New York, United States• New York City, United States (US)
Remote
Senior
Full Time
💰$171,000 - $257,000
blockchainfraudinvestigationsseniormanager
Requirements
- •7+ years of relevant investigative or analytical experience
- •Meaningful professional experience specifically conducting cryptocurrency or blockchain investigations
- •Demonstrated hands-on expertise independently conducting complex blockchain tracing investigations
- •Advanced proficiency with one or more blockchain intelligence platforms such as Chainalysis Reactor, TRM Labs, Elliptic, or comparable technology
- •Strong understanding of how blockchain intelligence platforms derive attribution, clustering, exposure, and risk information and their limitations
- •Demonstrated understanding of blockchain fundamentals including wallets and addresses, transactions, UTXO and account-based models, tokens, smart contracts, block explorers, transaction fees, confirmations, and blockchain-specific transactional structures
- •Strong understanding of digital-asset ecosystems including centralized exchanges, self-hosted wallets, DeFi, DEXs, stablecoins, cross-chain bridges, mixers, privacy-enhancing mechanisms, and other relevant technologies
- •Demonstrated ability to trace assets across multiple chains, protocols, and intermediaries and recognize when technical limitations prevent definitive continuity or attribution
- •Experience conducting transaction-graph analysis, wallet attribution, clustering, counterparty analysis, transaction-flow reconstruction, and investigative link analysis
- •Ability to critically assess blockchain attribution and distinguish among technical facts, commercial vendor intelligence, analytical inference, and unsupported assumptions
- •Experience integrating blockchain intelligence with off-chain evidence and enterprise information to develop investigative conclusions
- •Strong knowledge of fraud-investigation principles including corroboration, source evaluation, evidence preservation, timeline development, hypothesis testing, and documentation
- •Experience analyzing large or complex datasets and familiarity with tools such as SQL, advanced Excel, Python, Splunk, or comparable data-analysis technologies
- •Ability to clearly explain technically complex blockchain findings to audiences with little or no blockchain expertise
- •Strong investigative writing skills and ability to produce accurate, concise, and defensible analytical products
- •Sound judgment and ability to work effectively where evidence is incomplete, conflicting, or evolving
- •Demonstrated discretion when handling sensitive employee, customer, investigative, security, or company information
- •Demonstrated experience mentoring, supervising, or reviewing the work of junior analysts or investigators
What You'll Do
- •Lead and conduct complex blockchain investigations and transaction tracing across multiple wallets, counterparties, entities, blockchains, tokens, protocols, and digital-asset ecosystems
- •Trace the origin, movement, conversion, layering, consolidation, and ultimate disposition of digital assets, including activity spanning multiple intermediaries and blockchain environments
- •Conduct investigations using tools such as Chainalysis Reactor, TRM Labs, Elliptic, or comparable blockchain intelligence platforms
- •Analyze activity involving centralized exchanges, self-hosted wallets, decentralized exchanges, cross-chain bridges, mixers, privacy-enhancing technologies, DeFi protocols, smart contracts, stablecoins, NFTs, OTC activity, gambling platforms, and other relevant ecosystems
- •Trace assets across multiple chains and cross-chain transactions, identifying continuity of funds where technically supportable and clearly documenting assumptions or limitations where definitive attribution is not possible
- •Analyze transaction graphs, address relationships, behavioral patterns, clusters, counterparties, timing, amounts, transaction sequencing, and other relevant blockchain indicators
- •Understand and appropriately apply wallet-clustering and attribution methodologies, including the limitations and potential for false attribution associated with particular heuristics
- •Independently evaluate blockchain intelligence rather than relying solely on automated labels, risk scores, or vendor-generated attribution
- •Corroborate on-chain findings with internal account records, KYC/KYB information, transaction data, access information, open-source intelligence, legal-process returns, or other available evidence
- •Identify relationships among blockchain addresses, OKX accounts, external counterparties, individuals, organizations, vendors, affiliates, and other relevant entities
- •Reconstruct complex transaction flows and create clear fund-flow diagrams, transaction maps, timelines, and visualizations
- •Analyze blockchain activity associated with suspected fraud, theft, account takeover, social engineering, insider activity, collusion, payment diversion, asset misappropriation, or other misconduct
- •Identify new wallets, counterparties, entities, or transactional patterns that may generate additional investigative leads
- •Clearly document the methodology, assumptions, confidence level, and limitations associated with blockchain findings
- •Distinguish between confirmed attribution, vendor attribution, analytical inference, behavioral similarity, and an unverified investigative hypothesis
- •Avoid presenting blockchain proximity, exposure, clustering, or a commercial risk score alone as proof of ownership, control, intent, or misconduct
- •Maintain current knowledge of emerging blockchain technologies, protocols, tracing methodologies, obfuscation techniques, fraud typologies, and developments affecting blockchain attribution or investigations
- •Conduct and support investigations involving internal and external fraud, employee misconduct, insider threats, vendor and third-party misconduct, collusion, conflicts of interest, asset misappropriation, unauthorized access, credential misuse, and other significant fraud risks
- •Combine blockchain findings with off-chain evidence to develop a comprehensive investigative picture
- •Develop investigative hypotheses and objectively test those hypotheses against available evidence
- •Conduct timeline reconstruction, link analysis, relationship mapping, pattern analysis, clustering, and comparative analysis across individuals, accounts, wallets, devices, systems, transactions, and entities
- •Support investigations involving account takeover, impersonation, social engineering, business-email compromise, payment diversion, affiliate misconduct, and trusted-party abuse
- •Analyze vendor, affiliate, partner, and other third-party activity for indicators of billing irregularities, undisclosed relationships, conflicts of interest, unusual payments, control circumvention, or other potential misconduct
- •Support investigative interviews by developing transaction timelines, identifying inconsistencies or information gaps, organizing evidence, and identifying appropriate areas for follow-up
- •Analyze appropriately authorized information including system and access logs, authentication records, audit trails, customer-account activity, KYC/KYB information, transaction records, payment information, case-management records, vendor information, and relevant security telemetry
- •Correlate blockchain activity with enterprise data to identify possible connections among wallets, accounts, employees, customers, vendors, devices, transactions, and other relevant entities
- •Support investigations involving suspected unauthorized access, information misuse or exfiltration, credential compromise, control circumvention, unauthorized disclosure, or abuse of privileged access
- •Identify anomalous behavior or access patterns that may warrant additional investigation
- •Develop repeatable analytical methodologies capable of processing and correlating information from disparate systems
- •Use appropriate scripting, database querying, data visualization, and analytical technologies to efficiently analyze large or complex datasets
- •Prepare clear, concise, and well-supported blockchain investigation reports, investigative memoranda, executive summaries, transaction-flow diagrams, link charts, timelines, and other analytical products
- •Explain complex blockchain concepts and transaction activity in plain language suitable for investigators, senior management, Legal, regulators, or law enforcement
- •Clearly distinguish among allegations, investigative leads, known facts, third-party attribution, analytical judgments, assumptions, information gaps, and substantiated conclusions
- •Ensure analytical conclusions are proportionate to the evidence and do not imply greater certainty than the underlying blockchain or other data supports
- •Maintain sufficient documentation to allow significant blockchain findings to be reviewed, reproduced, and understood by another qualified analyst
- •Preserve and handle investigative records in accordance with applicable evidence-preservation, chain-of-custody, confidentiality, privacy, access-control, and need-to-know requirements
- •Support appropriately authorized law-enforcement, regulatory, litigation, or legal matters in coordination with the appropriate company functions
- •Provide analytical support to PST on selected matters involving threats or concerning activity directed toward employees, executives, offices, events, or other company interests
- •Conduct authorized open-source, link, timeline, blockchain, financial, or other analytical research where relevant to understanding the identity, relationships, capabilities, or activity associated with a potential threat
- •Assist in evaluating available information relating to credibility, corroboration, intent, capability, access or opportunity, targeting, escalation, timing, and other relevant indicators
- •Prepare objective analytical products identifying known facts, analytical judgments, material information gaps, uncertainties, and appropriate confidence levels
- •Support PST’s assessment while preserving PST’s responsibility for protective-security decisions and operational response
- •Directly manage and develop one Junior Analyst, including work allocation, coaching, technical development, quality assurance, and review of analytical work product
- •Serve as a FIT subject-matter resource for blockchain investigations and on-chain analytical methodology
- •Review blockchain analysis for technical accuracy, appropriate methodology, corroboration, reasonable attribution, and evidentiary support
- •Train and mentor junior personnel in transaction tracing, blockchain intelligence platforms, analytical reasoning, documentation, and investigative methodology
- •Help establish consistent standards for blockchain investigations, attribution, documentation, quality assurance, and reporting
- •Participate in time-sensitive investigations affecting a global organization, including occasional work outside normal business hours when required
Nice to Have
- •Experience conducting blockchain investigations within a cryptocurrency exchange, blockchain analytics company, law-enforcement agency, regulatory organization, financial institution, intelligence function, or investigative consulting environment
- •Experience investigating digital-asset matters involving fraud proceeds, theft, account compromise, insider activity, social engineering, asset tracing, or complex cross-chain movement
- •Experience supporting asset recovery, law-enforcement referrals, subpoenas/legal process, civil litigation, regulatory inquiries, or other matters requiring defensible blockchain analysis
- •Experience investigating insider threats, employee misconduct, unauthorized access, data exfiltration, credential compromise, vendor fraud, conflicts of interest, or trusted-party abuse
- •Experience with OSINT, digital forensics, enterprise logs, security telemetry, or identity and access-management information
- •Experience creating custom blockchain analytics through APIs, SQL, Python, blockchain explorers, node data, or other raw-data sources
- •Relevant blockchain-specific training or certifications including certifications associated with Chainalysis, TRM Labs, or comparable blockchain-analysis platforms
- •Professional certifications such as CFE, CFCS, CAMS, GIAC, or comparable investigative, fraud, financial-crime, cybersecurity, or intelligence credentials
Benefits
- •Performance bonus
- •Long-term incentives
- •Full range of medical, financial, and/or other benefits
About OKX
OKX is the second largest global crypto exchange by trading volume and a leading Web3 ecosystem.
Victoria, Seychelles
1000 - 5000
Blockchain & Cryptocurrency