Blockchain Intelligence as an Intelligence Discipline

The case for placing it alongside OSINT, HUMINT and SIGINT

Blockchain intelligence should be recognised as an intelligence discipline in its own right, alongside OSINT, HUMINT and SIGINT.

In November 2025, BIPA contributed to a RUSI workshop in Warsaw on how missing standards in blockchain analytics enable the financing of Russian sabotage. The contribution focused on standards: reproducible methods, consistent attribution, interoperable tools. Behind those gaps sits a more basic question. What kind of intelligence is this?

The proposal was underlined again in October 2026 at the GCFFC Annual Summit in Vilnius. BIPA’s chairman, Bogdan Vacusta, spoke in the session on wallet attribution and linking crime to cryptoasset flows, and returned to the case first made in Warsaw.

Intelligence communities organise their work by discipline. Each one has its own sources, collection methods, tradecraft, training and oversight. Blockchain intelligence has none of that standing. It is treated as a tool bought from vendors, or folded into financial or open-source intelligence. That framing is now a liability.

What makes a discipline

An intelligence discipline is defined by four things: a distinct source, a distinct way of collecting and processing it, a distinct analytic tradecraft, and a professional community that practises it. Blockchain intelligence meets each test.

The source is unique. Public ledgers are a permanent, global, append-only record of value moving between pseudonymous addresses. No other source offers a complete transaction history that cannot be altered after the fact.

Collection requires specialist processing. Raw ledger data is unreadable without running nodes, parsing chains, decoding smart contracts and following funds across bridges and protocols. The data is public; its meaning is not.

The tradecraft is its own. Address clustering, entity attribution, flow tracing and confidence scoring each rest on heuristics with known error rates and known ways to defeat them. Analysts must understand those limits to produce judgements that hold up.

The community already exists. Investigators, analysts, compliance specialists and researchers do this work every day. What they lack is the formal standing that comes with recognition.

Neither OSINT nor FININT

It is tempting to file blockchain intelligence under open-source intelligence because the ledgers are public. But OSINT works with information that people can read once they find it. Ledger data cannot be read without technical processing, which puts it closer to SIGINT: collection first, then decoding, then analysis.

Financial intelligence is the other obvious home. Yet FININT relies largely on reports and records from regulated institutions, obtained through legal process. Blockchain intelligence works on the primary transaction record itself, with no intermediary, and can see flows before any institution reports them.

It also behaves like a mature discipline in how it connects to others. Attributing an address often depends on HUMINT, OSINT or SIGINT, and blockchain findings in turn cue collection in those disciplines. Whether it is called BLOCKINT or simply blockchain intelligence matters less than giving it the same place at the table.

What is at stake

Sabotage financing shows why this matters. Russia now recruits “gig economy” operatives through digital platforms and pays them in cryptoassets. The payments are small, distributed and deniable, far harder to trace than Cold War methods.

Against this threat, allied agencies work with fragmented capabilities. Each sees a partial picture through a different tool. The same wallet carries different labels on different platforms. Operatives can shape transactions to evade the clustering logic of the tools they know are in use. When cases reach court, methods that cannot be reproduced are easily challenged, and the line between on-chain fact and analytical opinion is blurred.

The Warsaw contribution also noted a structural gap: law enforcement and regulators are driving standardisation, while intelligence agencies are largely absent. As long as blockchain intelligence is seen as a procured product rather than a discipline, the method belongs to the vendor. The agency can use the output but cannot fully validate it.

What recognition would change

Recognising blockchain intelligence as a discipline would bring it under the same disciplines of practice as the established INTs.

Doctrine and tasking. It would appear in collection plans and fusion processes, not only in post-incident investigations.
Tradecraft standards. Methods would be reproducible, attributions would carry stated confidence, and on-chain facts would be kept separate from analytical judgement.
Professional formation. Analysts would follow structured training, vendor-independent certification and recognised career paths.
Collection and use would sit within the legal and proportionality frameworks that govern other disciplines.
Sovereign capability. Agencies would build the expertise to validate vendor claims rather than depend on them.

Recognition would also bring intelligence agencies into standard-setting, where their operational experience is needed most. Open, vendor-neutral efforts already offer a route. The Open Blockchain Intelligence Standards initiative, a global project promoted by Complexity Science Hub Vienna, BIPA and ICI Bucharest, develops its specifications in the open and welcomes contributions from the intelligence community.

From tool to discipline

OSINT was long treated as a supplement to “real” intelligence before it earned its own doctrine, training and career paths. Blockchain intelligence is at the same point now.

Adversaries do not need to defeat our analytical tools. They only need to exploit the gaps between them. Treating blockchain intelligence as a discipline, with shared standards and accountable tradecraft, is how those gaps close before they are further weaponised.

Daniel Sanda is a member of the Blockchain Intelligence Professionals Association (BIPA). He has a background in defence intelligence, where he investigated sabotage, subversion, espionage and counterterrorism cases.

News