What an address cannot tell you
The chain records what moved, between which addresses, and when. Who held the keys, why they moved funds and whether they chose to all come from somewhere else.
Blockchain data is unusually complete and unusually narrow. Every transfer is there, permanently, for anyone to read. Almost everything an investigation needs to conclude is not.
What the chain records
That an amount of an asset moved from one address to another, at a particular block, paying a particular fee. That is the whole of it. The record is strong: it cannot be edited, and you do not have to trust anybody to read it.
What it does not record
- Who holds the keys
There is no name, no registration and no issuing authority. Any statement about who controls an address was inferred by somebody, or declared by somebody, and either can be wrong.
- Why the funds moved
A payment for goods, a loan, a transfer between a person’s own wallets and an extortion payment are identical on the chain.
- Whether the holder chose to move them
A transfer made under duress, or by somebody who stole the keys, is signed the same way as any other.
- The other half of the trade
Funds paid for something. What was received almost never appears on the chain.
- Who received a custodial deposit
The address belongs to the business. Which of its customers the funds reached is in the business’s records.
Where the missing half comes from
Your own records are the strongest source you hold: what the customer declared at onboarding, what they said their account was for, what they have done since. Next is the customer, who can be asked and whose answer is evidence even when it is wrong. Then the counterparty, if it is a business that will answer. Vendor attribution comes last, and comes with a date.
Three kinds of statement
| Kind | Example | How to write it |
|---|---|---|
| Observed | 412,500 USDC moved from 0x9ab3 to 0x41fe at 02:14 AEST on 7 October 2026. | State it. Quote the transfer hash. |
| Inferred | 0x41fe is a deposit address at a service holding no licence in its jurisdiction. | State it with its source and the date the source established it. |
| Unknowable from the chain | The customer intended to avoid the reporting threshold. | Never assert it. Describe the pattern and let the pattern carry the weight. |
What this changes
Chain analysis narrows an investigation. It rarely finishes one. The question to carry into every case is which of your conclusions rest only on the chain, because those are the ones that will need something else behind them before anybody signs.
Related
Addresses and wallets
An address is a destination that anyone can create, for free, without telling anybody. Everything else said about one, including who owns it and what it is for, was added later by somebody making an inference.
How to run a case
How to scope an investigation, what order to establish facts in and how to tell when you have enough.
Last checked against the product on .