We Started Building Before the Problem Statement Existed

How a question about the dark web, a broken crawler, and four scattered side projects led three college students to India’s first police hackathon

When I walked into CipherCop, India’s first police hackathon, I immediately felt out of place.

I looked around the room and saw cybersecurity professionals, founders, researchers, industry veterans, MBA graduates, and people who had spent years working on real world security challenges. Many of them had more experience than I had years in college. As a third year engineering student, I was probably one of the youngest participants there. For a brief moment, I wondered whether we truly belonged in that room.

Then I remembered why we were there.

Out of more than 1,000 teams from across the country, only 30 had been selected as finalists. Getting there was not easy. The selection process demanded more than an idea , teams had to submit a working prototype, technical documentation, a demonstration video, and a GitHub repository. You couldn’t simply talk about a solution. You had to build one.

For many teams, CipherCop marked the beginning of a project. For us, it was something else entirely. It was the continuation of a journey that had started months before the hackathon was even announced. When the official problem statement turned out to be tracing illicit cryptocurrency activity, it felt strangely familiar. We weren’t starting from scratch. We were continuing a story that had already begun.

A Question That Refused to Leave My Mind

Like many students interested in cybersecurity, I spent a lot of time exploring topics that never made it into a classroom. One topic kept pulling me back: the dark web. Not because it was mysterious, and not because it felt forbidden , but because it represented a part of the internet most people never explore.

The deeper I went, the more a pattern kept repeating. Whether I was reading about ransomware attacks, financial fraud, underground marketplaces, or cybercrime investigations, cryptocurrency always seemed to show up somewhere in the story. Money was moving. People were hiding. And cryptocurrency was often the bridge connecting the two.

At first, blockchain investigations sounded almost too simple. Blockchains are public. Every transaction is recorded, every wallet address visible, every transfer leaves a trail. It seemed like the perfect system for tracking activity.

Then I started looking at real data, and that assumption disappeared fast.

The challenge was never a lack of information. The challenge was understanding what that information actually meant. A wallet address could carry millions of dollars in transactions and still tell you almost nothing about the person controlling it. A transaction trail could look completely ordinary while quietly hiding a sophisticated laundering operation. Everything was visible, and yet so much remained hidden.

That contradiction fascinated me. How could a system be completely transparent and still feel impossible to understand? That question stayed with me for months, long before I knew it would eventually become a hackathon problem statement.

The Project That Started as an Experiment

The first version of our work looked nothing like what eventually became ChainBreak. There were no dashboards, no visualisations, no machine learning models. There was only a crawler, a simple one, built to pull information from both the surface web and the dark web.

At the time, we were just curious. Could meaningful intelligence be gathered from places specifically designed to be difficult to explore? We didn’t have a product in mind. We didn’t have a competition to prepare for. We were simply following a question we found interesting and seeing where it led.

Our original hypothesis seemed reasonable enough: any cryptocurrency address appearing on the dark web was likely connected to illicit activity. If a wallet was being shared on underground forums, hidden marketplaces, or anonymous services, surely there had to be something suspicious about it.

The more data we collected, the more that assumption fell apart. Some addresses were genuinely worth investigating. Others belonged to researchers, privacy conscious users, legitimate services, or discussions that had nothing to do with crime at all. Simply finding an address on the dark web wasn’t evidence , it was only a lead. That single realisation changed how we approached everything afterwards. Instead of asking where an address appeared, we started asking how it behaved, who it interacted with, and whether its transaction patterns revealed something meaningful.

Of course, getting to that point was far from smooth.

The crawler seemed determined to break the moment we made progress. Configuring Tor became its own adventure , what looked like a simple setup routinely turned into hours of debugging connection issues, routing problems, and failed requests. Solve one issue, and another would appear right behind it. And even once the crawler was running cleanly, a new obstacle showed up: rate limits. As students, we relied heavily on free blockchain APIs, which meant every request had to be used carefully. More than once, our entire data pipeline stalled , not because of a bug, but because we’d simply burned through our daily quota. There were days we spent more time keeping the infrastructure alive than analysing what it produced.

Looking back, those frustrations taught us something the textbooks never did: research is rarely a straight path. Progress usually comes from rebuilding systems that refuse to cooperate, again and again, until they finally do.

Despite all that, the crawler slowly started producing results. We spent countless hours collecting data, cleaning it, filtering noise, and trying to figure out whether any of it actually meant something. Sometimes we’d chase an idea for days only to find it led nowhere. Other times, a small, almost throwaway observation would completely change our direction.

One of those observations was about wallet addresses. At first, they looked like isolated data points scattered across different sources, with no clear connection to one another. But the more we examined them, the more a pattern emerged. Wallets interacted with other wallets. Transactions created relationships. Groups of addresses started behaving in strikingly similar ways. What had looked like scattered noise was slowly revealing structure, clusters, pathways, and entire communities of activity hiding inside what we’d assumed was randomness.

That was the moment our thinking changed. We stopped focusing on wallets. We started focusing on connections.

When Transactions Became Stories

Most people imagine blockchain investigations as following money from one wallet straight to another. Reality is far messier. A suspicious wallet rarely exists in isolation , it’s connected to dozens, sometimes hundreds, of other wallets, which themselves interact with exchanges, services, marketplaces, and entirely separate networks. The real story isn’t inside a single transaction. It lives in the relationships between them.

That realisation is what pushed us toward graph analysis. Instead of treating transactions as rows in a database, we started treating them as networks of connected entities, and suddenly things started making sense. Patterns that had been invisible before began surfacing. Clusters formed. Communities emerged. Certain wallets served as bridges connecting entire groups. What had looked like chaos often contained structure. What had looked random often contained intent, and that intent told a story.

The more we explored these networks, the more convinced we became that investigators didn’t have a data problem. They had a context problem.

Four Separate Projects, One Vision

As months passed, we found ourselves running four mostly independent systems: one for data collection, one for blockchain analytics, one for graph analysis, and one experimenting with machine learning. Each one solved a different piece of the puzzle. Each generated genuinely valuable insight. But they operated separately, like four people working on the same case without talking to each other.

The breakthrough came when we stopped asking how to improve each project individually and started asking a bigger question instead: what if they worked together?

That question became ChainBreak.

The idea behind it was simple, investigators don’t need more information, they need better ways to understand the information they already have. ChainBreak brings blockchain analytics, graph intelligence, anomaly detection, visualisation, and explainable risk scoring into a single investigative workflow, so analysts aren’t stuck manually inspecting thousands of transactions one at a time. It surfaces the patterns and relationships that actually matter, and instead of just slapping a risk score on a wallet, it can explain why that wallet looks suspicious in the first place.

Graph Visualisation in Neo4j

The goal was never to replace investigators. It was to help them focus on what matters most.

Following the Money

One of the most fascinating things about blockchain investigations is that while people can hide their identities fairly easily, hiding the movement of money is much harder. Every transaction leaves a trace. Every wallet interacts with other wallets. Every transfer creates a relationship that gets permanently recorded on the chain. The challenge isn’t finding the data, it’s making sense of it.

A scammer or money launderer rarely sends funds straight from a victim’s wallet to a final destination. Instead, money tends to move through a tangle of intermediary wallets designed specifically to make tracing difficult. Looked at transaction by transaction, these movements can seem random. Looked at as a network, patterns start to emerge.

During our research, we examined several laundering techniques commonly used in blockchain forensics. In a peel chain, a wallet holding a large balance sends out small portions repeatedly instead of moving everything at once , each transfer “peels” a sliver of funds away while the trail grows longer and harder to follow. In smurfing, a large sum gets fragmented across many smaller transactions and wallets; individually, they look insignificant, but together they form one much larger operation. Layering pushes funds through multiple wallets and paths purely to add complexity, making the original source harder to trace. And mixing services combine transactions from many users before redistributing them, useful for legitimate privacy but also a convenient way to obscure the link between money going in and money coming out.

Spotting these patterns by hand is close to impossible at scale. An investigator might be staring down thousands of wallets and millions of transactions, with no easy way to tell whether something unusual is actually happening. This is exactly where graph analysis earned its place in our work. By treating wallets as nodes and transactions as edges, we could turn an overwhelming pile of blockchain data into a network you could actually explore, visually and analytically. Isolated transactions became connected pathways. Clusters of wallets emerged. Certain nodes emerged as bridges between communities, while others served as central hubs for the movement of funds. Insights like that are nearly impossible to catch by reading transactions one row at a time.

In many ways, a blockchain investigation resembles a puzzle. Every transaction is a piece. Every wallet is a clue. Individually, they don’t say much. But once enough pieces come together, a much clearer picture starts to form.

Why Risk Scores Matter

One of the biggest challenges in blockchain investigations is simply deciding where to start. Investigators often have access to thousands of wallet addresses and millions of transactions. The data is public, but its sheer volume makes prioritisation genuinely hard, and manually chasing every possible lead just isn’t realistic.

That’s the problem our risk scoring mechanism was built to solve. Rather than relying on one signal, the score blends several: transaction behaviour, position within the wallet network, exposure to suspicious entities, community-level patterns, and other contextual factors. The point was never to label a wallet “criminal” or “legitimate” , real investigations are rarely that clean. The point was to help investigators know which addresses deserve a closer look and where their time would have the most impact.

Just as important to us was making the score explainable. A number on its own doesn’t help much. Investigators need to know why a wallet got flagged, which behaviours fed into the score, and which connections shaped it , even an accurate prediction is hard to trust. For us, transparency mattered as much as accuracy. The system was never meant to replace human judgment. It was meant to support it, by turning an avalanche of blockchain data into something an investigator could actually act on.

The Conversations That Changed My Perspective

As exciting as the technology was, my favourite part of CipherCop had very little to do with software. It was the people.

For the first time, I got to talk directly with police officers, cybersecurity professionals, researchers, founders, and participants working on real security problems. While the competition itself centred on building solutions, some of my most valuable takeaways came from the conversations happening between presentations, the moments people shared what it actually felt like to tackle problems very different from mine.

As students, we tend to approach challenges through a technical lens, algorithms, models, architectures, and performance metrics. Law enforcement approaches the same challenges in completely different ways. Their focus isn’t on building systems; it’s on helping victims, collecting evidence, identifying criminals, and ultimately closing cases. Listening to discussions about online fraud, financial crime, digital investigations, and social media scams was genuinely eye opening. Problems that seemed straightforward from a technical standpoint became far more complex once you saw them through the lens of an actual investigation.

One conversation has stuck with me ever since. We were talking about scams run through Instagram and other social platforms. The discussion began with technology and digital footprints but quickly shifted to attribution, evidence collection, legal procedure, and prosecution. Something clicked for me right there. Behind every suspicious wallet is a person. Behind every fraudulent transaction is a victim. And behind every successful investigation is a team piecing together fragments of digital evidence to find the truth. That conversation reshaped how I think about cybersecurity, technology is only one part of the solution. The real objective isn’t building impressive systems. It’s solving real problems for real people.

I was just as impressed by the other participants. CipherCop ran two tracks, ours focused on tracing illicit cryptocurrency activity, while the second tackled fraudulent websites, malicious apps, and deceptive digital content using AI. Some of those presentations were genuinely remarkable: phishing detection, malicious app analysis, manipulated content detection, real time scam protection, each team arriving at a completely different solution to a similar problem. Some leaned heavily on machine learning, others on behavioural analysis or threat intelligence. It reinforced something CipherCop kept demonstrating all day: innovation rarely comes from a single perspective. The strongest ideas emerge when people with diverse backgrounds tackle the same problem from different angles. It was genuinely hard to walk out of any session without learning something new.

The Presentation I Will Never Forget

There’s one moment from CipherCop I’ll probably remember for years, and it isn’t the acceptance email, the final results, or even the months of building ChainBreak. It’s the presentation itself.

Out of all the finalist teams, we were scheduled third. At first, that didn’t seem like a big deal. Then the event started, and I realized exactly what it meant , no chance to sit through other presentations and read the judges’ style, no opportunity to adjust based on what other teams had done. We hadn’t even fully settled into the room before it was our turn. Months of research, experimentation, and preparation, compressed into a few slides and a short window of time.

Sitting there waiting, I looked around at the level of talent in the room , cybersecurity professionals with years of real world experience, researchers deep in their domains, and founders building genuinely innovative solutions. Despite being a third year engineering student, I found myself in conversations with people whose experience dwarfed mine. It was inspiring and slightly intimidating in equal measure.

Naturally, there were nerves. My teammates and I knew exactly how much had gone into this, the failed experiments, the broken crawlers, the API limits, the wrong assumptions that forced us to rethink the entire approach, the late nights spent untangling blockchain transactions and graph structures. All of it had led to this moment.

I expected the pressure to hit the second I walked toward the stage. Instead, the nerves disappeared the moment I started speaking. Looking back, the reason was simple: I wasn’t presenting a project I’d built for a competition. I was telling a story I had actually lived. Every slide represented a challenge we’d faced, a lesson we’d learned, or a breakthrough that changed how we understood the problem. I wasn’t reciting a script , I was sharing the journey that had brought us there. I talked about how curiosity about the dark web pulled us into blockchain investigations, about building a crawler with no idea where it would lead, about finding wallet addresses buried in our data and slowly realising the real value wasn’t in the addresses themselves but in the relationships between them. I explained how four scattered experiments converged into ChainBreak, and why the problem mattered in the first place.

For those few minutes, I stopped thinking about rankings or judging criteria entirely. It felt less like a presentation and more like a conversation about a problem that had fascinated us for months. When it ended, and the room applauded, I felt relief, gratitude, and something close to validation, proof that the late nights, the failed experiments, and the frustrating setbacks had all been worth it.

What makes that moment stick with me isn’t the presentation itself, it’s what it represented. A simple question had become curiosity, curiosity had become research, research had become a project, and that project had become a platform standing on a stage before investigators and innovators from across the country. For a brief moment, the entire journey came full circle, and it reminded me exactly why I’d started exploring this space to begin with.

Looking Ahead

One question we got asked over and over at CipherCop was simple: how would an investigator actually use this?

Picture a victim reporting a crypto scam. Often, the only lead at the start of an investigation is a wallet address, at first glance, nothing more than a random string of characters. But behind that address sits an entire network. By treating wallets as nodes and transactions as connections, investigators can trace how funds move, identify clusters of related entities, surface suspicious transaction paths, and reveal relationships that wouldn’t otherwise be visible. A single wallet can expand into dozens of connected addresses, each one adding another piece to the story. That idea sits at the heart of ChainBreak, never built to replace investigators, only to turn an overwhelming flood of blockchain data into something a human can actually understand and act on.

Beyond the technology, CipherCop taught me something I didn’t expect: building software is hard, but understanding the problem is harder. Over the course of the event, I talked with students, researchers, entrepreneurs, cybersecurity professionals, and law enforcement officers, and each group approached the same challenge from a completely different angle. The clearest lesson was that meaningful innovation rarely comes from a single discipline, it shows up when people with different experiences come together around the same problem.

ChainBreak is still evolving. There are new capabilities to build, new investigative techniques to explore, and new challenges to take on as blockchain ecosystems continue to grow in scale and complexity. There’s still a tremendous amount left to learn.

One aspect of cryptocurrency investigations that often gets overlooked is the role of centralised exchanges. While blockchain transactions themselves are irreversible, many illicit funds eventually pass through regulated exchanges, where users convert crypto to fiat or move assets between platforms.

For investigators, identifying these exchange touchpoints can be critical. By tracing transaction paths and determining where funds enter or exit an exchange, law enforcement can establish investigative leads, request account information through appropriate legal channels, and, in some cases, work with exchanges to intervene before funds are withdrawn or moved further. The first few hours after a scam or theft are often especially important, as funds may still be moving through identifiable pathways before they become significantly harder to trace.

This is another reason graph-based analysis matters. It’s not only about understanding where money came from; it’s about understanding where it is going, which entities it interacts with along the way, and where meaningful intervention opportunities may exist.

But the biggest lesson from this whole journey has nothing to do with blockchain analytics, graph databases, or machine learning. It’s that some of the most meaningful projects begin long before there’s a competition, a grant, or even a problem statement. They begin with curiosity, a question that simply refuses to leave your mind.

For us, that question started simply: how do you trace activity designed to stay hidden?

We still don’t have all the answers. But that question carried us from late night experiments and broken crawlers all the way to India’s first police hackathon, conversations with investigators, and the chance to build something that might, even in a small way, contribute to the future of digital investigations.

And in many ways, the journey is only just beginning.