Decrypting Coinbase Accounts: A Guide for Forensic Analysts

[author: Jason Pierce]

As cryptocurrencies become more mainstream, it is vital for forensic analysts to understand and analyze digital currency data. Forensic analysts are increasingly being brought in to trace and help recover crypto assets in criminal matters, such as money laundering and other fraud prosecutions. There is also a noticeable increase in the use of forensic analysts in civil litigations, which can range from contested divorces to probate and bankruptcy cases.

This article focuses on how to do this using one of the major exchanges as the example. Coinbase is an online cryptocurrency exchange with more than 89 million verified users with $278 billion on the platform.[1] The exchange’s retail users can buy, sell, send, receive, and exchange 139 different crypto assets.

Let’s say you were asked to analyze the activity of a user account, but you don’t know where to start since there are no monthly statements from Coinbase. The following steps illustrate the process to obtain the data:

1. Sign into the Coinbase account.
2. Click on the profile photo.
3. Navigate to “Reports”.
4. Choose “Generate Report” for the Transaction History.[2]
5. Filter the information or choose from CSV or PDF format and “Generate Report”.[3]
6. Click “Download” to get the Coinbase transaction report.

Of course, this process may require a subpoena for investigating accounts outside your client’s control, but the option to receive the complete transaction history in an electronic format is a step above what most financial institutions provide. Coinbase does issue 1099-MISC to account holders if “earnings” exceed $600 in a calendar year but doesn’t share any gain or loss activity with the IRS.[4] However, the IRS has successfully issued subpoenas to obtain client information from Coinbase and other exchanges.[5]

Once the transaction data has been imported into Excel, you can perform some standard forensic procedures. Examples include:

1. Establish values of the holdings
2. Summarize the account activity
3. Reconcile the transfers to and conversions to/from other currencies
4. Quantify the amount of crypto sent to and received from other accounts
5. Other considerations

These procedures are discussed separately below.

1. Establish Values of the Holdings

In the past, establishing crypto asset values was difficult, due to price variations between exchanges and the availability of historical data. Today even the Wall Street Journal reports historical prices, and there are websites devoted to the continuous tracking of roughly 10,000 digital currencies.[6] The Coinbase Transaction History report includes information to establish the cost basis at the time of each transaction. You may need to go one step further and calculate the value of the holdings closer to the trial date.

2. Summarize the Account Activity

The Transaction History report includes the following fields: timestamp, transaction type, asset, quantity transacted, spot price currency, spot price at transaction, subtotal, total (inclusive of fees), and notes. These data groups can be manipulated/pivoted to a more usable format. For example, the following chart illustrates how Bitcoin (BTC) transactions can be summarized by quantity and amount for the past three calendar years.

You can use the transaction summaries for each type of currency to help educate clients on the account activity and determine the scope of additional procedures. For example, you may want to investigate why there were more sales of BTC than purchases/receipts and determine the destination of the “send” transactions.

These fields can be further segregated by month, individual transactions, or other available evidence depending on the needs of the case. The next section shows how to reconcile the transfers to/from the bank accounts and analyze currency conversions.

3. Reconcile the Transfers and Conversions to/from Other Currencies

Transfer Activity

Reconciling crypto exchange transfers is similar to a traditional forensic analysis of bank statement activity if you consider Coinbase as a specialized financial institution. Funds transferred out of a traditional bank account will flow directly into the Coinbase account as a “buy” transaction (or into cash as a “USD” type). Note that transfers and other cryptocurrency activities occurring prior to the Coinbase account formation won’t show up on the Transaction History report.

Transfers out to bank cash accounts require conversion to dollars before leaving Coinbase, so these should be easier to follow. However, the Transaction History report doesn’t include the USD only transactions.[7] You should have the client perform the following steps:

1. Click the Coinbase logo or navigate to the home screen.[8]
2. Select the “Assets” category.
3. Select the US Dollar (USD) under “Your assets”.
4. Print this page or save to a PDF.

There is no option to export the USD wallet activity, but this printout will ensure the withdrawal and deposit transactions are captured for the forensic analysis.

A useful feature of the blockchain is that it maintains a complete record of all the transactions that have ever occurred, facilitating the reconciliation of transfers despite the anonymity. Think of the Bitcoin platform as a giant general ledger. If there are transactions outside the Coinbase exchange, you may consider utilizing a specialized forensic analyst with crypto expertise to help understand the activity in other accounts.[9]

Crypto Asset Conversions

The first step in the reconciliation process is to sort the transactions by type. The Transaction History report tracks the following transaction types: buy, sell, convert, advanced trade fill, send, receive, rewards income, and Coinbase earn. The “convert” type transactions provide some data, but you will need additional information from the “notes” field to understand the entire transaction.

The following is an example of the notes data from a sample transaction: “Converted 518.90941073 LTC to 6.65444836 BTC”. The recommendation here is to add an additional row of data to segregate the “convert from” data from the “convert to.” This is shown below with some fields removed/rounded for simplicity.

Coinbase charges a fee for these transactions so there will be differences between the “convert from” and “convert to” balances. Understanding the convert data field is also important so you don’t confuse the source of funds and/or mistake asset holding fluctuations with those sent to or received from other accounts.

The following is an example of an Excel pivot chart using the modified convert-type transactions, summarized by dollar amounts only (rounded).

Please note Excel pivot tables put the section totals at the top of each category so the above table is shown with this formatting. The “Grand Total” difference between the convert to and the convert from represents Coinbase’s transaction fees. Beware of any large variations as that may signal something is wrong with the analysis. You may want to add additional details depending on the needs of the case (such as quantity transacted, spot price, etc.).

4. Quantify the Amount of Crypto Sent to and Received from Other Accounts

As described above, the Transaction History report tracks the cryptocurrency assets sent and received from other sources. Sometimes the recipient’s name is listed in the “notes” field if the account holder has a Coinbase account or is a known related party. Otherwise, only the recipient’s public wallet address is shown (which is a long, nonsensical series of letters and numbers such as: 4WCB5je278eUXVrpW3cAHfxfHjkp1KoKos). You can use the sent and received information to help identify additional user accounts, such as those held on other exchanges. These can be quantified similar to the BTC example above using the report data.

You should consider discussing with counsel whether the sent transactions represent potential dissipation of the marital estate for divorce cases. In these situations, the Coinbase account holder would have the burden of proof to establish the marital purpose for the transaction(s). You should also ensure consistency between the actual transaction date and current market value as counsel may argue for whichever date produces the highest amount.[10]

5. Other Considerations

Income Taxes

It’s no secret that some people use crypto currencies to mask their identities while others simply may not know the rules for reporting gains and losses. So, don’t assume all the activity is reported on the income tax returns. This is more complicated when account holders receive currencies through hard forks in the blockchain or “airdropped” tokens.[11] The IRS has issued some guidance on the taxation of digital currencies and “actively addressing potential noncompliance”.[12] You should consider the taxes (un)paid and potential liabilities. The Transaction History data provides information to calculate the tax liabilities associated with unrealized capital gains depending on the type of case. Coinbase also has a separate section of the website devoted to tax reports.[13]

Other Data

Other information contained in the Coinbase accounts that may be accessed with the subpoena include: the account registration records, funding sources, and history of the IP addresses used to access the account. Coinbase also offers a Wallet Extension which allows users to self-custody crypto assets, monitor non-fungible tokens (NFTs), and interact with the Crypto Economy and Web3 (i.e., trade tokens on decentralized exchanges (DEXes)), and access decentralized applications (dApps).[14] These specialized topics may be the subject of future articles.

Coinbase Pro, Institutional, or Prime customers have premium content available so you should understand the type of account the user has in case there is more information available, such as accessing Form 8949 (Sales and Other Dispositions of Capital Assets).

Summary

It’s time for forensic analysts to embrace crypto cases as standard fare. The top 85 cryptocurrencies each have a market capitalization in excess of $1 billion.[15] At the time of this writing, $2+ trillion of wealth has been created through digital currencies and the daily volume can exceed $100 billion/day. This is especially relevant as the Federal Reserve is considering how a Central Bank Digital Currency (CBDC) might fit into the U.S. money and payments landscape.[16] With approximately 12% of the total market capitalization of crypto assets at the end of 2021[17], a Coinbase analysis may be coming to an engagement near you.

As the crypto market continues to grow and evolve, forensic analysts called in to examine these cases would be wise to include cryptocurrency activity/assets in their standard document requests and find a specialized crypto forensics expert before the need arises.

Acknowledgments

We would like to thank Jason Pierce for providing insight and expertise that greatly assisted this research.