Home
>
Blog
>
blog post
May 12, 2026

Blockchain Forensics Data Infrastructure: How 4soft Builds the Investigative Layer Behind Elliptic

When law enforcement agencies, compliance teams, and financial intelligence units trace illicit crypto flows, they need complete, verified on-chain records — not estimates, not sampled feeds. 4soft builds the blockchain forensics data infrastructure that powers Elliptic’s investigative capabilities, delivering the raw material that makes wallet tracing, address clustering, and entity resolution possible.

The Data Problem in Blockchain Forensics

Blockchain forensics is the discipline of tracing on-chain transactions to identify real-world entities behind wallet addresses. The goal: uncover money laundering routes, sanctions violations, ransomware payments, fraud. Elliptic leads this space. But their investigative power depends entirely on what sits underneath — complete, accurate blockchain data that doesn’t drop records.

Most off-the-shelf data providers miss things. Internal transactions generated by smart contract calls. Failed transactions. Bridge hops between chains. Those gaps matter. A single missing hop in a transaction trail can let an illicit flow disappear from an investigation entirely.

4soft closes those gaps.

What We Build for Elliptic

Transaction Data for Wallet Tracing and Forensic Analysis

The capture has to be complete. For bitcoin wallet forensics and cross-chain crypto forensics analysis, “almost everything” isn’t good enough. 4soft indexes:

Native asset transfers across Bitcoin, Ethereum, and across 56 blockchain networks additional chains

Token transfers: ERC-20, ERC-721, and equivalent standards on non-EVM chains

Internal transactions from smart contract calls — essential for tracing DeFi flows where value doesn’t move in simple transfers

DEX swap sequences used to fragment transaction trails are captured in full. Cross-chain bridge movements are attributed hop-by-hop. Even failed transactions and reverted calls are recorded — behavioral context that analysts use to reconstruct intent.

Missing any of these isn’t a minor data quality issue. It’s an investigation failure.

Structured Blockchain Data Extraction

Raw block bytes don’t answer investigative questions. 4soft builds custom extraction pipelines that transform on-chain activity into structured records: address-level transaction histories, USD-denominated value flows for financial crime quantification, temporal transaction graphs for timeline reconstruction, and cross-chain asset traces with bridge attribution.

The output is queryable. It’s built around how investigators actually work, not around what’s easiest to index.

Entity and Smart Contract Enrichment

Forensics platforms differentiate on entity intelligence — the ability to label an address as an exchange, a mixer, a darknet market, or a sanctioned entity. That labeling is only as good as the underlying contract and protocol data.

4soft maintains active smart contract registries categorized by type and risk profile. Token metadata catalogs handle accurate asset identification across chains. Cross-chain bridge activity logs close the loop on assets that move between networks. Protocol change monitoring keeps entity data accurate after upgrades — [SPECIFIC: name a protocol upgrade that required reindexing or entity remapping].

Without that monitoring, an exchange address that migrated to a new contract after an upgrade looks like an unknown wallet.

Multi-Chain Forensics Pipelines: EVM, Tendermint, Cosmos, UTXO

Criminals don’t stay on one chain. Tracing a ransomware payment often means following assets from Bitcoin to Ethereum, through a bridge to an EVM-compatible L2, then into a DeFi protocol on a Cosmos-based chain. Each of those networks has a different consensus model, a different transaction format, different finality semantics.

4soft builds pipelines that normalize activity across EVM chains, Tendermint networks, Cosmos-based protocols, and UTXO chains into a unified investigative dataset. The normalization isn’t cosmetic — it’s the thing that makes cross-chain tracing tractable at The platform processes over 200 million addresses and transactions each month transaction volume with a lag target.

Who Uses This Infrastructure

Law Enforcement Agencies

LEAs increasingly need blockchain investigation capabilities that don’t route sensitive case data through commercial cloud platforms. That’s not paranoia — it’s operational security and legal admissibility. 4soft builds proprietary forensics data infrastructure for law enforcement, giving agencies control over their data, their queries, and their analytical results. No vendor audit logs. No shared tenancy.

Compliance Teams at Banks and Exchanges

Financial institutions and VASPs operating under FATF Travel Rule requirements, sanctions screening obligations, or SAR filing mandates need forensics data that integrates natively with internal AML systems. Off-the-shelf SaaS tools often can’t do that without custom middleware and data sharing agreements that create their own compliance exposure.

4soft builds these integrations on top of the same data infrastructure we develop for Elliptic.

Build vs. Buy: The Honest Case

There are real reasons to buy a SaaS forensics subscription. Speed to deployment. Lower upfront cost. Someone else handles the infrastructure.

There are also real reasons not to. Investigation data stays in your infrastructure, not a vendor’s cloud. Chain coverage isn’t limited to what the vendor has chosen to index. Proprietary intelligence feeds and entity labels can be integrated without negotiating data-sharing terms. Every data point has complete provenance — which matters when evidence enters legal proceedings. And you own the tool rather than holding a time-limited license that expires or gets repriced.

The right answer depends on investigation volume, sensitivity requirements, and chain coverage needs. For organizations past a certain scale, building wins.

How Blockchain Forensics Works

Starting from a known address, analysts follow transaction chains — accounting for mixing, bridging, and DEX hops — to identify where funds originated or where they were sent. Address clustering algorithms group wallets controlled by the same entity. Entity intelligence maps clusters to real-world actors.

The accuracy of that entire process depends on one thing: the completeness and quality of the underlying data. A forensics platform is only as good as its indexer.

Working With 4soft

Cost depends on the number of chains, data depth required, and latency targets. 4soft works on fixed-scope development contracts — cost certainty compared to per-query SaaS pricing at investigation scale.

“What impresses me most about 4soft is their adaptability to our business. They provide both top-quality code and valuable blockchain business insights. I’d recommend 4soft to anyone who needs both proactive tech specialists and business expertise for their project.”

— Lukas Kujawa, Engineering Director at Elliptic

Contact us for a scoping discussion.

For more details on Elliptic’s next-generation platform: https://www.prnewswire.com/news-releases/elliptic-launches-next-generation-platform-to-power-the-future-of-digital-asset-forensics-and-compliance-302637723.html

Did you find it interesting? Schedule a call with one of our experts and discover tailored solutions designed specifically for your needs.

May 12, 2026