Blockchain transaction tracing and on-chain analysis

Tracing is the reconstruction of how value moved across a blockchain, starting from an address or a transaction hash and following the flow outward. Public chains record every transfer permanently, but the raw record is a list of hashes and amounts with no structure. Tracing turns that into an ordered account of what left an address, where it went at each hop, where it was converted or bridged, and where it came to rest. The output is an analysis, not a database export.

Screening checks one address against a risk database and returns a score or a label. It is fast, automated, and shallow: it tells you what is already known about that address, and nothing about the funds themselves. Tracing follows the actual transaction path across hops, chains, and conversions to establish where value came from and where it went. Screening is a filter you run on everything. Tracing is what you do when the filter flags something, or when the answer matters enough to justify the work.

Clustering groups addresses that appear to be under common control. The main heuristics are co-spending, where several inputs signed into one transaction imply one key holder, and behavioural patterns such as change address selection, consistent fee settings, timing, and reuse of infrastructure. These are inferences, not proofs. Co-spend logic is strong on Bitcoin and much weaker on account-based chains. Heuristics can be defeated deliberately, and shared custodial wallets can produce a cluster that spans thousands of unrelated users. We state which heuristic supports each cluster and how confident we are in it.

Sometimes, and only with qualification. Attribution comes from linking on-chain behaviour to off-chain information: known deposit addresses at exchanges and services, published or leaked address disclosures, addresses named in enforcement actions, contract deployments, and public claims by the owner. Where the funds reach a regulated venue, the venue knows the account holder even though we do not, which is the usual route to a real identity through legal process. Where attribution rests on inference, we say so and describe what would be needed to confirm it.

Yes, and it is the part of the work that most often decides whether a trace is useful. Value routinely leaves one chain through a bridge, arrives as a wrapped asset on another, and is swapped through a decentralised exchange before moving on. Each of those events breaks a naive trace, because the outgoing and incoming transactions are separate records on separate ledgers. We match them using bridge contract events, message identifiers, timing, and amount reconciliation net of fees. Many traces are abandoned at exactly this boundary and reported as a dead end when they are not one.

Usually the trace ends there, and we say so rather than presenting a guess as a finding. A mixer is designed to break the link between deposit and withdrawal, and privacy-preserving chains hide amounts and parties at the protocol level. Partial results are sometimes available: unusual amounts, poor timing discipline, or reuse of the same withdrawal pattern can support a probabilistic link, and deposits into a sanctioned service are themselves a finding worth recording. But we distinguish clearly between a traced path and a suspected one, and we will not sell continued analysis past the point where it stops producing evidence.

A written analysis setting out the scope, the methodology, the data sources, the findings, and the limitations. Flow-of-funds diagrams showing the path visually at a level a non-technical reader can follow. Transaction schedules exhibiting every hop relied on, with hashes, timestamps, amounts, and chains, so that anyone can verify the underlying data independently. Where the analysis may be used in proceedings, a documented chain of custody over how each item of evidence was obtained and preserved.

At minimum one starting point: an address, a transaction hash, or an exchange deposit reference, plus the chain it sits on. Anything else narrows the work and reduces the cost: dates and amounts, the counterparty name if you have one, invoices or contracts, exchange statements, and the question you actually want answered. That last item matters more than people expect. "Is this counterparty exposed to sanctioned entities" and "where did these funds originate" are different analyses on the same data.

Bitcoin, Ethereum and the major EVM networks, the principal non-EVM chains used to move value at scale, and the stablecoins and tokens issued across them. Coverage matters less than continuity: the practical test is whether an analysis can follow value through a bridge and a swap onto a chain it did not start on, and report it as one flow rather than several unconnected fragments.