One of the featured speakers at the upcoming Digital Forensics Conference 2025 is Ralph Kyburz, Deputy Head of the Digital Forensics Unit at the Zurich Cantonal Police. With years of experience in cryptocurrency investigations, darknet cases, and advanced digital forensics, Kyburz shares how investigative methods are evolving alongside criminal innovation — and why close collaboration with prosecutors, judges, and the private sector is essential in the fight against cybercrime.

1. You’ve been deeply involved in cryptocurrency investigations and blockchain analysis since 2020. How have investigative techniques evolved to keep pace with the increasingly sophisticated methods criminals use to launder crypto assets?

Yes, they increase constantly. On one hand, there are many tools from the industry evolving with analysis capabilities almost daily. Also we try to keep up with the technology changes with constant education and courses for our investigation specialists.

2. Your work often intersects with darknet investigations and complex drug trafficking cases. Can you share insights into how digital forensics and crypto tracing have changed the way these cases are solved?

In the early days, the money flow was almost always with cash. With the introduction of cryptocurrencies we could detect a change in money flow. Most dealers try to adapt to new cryptocurrencies to keep themselves and also buyers behind some form of anonymity. Also, cryptocurrency flows are widely used to launder money in an efficient and easy way.

3. As an educator in network forensics and crypto investigations, what are the key skills and knowledge gaps you observe among new investigators entering this field?

Mostly new investigators lack basic knowledge about cryptocurrency. From how they work to specific use cases and forms how they can be used to obfuscate. They need a lot of time to build up their knowledge and get better at working and analyzing money flows in the digital space.

4. Building strategic relationships with prosecutors, judges, and the private sector is a clear passion of yours. How critical is this multi-stakeholder collaboration to the success of digital forensics and cybercrime investigations?

It is crucial to work and build relationships among prosecutors and judges to help them to get a better understanding of <what happened> . On the other hand, a good relationship and collaboration with the private sector is really important. They have adapted a lot of techniques and are working to get new analysis capabilities and tools, which can be used by law enforcement to keep up with the digital evolution and new techniques which law enforcement could not keep up with due to limited resources like time, personal and so on.

5. Demixing crypto asset transfers is a daily part of your work. What are the biggest technical challenges in this area, and what emerging tools or techniques show the most promise?

The biggest challenge is the rapid growth of the technology. Almost daily there are new tokens, smart contracts or even new blockchains and technologies. The quick adoption on the market and creation of new business models, bridges, exchanges and so on make it really hard to get the overall picture. Criminals adopt such new ways and try things out where we will recognise this during our investigations, losing time to understand what exactly happened and how they used this to hide their activities.