When victims become data: why blockchain intelligence needs open standards
An investigation published this week by Compliance Corylated raises a question the blockchain analytics industry can no longer sidestep: what happens to the information that victims of crypto scams hand over when they report a crime?
Rachel Wolcott’s article, “Blockchain analytics’ monetisation of crypto crime victim data treads risky data privacy path”, documents how victim-reporting channels operated or acquired by leading analytics vendors feed directly into commercial intelligence products. Reports submitted in the hope of recovering funds or helping police become, in the vendors’ own terms of use, content over which the company holds “a perpetual, irrevocable, transferable, assignable, sublicenseable, worldwide licence” to be used “at its discretion for its legitimate business purposes”. Victims are offered an explicit choice about sharing with law enforcement; they are not offered a comparable choice about commercial reuse.
The privacy stakes are not abstract. As Nivie Kaul of Digital Defenders Group explains in the piece, a report on an investment scam rarely consists of a wallet address alone. It carries chat transcripts, identity documents, bank statements and, because social engineering works by exploiting personal circumstances, details of health, faith, relationships or financial distress. Under the GDPR much of this is special category data, whose processing requires an explicit legal basis and documented safeguards that none of the reviewed privacy policies appear to set out. The data protection authorities of Berlin and Finland, asked for comment, restated the basics: a controller must disclose which data it processes, for what purposes, on what legal basis and to which recipients, and may reuse data for a new purpose only where that purpose is compatible with the original one. Perpetual licences sit awkwardly beside the rights to withdraw consent, to rectification and to erasure.
The vendors’ responses ranged from an assurance that only wallet addresses reach the commercial platform, to an internal policy review acknowledging that the documentation “could explain more clearly” how submitted information is processed, to no comment at all. One victim quoted in the article put the point more plainly: reporting data “should be treated with the same care, sensitivity and respect as medical data”.
The problem is structural, not individual
It would be easy to read this as a story about a few companies’ privacy policies. It is not. It is a story about a field that has grown into a critical input for law enforcement, financial supervision and the courts without any shared, public definition of how its data should be collected, labelled, attributed, retained or shared.
Attribution is the clearest example. A wallet address reported by a victim becomes, once it enters a commercial dataset, a label that follows that address through every product, every customer and every downstream investigation. Whether that label was verified, by whom, on what evidence, and whether the person who supplied it can ever have it corrected, is today a matter of each vendor’s internal practice. The same is true of the boundary between intelligence data and personal data, of provenance records, and of what a competent analyst is expected to do before a finding leaves their desk. Regulators can insist on transparency, but they cannot audit what has never been specified.
This is precisely the gap that standards exist to close. In every other discipline that feeds evidence into judicial and supervisory processes, from forensic accounting to digital forensics, practice is anchored in openly published methods that anyone can read, challenge and test. Blockchain intelligence has reached the point where the same is required of it.
Joining efforts on OBIS
The Open Blockchain Intelligence Standards (OBIS) initiative was created to provide that anchor. OBIS is an open, vendor-neutral project: its specifications are written by contributors in public, on GitHub, and pass through a Draft, Public Review and Published lifecycle that anyone can follow. It is not owned by any company and it certifies no one. Three institutions promote OBIS and facilitate its development: ICI Bucharest, the Complexity Science Hub Vienna and the Blockchain Intelligence Professionals Association. None of them owns, controls or authors the standards; their role is to bring the community together and keep the work open. Its three focus areas, investigations, forensics and attribution; regulatory reporting and supervision; and open analytics and research data, map directly onto the questions this week’s reporting leaves open.
Standards of this kind only carry weight if the people who will be bound by them help write them. That means the analytics vendors themselves, whose data practices are now under scrutiny and who have the most to gain from a common rulebook that replaces case-by-case reputational risk. It means the law enforcement agencies, financial intelligence units and supervisors who consume the outputs and must be able to rely on them in proceedings. It means the data protection authorities whose principles need a technical vocabulary to bite on. And it means victim-support organisations, who understand better than anyone what is at stake when a report is filed.
A series of OBIS roundtables across Europe in the coming months, and the Blockchain Intelligence Forum in Bucharest on 22 April 2027, offer a practical route in. So does the open repository itself. The specifications, the discussion and the contribution process are available at obistandards.org and github.com/obi-standards; formal comments can be sent to [email protected].
The victims quoted in Compliance Corylated’s investigation did not ask for much: to know what happens to their data, and to have it used to bring criminals to justice rather than to enrich intermediaries. An industry that shares open standards can answer them. An industry without them will keep being asked the same questions.
Source: Rachel Wolcott, “Blockchain analytics’ monetisation of crypto crime victim data treads risky data privacy path”, Compliance Corylated, 2 September 2026 — https://www.compliancecorylated.com/news/blockchain-analytics-monetisation-of-crypto-crime-victim-data-treads-risky-data-privacy-path/