Investigating Crypto Wallets and NFTs on Facebook: A Step-by-Step OSINT Guide with a Real-Life Story
The world of cryptocurrency and NFTs (Non-Fungible Tokens) is vast and complex, and uncovering information about these digital assets requires a mix of skill, creativity, and the right tools. Social media platforms, particularly Facebook, serve as a treasure trove for investigators looking to learn more about crypto wallet addresses, NFT collections, and the networks surrounding them. In this guide, we will start by walking you through a comprehensive approach to utilizing Open Source Intelligence (OSINT) techniques for investigating crypto wallets and NFTs on Facebook. From exploring profiles and groups to diving into live streams and Facebook Marketplace listings, we’ll cover a variety of methods to help you navigate this space.
I’m excited to announce the release of my new book,
Cryptocurrency Investigations: A Step-by-Step Guide to Tracing Digital Assets and Tracking Down Their Owners. Check it out on Amazon: https://www.amazon.com/dp/B0DJ1BN7ZM
This comprehensive guide is designed to help investigators, analysts, and anyone interested in the crypto space navigate the complexities of tracing digital assets and uncovering the identities behind them. Whether you’re new to crypto or a seasoned investigator, I hope you’ll find valuable insights and practical strategies inside.
But theory alone is never enough. To show how these techniques work in the real world, we'll also dive into a practical example: an investigation conducted by one of my colleagues (with names and identifying details changed for privacy). This case study will showcase how these OSINT methods were used to follow a trail of crypto activities across Facebook, revealing the power of digital sleuthing and providing actionable insights for anyone interested in conducting similar research.
So, whether you're just getting started with crypto investigations or looking to sharpen your skills, this guide is packed with both strategies and real-life application. Let's jump in!
How to Investigate Crypto Wallets and NFTs on Facebook Using OSINT Techniques
Open Source Intelligence (OSINT) has become a powerful method for digging into publicly available data online. When it comes to investigating crypto wallets and NFTs (Non-Fungible Tokens) on platforms like Facebook, a systematic approach is crucial. Here, we'll walk through a structured way to leverage OSINT techniques to uncover details about wallet addresses, NFT projects, and user connections, all using Facebook's rich trove of public data.
1. Profiles and Pages: Hunt for Relevant Information
Identify Profiles and Pages Connected to Crypto Wallets or NFTs
Start by using Facebook's search bar effectively. Keywords like “MetaMask,” “Coinbase,” “crypto wallet,” or even blockchain-specific terms can uncover profiles or pages that are directly involved in crypto and NFTs. Use NFT-related terms like “NFT artist,” “NFT collector,” or the names of popular NFT projects to find artists, collectors, or teams promoting their work.
Look for Personal Profiles, Public Pages, and Groups: Many NFT creators, crypto enthusiasts, and NFT project teams openly display wallet addresses or share their NFT collections on Facebook. Profiles might feature linked crypto marketplaces or include wallet addresses.
Utilize Search Filters: Facebook's search filters (posts, people, photos, videos) allow you to refine your results to find posts about crypto wallets, NFT drops, or blockchain technology.
Examine Publicly Shared Content and Media
Scroll through posts, photos, and videos for any mentions of wallet addresses, transaction screenshots, or QR codes linked to wallet addresses. Users often showcase their NFTs, recent acquisitions, or even share images of their crypto wallet balances.
Check the Comments Section: A wealth of discussions around wallet addresses, NFT sales, or crypto transactions can be found here. Additionally, users might be tagged in posts related to specific transactions or NFT projects, providing more leads.
2. Facebook Groups and Communities: Dig into Public and Private Discussions
Explore Public Crypto and NFT Groups
Facebook hosts many active groups dedicated to crypto trading, NFT discussions, and blockchain technology. Public groups are open for anyone to see and are a great source of information on wallet addresses, NFT collections, new releases, and even scams.
Find the Right Group by Searching the Right Keywords: Use terms like “crypto trading,” “NFT marketplace,” or “blockchain discussion” to locate groups with regular discussions about the crypto space.
Private and Closed Groups as Potential Goldmines
While private and closed groups require permission to join, their public descriptions or cover images may hint at wallet activities, NFT project details, or other useful information.
Check Group Descriptions and Pinned Posts: Some private groups display hints of the discussions happening inside, such as recent NFT drops, crypto trading strategies, or wallet connections.
3. Facebook Marketplace and Product Listings: Search for NFTs Being Sold or Promoted
Hunt Down NFTs on Facebook Marketplace
NFTs sometimes appear as listings on Facebook's own marketplace. Use keywords like “NFT,” “crypto art,” or specific project names to filter relevant listings.
Look for Wallet Information and Seller Details: Listings may include wallet addresses for payment, verification purposes, or links to other platforms like OpenSea. It's also wise to view the seller’s profile for any crypto-related content they may share.
Identify Pages Offering Crypto Services
Search for pages related to NFT minting, crypto trading, or wallet services. These pages often have posts promoting NFTs, offering minting services, or linking to wallet addresses.
Look for Advertisements and Promotional Content: Posts and ads might detail NFT drops, new wallet services, or events where further details about wallet addresses or projects can be found.
4. Monitoring Social Interactions: Reactions, Shares, and Likes
Analyze Reactions to Crypto and NFT Content
Identify users who actively engage with posts about crypto wallets or NFTs by liking, sharing, or reacting. People who are open about their crypto activities might provide wallet addresses or additional details in their comments.
Identify Influencers and Key Promoters
Influencers often share their own NFT projects or promote others. They may openly provide wallet addresses to receive payments or showcase their collections. Additionally, these influencers might have profiles on other social media platforms, expanding your investigation.
5. Facebook Live and Video Content: Discover Real-Time Discussions and Webinars
Tune into Facebook Live Sessions and Recorded Videos
Live streams and recorded sessions about crypto trading, wallet management, and NFT promotions are goldmines for real-time information. Speakers sometimes reveal wallet addresses, discuss transactions, or hint at upcoming NFT drops.
Monitor Live Chat and Comments: Real-time sharing of wallet addresses, external links to crypto services, and other valuable information often occur in the comment sections of these videos.
6. Links to External Platforms and Marketplaces: Make Cross-Platform Connections
Spot Mentions of Crypto Wallets or NFT Marketplaces
Profiles, posts, or pages may include external links to crypto marketplaces or wallet services like OpenSea, Rarible, or MetaMask. These links can lead to the wallet addresses or collections linked to the Facebook users.
Cross-Reference Wallet Addresses on Blockchain Explorers: Platforms like Etherscan or BSCScan can verify wallet addresses and their associated transactions, providing further insights into the user's crypto activities.
7. Advanced Search Techniques and Facebook Graph Search
Leverage Facebook's Advanced Search Options
Perform advanced searches within Facebook or through search engines like Google. Use phrases like site
.com "wallet address" or "ETH address" to pinpoint specific wallet addresses mentioned across Facebook.
Use Keywords and Filters for Precise Searches: Though Facebook Graph Search is no longer available in its original form, you can still perform refined searches using combinations of keywords, dates, or locations to narrow down results.
8. Analyze User Patterns and Behavior: Connect Wallets and NFTs
Watch Posting Patterns and Content Themes
People heavily involved in the crypto world may frequently post about their trades, NFT acquisitions, or wallet updates, often using hashtags like #NFT, #cryptoart, or #blockchain. Tracking these behaviors helps identify wallet addresses or NFT activities.
Build Networks of Connected Users
Investigate friends lists or followers of users frequently posting about crypto or NFTs. This can help uncover networks of people involved in similar projects or communities.
9. Track Public Events and Webinars on Cryptocurrency and NFTs
Investigate Public Crypto and NFT Events
Facebook events related to cryptocurrency and NFTs often draw people actively involved in the space. Look at event pages for details on attendees, hosts, and discussions that could contain shared wallet addresses or project details.
The Case of the Missing NFTs: A Real-Life Facebook Investigation
Jake had never imagined his passion for open-source intelligence (OSINT) would lead him into the chaotic world of NFTs. As a cyber investigator who relished uncovering hidden data online, Jake was used to peeling back the digital curtains of the internet. But this time was different. He wasn’t on a typical case. A friend had recently fallen victim to an NFT scam, losing several hundred dollars to a fraudulent seller on Facebook. Jake’s curiosity was piqued, and he decided to dig in, not just to help his friend but to see how deep this rabbit hole went — and how much public information he could uncover on Facebook.
Profiles and Pages: The Starting Point
Jake started with a straightforward goal: find crypto wallet connections on Facebook. He began by searching for terms like "NFT artist," "crypto wallet," and "ETH address." The results were overwhelming — hundreds of pages, groups, and profiles surfaced, filled with discussions about digital art and cryptocurrency.
One profile quickly stood out — a public figure named "CryptoCrane," an NFT artist with over 10,000 followers. CryptoCrane posted daily about his NFT art pieces, minting new tokens, and engaging in discussions about the crypto world. As Jake scrolled through the posts, he noticed a recurring pattern. Each piece of digital art came with a story, an ETH wallet address, and a flurry of comments with wallet addresses from buyers congratulating one another. To most, it seemed like an ordinary NFT sale. But to Jake, this was a key lead.
He made note of CryptoCrane’s ETH wallet address, which was prominently shared in the comments. He didn't stop there; he also checked comments for tagged users, noting any additional wallet addresses shared. As he continued his search, Jake started to wonder how interconnected these users might be.
The Group Deep-Dive
Jake knew that in any online community, the real conversations often happen in groups. Using Facebook’s search feature, he hunted for public groups that were hubs for crypto and NFT discussions. Terms like "crypto trading," "NFT marketplace," and "blockchain buzz" led him to groups with tens of thousands of members.
He joined a few public groups to observe the conversations. There, members openly shared their wallet addresses for trades, sold NFTs directly, and asked for advice on handling transactions. One post by a user named "TokenKing" stood out. TokenKing had shared an eye-catching piece of digital art and was offering it for sale in exchange for ETH, openly providing his wallet address in the post.
Jake immediately took note. The comments were filled with excited potential buyers posting their own wallet addresses, saying they had just sent payment. Curious to know more, Jake dug into TokenKing’s profile and found multiple posts flaunting wallet balances and transaction records, projecting both confidence and a bit of flashiness.
The Marketplace Mystery
Jake’s next move was to visit Facebook Marketplace, which had a hidden niche of NFT sellers. Searching for terms like "crypto art," "NFT for sale," and "ETH trade," he stumbled upon collections of digital items priced as high as $10,000 in ETH. Each listing came with details of the art, sometimes an embedded wallet address for payment, and a link to the seller’s profile.
One seller, “PixelMaster,” particularly stood out. Offering “limited-edition NFTs,” the seller claimed only three copies were available, each priced at 1 ETH. The profile was filled with posts about new NFT drops, crypto memes, and market discussions. The posts had high engagement, with dozens of comments and shares. Some comments even showed buyers confirming transactions.
Jake jotted down PixelMaster’s wallet address and checked recent listings, documenting all transaction details that could lead to a larger connection.
Analyzing Social Interactions
Jake knew the NFT community thrived on word-of-mouth recommendations and influencer hype. He began analyzing posts by looking at who was liking, sharing, and commenting on crypto content. One influencer, "Blockhead," was especially vocal about promoting NFT projects. Blockhead would often be the first to react to new drops, resharing content with his own commentary and directing his audience to “hot new collections.”
Blockhead wasn’t just an NFT promoter; he also openly shared his ETH address for "collaborations" and encouraged followers to send ETH for “early access” to limited-edition NFTs. The comments and engagements were massive, with dozens of people confirming transactions and sharing their own wallet addresses as proof.
Jake added Blockhead’s address to his list, alongside those of several active followers. Who were these people sending ETH, and could they be connected to a broader scam?
Facebook Live and Video Content
Facebook Live was another avenue Jake explored. He found that NFT projects were often hyped through live videos, with hosts sharing new collections, discussing market trends, and promising giveaways. Jake tuned into a live session called “The Next Big NFT Project,” hosted by a page named "Artify."
The hosts raved about a new NFT collection, sharing wallet addresses in the comment section for pre-sales and offering real-time promotions. Viewers joined the chat, sharing their wallet addresses and participating in discussions — some confirming they had sent ETH to secure early access to the new collection. Jake noted all the addresses shared, as they could be crucial in tracking down transaction histories later.
One user, “NFTDream,” was highly active in the comments, promoting his own collection and repeatedly posting his wallet address. Jake added this lead to his growing collection of evidence.
Cross-Platform Connections and Verification
Armed with a list of wallet addresses, Jake decided to take his investigation off of Facebook. He cross-referenced these addresses on popular crypto marketplaces like OpenSea and Rarible. A search of CryptoCrane’s address led to a sizeable portfolio of NFTs — many of which had been sold, with transactions that could be traced.
One wallet address, belonging to PixelMaster, had a long list of recent transactions on OpenSea. While most sales seemed legitimate, some stood out: high-value transactions for obscure NFTs with hardly any description. Could these be part of a larger scheme to inflate prices or launder money?
Jake also used blockchain explorers like Etherscan to follow the flow of funds. One wallet, linked to both TokenKing and Blockhead, had been flagged by the Etherscan community as potentially connected to a scam. The more Jake cross-checked, the more the puzzle pieces began to fall into place.
Analyzing Patterns and Building the Puzzle
As Jake mapped out the connections, a pattern began to form. The same handful of wallet addresses appeared repeatedly — sending or receiving ETH from the same third-party wallets, often at the same time. The profiles promoting these NFTs seemed to be working together, sharing posts in a coordinated manner to build hype around certain NFT drops.
Jake compared timestamps and saw that users would simultaneously post about a new NFT, often using hashtags like #NFTdrop or #cryptoart to pull in a wider audience. It felt like an orchestrated effort to boost sales, artificially inflate prices, and then vanish once they had made enough money.
Connecting the Dots at Events
To further expand his investigation, Jake searched for Facebook events related to NFTs and cryptocurrency. He found multiple upcoming webinars hosted by NFT communities, with publicly visible attendee lists. There, he found familiar names: CryptoCrane, Blockhead, and even PixelMaster. Jake also spotted that TokenKing was listed as a speaker for an event about “the future of NFTs.”
These events provided opportunities for Jake to identify even more wallet connections and potentially link real-world people to their digital activities. By attending these events, Jake hoped to gain deeper insight into how these individuals interacted and promoted their NFT projects.
The investigation had taken Jake deep into the underbelly of Facebook’s NFT community. After weeks of research, he compiled an extensive map of Facebook profiles, wallet addresses, and NFT sales. His findings confirmed what he had suspected all along: coordinated efforts to pump up the value of NFTs, obscure transactions between connected wallets, and a pattern of suspicious behavior that suggested organized scams.
Though Jake knew that completely stopping these scammers was nearly impossible, he felt a sense of accomplishment. His findings were shared widely within the crypto community, and he helped educate others on what to look out for — turning his detective work into a story that warned and empowered others.
For Jake, it was clear that as long as there was digital gold to mine, there would be digital thieves to hunt. But now, armed with his skills and the power of OSINT, he was ready for whatever case came next.