Analyzing cryptocurrency payment flows has become a key forensic method in
law enforcement and is nowadays used to investigate a wide spectrum of criminal
activities. However, despite its widespread adoption, the evidential value of
obtained findings in court is still largely unclear. In this paper, we focus on
the key ingredients of modern cryptocurrency analytics techniques, which are
clustering heuristics and attribution tags. We identify internationally
accepted standards and rules for substantiating suspicions and providing
evidence in court and project them onto current cryptocurrency forensics
practices. By providing an empirical analysis of CoinJoin transactions, we
illustrate possible sources of misinterpretation in algorithmic clustering
heuristics. Eventually, we derive a set of legal key requirements and translate
them into a technical data sharing framework that fosters compliance with
existing legal and technical standards in the realm of cryptocurrency
forensics. Integrating the proposed framework in modern cryptocurrency
analytics tools could allow more efficient and effective investigations, while
safeguarding the evidential value of the analysis and the fundamental rights of
affected persons
