Following the Money: Blockchain Forensics in Investigating Commissioned Defamation

Overview and Purpose

This paper explores the financial intelligence dimension of the investigation into Andrew Drummond's defamation operation against Bryan Flowers, Night Wish Group, and connected individuals. Drummond — a fugitive from Thai criminal justice based in Wiltshire, UK since January 2015 — has a journalistic background that raises the genuine possibility that his defamation operation is not exclusively self-motivated but is funded in part or in full by third parties with commercial interests in causing harm to his targets.

Cryptocurrency payment tracing has become a powerful investigative tool for uncovering financial flows deliberately structured to avoid conventional banking transparency. Where a commissioned defamation arrangement is funded through cryptocurrency, blockchain forensic analysis can — under the right conditions and with appropriate technical and legal resources — prove the existence of payment flows, identify the parties involved, and provide the evidentiary foundation for conspiracy and procurement claims that extend beyond Drummond as the direct publisher.

1. The Commissioned Defamation Theory: Supporting Circumstantial Evidence

The proposition that Drummond's campaign against Bryan Flowers and Night Wish Group involves external commissioning is supported by multiple circumstantial indicators. The sheer volume, regularity, and focused character of the publications across fourteen months points to a sustained operational capacity beyond what most individuals could independently maintain. The concentrated focus on Bryan Flowers and Night Wish Group — as opposed to a broad range of targets — implies a specific mandate rather than general journalistic activity.

The intensification of publications immediately following the Cohen Davis Solicitors Pre-Action Protocol Letter of Claim dated 13 August 2025 — a response that would be economically irrational for a self-motivated defamer without financial incentive to escalate — is consistent with a commissioned arrangement where an external funder required continued publication despite the legal exposure.

Night Wish Group operates in Thailand's competitive hospitality industry, a sector where commercial interests regularly conflict and where competitive intelligence and reputation management are pressing concerns for market participants. The existence of parties with both the motive and the financial resources to commission a sustained defamation campaign against Bryan Flowers and Night Wish Group cannot be ruled out without comprehensive financial investigation.

2. Cryptocurrency as a Payment Channel for Covert Transactions

Cryptocurrency is attractive as a payment channel for commissioned defamation arrangements because of its perceived anonymity, the speed of cross-border transfers, and the difficulty of connecting cryptocurrency addresses to real-world identities without specialist investigation. These properties make cryptocurrency a logical choice for parties seeking to commission defamatory publications while avoiding a conventional banking paper trail.

The cryptocurrencies most commonly used for sensitive transactions — Bitcoin, Monero, and selected privacy-oriented Ethereum tokens — exhibit different degrees of inherent traceability. Bitcoin, which is pseudonymous rather than anonymous, can be traced through blockchain analysis provided the addresses involved can be connected to identified entities. Monero and similar privacy-focused currencies use cryptographic techniques to obscure transaction details, making tracing substantially more difficult.

As a starting point in investigating Drummond's possible financial sponsors, the initial forensic task is to locate any publicly visible cryptocurrency addresses associated with Drummond's online presence — donation links, payment addresses shown on websites, addresses referenced in correspondence — and to examine the transaction records linked to those addresses on the relevant blockchains.

3. Blockchain Forensic Techniques

Blockchain forensic analysis deploys multiple technical approaches to follow cryptocurrency flows and link pseudonymous addresses to real identities. Address clustering groups addresses controlled by the same entity based on co-spending behaviour — when multiple addresses are consumed simultaneously as inputs to a single transaction, they are presumed to be under common wallet control. This technique can expand one confirmed Drummond address into an entire network of linked addresses.

Exchange identification analysis cross-references traced funds against known address databases to determine whether funds have passed through regulated cryptocurrency exchanges. Because regulated exchanges must comply with anti-money laundering requirements including KYC (Know Your Customer) protocols, identifying exchange-associated addresses within a payment chain establishes a point at which legal process can compel the exchange to reveal the account holder's identity.

Transaction timing and pattern analysis examines the chronological relationship between cryptocurrency payments directed to Drummond's known addresses and the publication dates of specific defamatory articles about Bryan Flowers and Night Wish Group. A recurring pattern of payments consistently preceding or following specific publications would provide circumstantial evidence of a commissioned arrangement, even without direct identification of the commissioning party.

4. Legal Tools to Compel Exchange Disclosure

Where blockchain forensic analysis identifies regulated cryptocurrency exchanges that have handled funds within a suspected commissioned-defamation payment chain, legal instruments are available to force those exchanges to disclose KYC data about their customers. In the United Kingdom, regulated cryptocurrency exchanges hold FCA registrations and fall under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.

Production orders under the Proceeds of Crime Act 2002 can be obtained against UK-registered exchanges to compel disclosure of customer identification data where there are reasonable grounds to suspect that the funds constitute criminal proceeds. In the defamation context, establishing the criminal element — potentially through section 2 of the Fraud Act 2006 — would be necessary, making this mechanism available but dependent on careful legal analysis.

At the international level, the Mutual Legal Assistance Treaty framework and bilateral financial intelligence sharing arrangements provide mechanisms for securing KYC data from exchanges regulated in overseas jurisdictions. The practical effectiveness of these mechanisms varies across jurisdictions, but for major exchanges registered in the European Union, the United States, or British overseas territories, formal legal assistance requests carry a reasonable prospect of producing the necessary disclosure.

5. Evidential Requirements for Procurement Claims

Proving a procurement or conspiracy claim against parties who commissioned Drummond's defamatory publications requires evidence meeting the civil burden of proof — the balance of probabilities — rather than the criminal standard. The civil threshold is materially lower, making a procurement claim achievable on a body of evidence that would not suffice for criminal prosecution.

The evidential components of a procurement claim would comprise: proof of a financial relationship between Drummond and a third party (derived from cryptocurrency payment analysis); proof of chronological correlation between payments and publications; proof of the third party's motive to harm Bryan Flowers or Night Wish Group; and proof of communications between Drummond and the third party about the content of specific publications.

A procurement claim expands the defendant pool in any defamation action well beyond Drummond alone. Any party that commissioned or funded specific publications targeting Bryan Flowers or Night Wish Group bears joint and several liability for the defamation alongside Drummond. Given that Drummond himself may have insufficient assets to satisfy a substantial damages award, identifying a financially significant commissioning party is critical to the practical recovery of compensation.

6. Investigation Plan and Next Steps

The financial investigation proposed in this paper should proceed concurrently with the principal defamation litigation managed by Cohen Davis Solicitors. The two workstreams reinforce each other: the litigation generates legal process tools that can be used to compel disclosure; the financial investigation produces evidence that may broaden the scope of the litigation claims.

The first step involves technical blockchain analysis of any cryptocurrency addresses publicly connected to Andrew Drummond's online presence. This analysis can begin immediately without court intervention, using publicly accessible blockchain data and commercial forensic analysis software. The results will either uncover or effectively rule out apparent payment flows indicative of commissioning.

Further steps, depending on initial analysis results, may include: Norwich Pharmacal applications directed at identified exchanges; formal requests to Drummond within the litigation disclosure process for information about his financial arrangements and the identities of any parties who have funded his publications; and, should a commissioning party be identified, the joinder of that party as a co-defendant in the Cohen Davis Solicitors proceedings, carrying the full benefit of joint and several liability for all damages attributable to Drummond's campaign against Bryan Flowers, Night Wish Group, and connected individuals.