rapidly evolving. As digital assets become more mainstream, bad actors frequently attempt to exploit novel technologies — such as NFTs, decentralized finance (DeFi) protocols, or emerging token standards — in hopes of keeping their wealth hidden from tax authorities and law enforcement.

But there is a fatal flaw in this strategy: the inherent transparency of the blockchain. No matter how sophisticated a scheme appears, the underlying technology leaves a permanent, immutable trail. With the right blockchain intelligence tools, investigators worldwide can decode even the most complex on-chain maneuvers.

A recent landmark case out of Italy perfectly illustrates this reality, demonstrating how law enforcement agencies can leverage Chainalysis solutions to transform seized hardware and scattered transactions into a clear, actionable financial map.

A seemingly ordinary case turns complex

When investigators from Italy’s Guardia di Finanza — specifically the Economic and Financial Police Unit of Foggia and the Special Unit for Privacy Protection and Technological Fraud of Rome — began looking into a suspect for unreported income, they expected a routine case.

Instead, they uncovered a highly sophisticated, multi-year scheme. The suspect was quietly accumulating immense wealth using the Ordinals protocol and the BRC-20 token standard, all while unlawfully receiving public subsidies. Ultimately, the operation involved over €1 million in undeclared capital gains.

The technical depth of the suspect’s methodology was complex, but investigators were equipped with Chainalysis Reactor. Serving as their central investigative tool, Reactor allowed law enforcement to reconstruct the intricate on-chain flows and dismantle the operation piece by piece.

Mapping the network from a single hardware wallet

The technical analysis began with a single piece of physical evidence: a Ledger hardware wallet seized during a home search.

Hardware wallets are self-custody tools designed with privacy and security in mind. They don’t hold funds directly; rather, they store the private keys that control funds on the blockchain. By design, Ledger devices automatically generate a new receiving address for every incoming transaction, utilizing Bitcoin’s Unspent Transaction Output (UTXO) architecture to maximize user privacy.

To the naked eye, this multiplicity of addresses looks like a fragmented, untraceable web. But from a forensic perspective, this fragmentation is easily resolved. Using common-input-ownership heuristics, investigators were able to probabilistically link these seemingly disparate addresses to a single controlling entity, which was the financial engine of the entire tax evasion scheme.

Decoding the inscription and monetization cycle

To understand how the suspect generated such massive undeclared wealth, investigators had to decode the mechanics of Bitcoin Ordinals.

Introduced in 2023, the Ordinals protocol assigns a unique serial number to each satoshi (the smallest unit of bitcoin) and allows arbitrary data like images, text, or code to be permanently embedded in the witness field of a bitcoin transaction. BRC-20 tokens extend this mechanism further, using textual inscriptions to deploy, mint, and transfer fungible tokens on the Bitcoin blockchain without the need for smart contracts.

Using Reactor, investigators visualized a precise, iterative cycle executed by the suspect:

1. Funding: Satoshis were transferred from the suspect’s primary wallet cluster to an external inscription service to generate the digital assets.
2. Listing: The newly inscribed assets were listed on dedicated marketplaces.
3. Profit: The assets were sold for multiples of their original cost, and the profits were routed back to the suspect’s primary wallet in Bitcoin.

The suspect continually reinvested these earnings into new inscriptions. What a superficial analysis might have misinterpreted as random send-and-receive operations, Reactor clearly identified as a lucrative inscription-monetization cycle that netted the suspect over €1 million.

Why no blockchain-based asset class is beyond forensic reach

While blockchain intelligence can reconstruct a financial network with remarkable precision, wallet addresses remain inherently pseudonymous. To bring the suspect to justice, investigators needed to connect the on-chain map to a real-world identity — a connection they found at the exchange layer. Because individuals must eventually interact with centralized platforms to manage and off-ramp their crypto gains, regulated exchanges serve as the ultimate identity bridge. By complying with judicial disclosure orders and providing Know Your Customer (KYC) documentation, exchanges allowed investigators to cross-reference off-chain data with on-chain patterns, definitively unmasking the suspect.

This landmark Italian case serves as a powerful reminder for law enforcement and compliance professionals globally: the technical novelty of crypto does not equal anonymity. As new digital asset classes continue to emerge and generate income streams, the gap between actual on-chain wealth and declared tax positions will become a primary target for global investigative attention. In today’s financial landscape, blockchain intelligence is essential infrastructure.

FAQs

What are Bitcoin Ordinals and BRC-20 tokens?

The Ordinals protocol allows users to attach arbitrary data (like images or text) to individual satoshis, creating unique digital assets directly on the Bitcoin blockchain. BRC-20 is an experimental token standard built on top of the Ordinals protocol, which enables the creation and transfer of fungible tokens on the Bitcoin network without using traditional smart contracts.

How does Chainalysis trace transactions from hardware wallets?

While hardware wallets generate new addresses for every transaction to protect user privacy, Chainalysis Reactor uses advanced analytics and common-input-ownership heuristics to connect these addresses. By analyzing transaction inputs on the blockchain, Reactor can probabilistically group associated addresses into a single cluster, revealing the complete transaction history of an entity.

Can criminals use new crypto assets to hide wealth from tax authorities?

While criminals often flock to the newest technologies assuming they are untraceable, this is a misconception. Because all transactions occur on a public ledger, blockchain intelligence tools can parse and map the flows of novel assets, proving that new asset classes are not immune to financial forensics.

Why is exchange cooperation important in blockchain investigations?

Blockchain addresses are pseudonymous. While on-chain analysis can trace the flow of funds with pinpoint accuracy, investigators rely on the KYC (Know Your Customer) data collected by centralized, regulated exchanges to link a specific wallet cluster to a real-world identity. Cooperation between these exchanges and law enforcement is vital for prosecuting financial crimes.

This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein. 

This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.

Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.