Evidence before attribution.

Start with the reported account

We distinguish a reporter’s account from information independently observed or corroborated. An allegation remains an allegation until supported by evidence. Dates, transaction references and source material help define the scope of an assessment.

Examine blockchain facts

Investigators document the network, exact address, transaction hash, time, asset and amount. Every movement recorded in the trace workspace needs a source. A visible transaction does not establish who controlled an address or why the transfer occurred.

Receiving funds, interacting with a contract or using an exchange is not proof of beneficial ownership or involvement in fraud. Exchange deposit addresses, service hot wallets, contracts, bridges and personal wallets have different functions.

Attribute with restraint

Proposed entity labels are recorded with supporting links, confidence, verification notes, analyst identity and review status. Direct first-party publication of an exact address is stronger than an explorer label. When control cannot be established, we record the uncertainty.

Cross-chain continuation requires evidence on both sides. A bridge interaction alone does not prove a destination wallet. Missing hops remain missing; we do not invent connections.

Corroborate and review

Notes distinguish reported allegations, directly observed blockchain facts, third-party claims, independently corroborated findings, hypotheses and unresolved questions. Only investigator-verified flow records appear in the case diagram.

Publication requires manual editorial approval. We document methodology, citations, limitations and responsible disclosure considerations alongside findings. Evidence hashes support integrity checks; they do not alone create a legally certified chain of custody.