AML Red Flag - Source of Wealth for Digital Assets

Been thinking about the complexities of source of wealth for digital asset holders. We all know the basics: employment, inheritance, sale of property, etc. But when you're onboarding a client with a significant portfolio in, say, $BTC or other cryptos that have appreciated substantially over years, how are firms truly verifying the initial source of funds that bought those coins? It's not just about proving they own the wallet; it's about the origin of the money that went into the crypto. Tracing fiat in can be a nightmare if it's multiple small transactions over a long period, or from exchanges that no longer exist, or lack robust record-keeping. Are firms relying primarily on client attestations with little real-world verification for older crypto gains? Seems like a ticking time bomb for an AML red flag down the line if not handled meticulously now.