Chainalysis Reactor Blockchain Investigation Training Course

Course overview

Blockchain-related financial crime investigations often begin with incomplete evidence: a wallet address from a suspicious activity alert, a transaction hash from a victim report, or a customer deposit linked to a high-risk service. Analysts must determine what funds did, which entities may control them, whether exposure is direct or indirect, and how to document findings without overstating attribution. This course equips financial-crime teams to turn blockchain data into defensible investigative intelligence using Chainalysis Reactor.

Participants learn to build and interpret transaction graphs, trace funds across services and assets, identify common laundering typologies, apply exposure and confidence concepts, and use Reactor entity labels, clusters, filters, alerts and visualisation controls. The programme covers an end-to-end investigation workflow: scoping a lead, preserving source information, following transaction paths, testing hypotheses, prioritising risk, and preparing evidence suitable for escalation to compliance, legal, law enforcement or a customer-review team.

Delivered over five instructor-led days, the course combines guided Reactor labs with realistic cases involving scam proceeds, exchange deposits, mixers, ransomware exposure and cross-chain activity. Participants practise documenting each analytical decision in an investigation workbook and complete a capstone case. They leave with a structured investigation case file containing transaction narratives, annotated Reactor graphs, risk findings, evidence references and a recommended next action, alongside a certificate of completion.

The course is designed for practitioners who need to use blockchain intelligence in operational investigations rather than simply understand cryptocurrency concepts. It is equally useful to managers seeking a repeatable process for triage, escalation and quality assurance across cryptocurrency-related alerts and cases.

Course objectives

By the end of this course, participants will be able to:

• Construct transaction graphs in Chainalysis Reactor from wallet addresses, transaction hashes and known entities
• Apply Reactor filters, path-finding and flow analysis to trace cryptocurrency movement across multiple hops
• Differentiate direct and indirect exposure using transaction distance, value flow and entity-risk context
• Identify laundering indicators associated with exchanges, mixers, scams, ransomware and high-risk services
• Assess attribution evidence using Reactor labels, entity clusters, confidence indicators and corroborating sources
• Document an investigation narrative that links blockchain evidence to a defensible risk conclusion
• Prepare annotated graph exports and evidence references for compliance escalation or law-enforcement referral
• Produce a complete blockchain investigation case file with findings, limitations and recommended actions

Benefits of attending

Target competencies

Who should attend

• AML Investigators — who must assess cryptocurrency activity and support suspicious activity escalation
• Financial Crime Analysts — who need to triage blockchain-linked alerts with evidence rather than assumptions
• Transaction Monitoring Analysts — who investigate fiat-to-crypto and crypto-to-fiat movement through customer accounts
• Compliance Officers — who require defensible blockchain risk assessments for customer reviews and regulatory reporting
• Fraud Investigators — who trace scam proceeds, mule-wallet activity and victim-payment destinations
• Law Enforcement Financial Investigators — who need structured tracing methods for cryptocurrency evidence

Requirements and prerequisites

Participants should be comfortable working with financial-crime case information, transaction records and basic spreadsheet data. Familiarity with AML concepts such as customer due diligence, suspicious activity indicators, source of funds and escalation routes is helpful. No prior blockchain investigation experience is required: the course begins with wallets, private and public keys, transactions, blocks, confirmations and common cryptoasset service providers. Participants do not need coding, smart-contract development or advanced cryptography knowledge. Access to a Chainalysis Reactor training environment is provided for class exercises; attendees should bring a laptop capable of using a modern web browser and opening spreadsheets.

Training methodology

The instructor introduces each investigation method through a live Reactor demonstration, then participants apply it in guided lab scenarios using training data. Exercises progress from reading a single transaction to analysing multi-hop flows, entity exposure and cross-service movement. Small groups compare competing hypotheses, decide what evidence supports attribution, and defend escalation recommendations. Daily debriefs connect Reactor outputs to AML casework, while the final day uses a capstone investigation to create an annotated graph, written narrative and action plan that participants can adapt to their own operating procedures.

Course outline

Day 1: Blockchain investigation foundations and Reactor navigation

• Blockchain transaction anatomy: addresses, inputs, outputs, UTXOs and confirmations
• Cryptoasset service provider ecosystem: exchanges, brokers, mixers, DeFi services and payment processors
• Chainalysis Reactor workspace, search methods and investigation starting points
• Address, transaction and entity searches within Reactor
• Entity clusters, labels and attribution confidence concepts
• Graph visualisation controls, node expansion and transaction-detail review
• Investigation scoping, hypothesis setting and source-information preservation

Workshop: Participants build their first Reactor graph from a suspicious wallet address and produce a documented initial lead assessment.

Day 2: Tracing funds and analysing transaction flows

• Following inbound and outbound funds through transaction chains
• Flow direction, transaction timing and value analysis
• Reactor filters for asset, date, amount, category and transaction type
• Hop analysis and direct-versus-indirect exposure measurement
• Path-finding between addresses, entities and identified services
• Peel chains, consolidation patterns and change-address interpretation
• Graph annotations, saved views and investigative decision logs

Workshop: Participants trace suspected scam proceeds through multiple hops and create an annotated flow map showing the most relevant destinations.

Day 3: Risk typologies, entities and attribution

• Risk categories and service typologies used in blockchain investigations
• Exchange exposure, nested services and deposit-address analysis
• Mixer, tumbler and privacy-enhancing service indicators
• Ransomware, darknet market and scam-payment tracing patterns
• Entity identification versus ownership attribution limitations
• Corroborating Reactor findings with case records and open-source evidence
• Applying FATF risk-based principles to blockchain investigative decisions

Workshop: Teams assess a high-risk-service exposure case and produce a risk rationale distinguishing confirmed facts from analytical assumptions.

Day 4: Operational casework and reporting

• Alert triage workflow for customer-linked cryptocurrency activity
• Linking fiat transaction records to blockchain deposits and withdrawals
• Case chronology construction from on-chain and off-chain evidence
• Investigative thresholds for enhanced due diligence and escalation
• Reactor graph exports, screenshots and evidence-reference discipline
• Writing transaction narratives for SAR, STR and internal case files
• Quality assurance checks for reproducible blockchain investigations

Workshop: Participants turn a Reactor analysis into a concise escalation pack containing a timeline, graph exhibits, risk assessment and recommended action.

Day 5: Capstone investigation and workplace application

• End-to-end case intake and investigative planning
• Multi-entity graph construction for a complex funds-flow scenario
• Competing hypotheses and evidential-strength assessment
• Prioritising leads using risk, value, recency and destination criteria
• Investigation limitations, false-positive risks and defensible language
• Stakeholder briefing for compliance, legal and law-enforcement audiences
• Personal application plan for Reactor-enabled investigation workflows

Workshop: Participants complete a capstone Reactor investigation and submit a case file with annotated graph, evidence log, findings and escalation recommendation.

Tools & standards covered

Chainalysis Reactor, Chainalysis KYT, Microsoft Excel, FATF Recommendations

A typical training day

Live online deliveries follow the same structure in the East Africa Time zone, with shorter screen blocks and longer breaks.

What the fee includes

How you can take this course

Certification

Participants who complete the full five days receive the Skillset Development Certificate of Completion, stating the course title, course code, dates and delivery format — suitable for professional-development records and employer reimbursement.

Frequently asked questions