Curriculum·G103 Fund-Flow Tracing and Forensics·about 30 min
Following a transfer graph
By the end of this lesson you can
- →Model a set of transactions as a directed graph of value flowing between addresses
- →Explain how the FBI traced the Colonial Pipeline ransom across the graph to a recoverable wallet
- →Compute how value splits and merges as it moves, and why every hop is recorded
- →Trace a flow forward from a source and backward from a destination
Graduate · enrolled learners
This lesson opens with Colonial Pipeline ransom, May 2021.
- What happened
- In May 2021 a ransomware attack by the DarkSide group shut down the Colonial Pipeline, a major fuel line for the US East Coast, and the operator paid about 75 bitcoin, then worth roughly 4.4 million dollars, to restore service. The payment did not vanish. On a public ledger every transfer is a recorded edge from one address to another, so the FBI followed the ransom hop by hop across the transaction graph as it was split and moved, until a large portion landed in a wallet whose private key investigators were able to obtain. In June 2021 they recovered about 63.7 of those bitcoin. Nothing was decrypted and no backdoor was used on the chain itself; the money moved in the open, each step written permanently, and following the recorded path is what let investigators find where the funds came to rest and seize them.
- The decision point
- A ransom on a public chain is not a disappearance; it is a trail, because the ledger records every transfer as a permanent, directed edge from a sender to a recipient. That single fact turns tracing into a graph problem: value flows along edges, splitting into several outputs and merging from several inputs, and the whole history is queryable. The analyst's first tracing skill is to see a pile of transactions as that graph and to walk it, forward from a source to see where funds went, or backward from a destination to see where they came from. Colonial Pipeline is the clean case: a payment made to make a problem go away instead became a path the FBI walked to a wallet they could open. The chain does not forget an edge, and following edges is the whole of a trace.
- Recorded loss
- $4,400,000
What you will be able to answer
- →How was the Colonial Pipeline ransom recovered?
- →What is a transfer as a graph?
- →Forward versus backward tracing?
- →How do you handle splits and merges in a trace?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside
- https://www.chainalysis.com/blog/how-crypto-tracing-works/
- https://www.fbi.gov/news/press-releases/fbi-statement-on-network-disruption-at-colonial-pipeline
Confidence high·Volatility low·Reviewed 2026-09-15·Owner unassigned
Contested
Colonial Pipeline paid about 75 BTC (~4.4 million dollars); the FBI recovered about 63.7 BTC (~2.3 million dollars at the June 2021 price). The exact method of obtaining the wallet's private key was not fully detailed publicly.
This lesson uses the case to teach graph tracing; the recovery depended on the funds landing in a wallet the FBI could access, which is not guaranteed in every trace.