[{"data":1,"prerenderedAt":5060},["ShallowReactive",2],{"tag-blockchain-tracing":3},[4,813,1527,2072,2595,3619,4241,4638],{"_path":5,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":9,"description":10,"slug":11,"date":12,"lastUpdated":12,"author":13,"readingTime":14,"category":15,"tags":16,"ogImage":21,"featured":7,"body":22,"_type":807,"_id":808,"_source":809,"_file":810,"_stem":811,"_extension":812},"\u002Farticles\u002F23-sanctions-blockchain-tracing-ofac-match-evidence","articles",false,"","Sanctions and blockchain tracing: What an OFAC match proves","How attorneys should distinguish OFAC-listed addresses, vendor attributions, indirect transaction paths, ownership rules, and risk-score evidence.","sanctions-blockchain-tracing-ofac-match-evidence","2026-09-19","Nick Kampe",13,"Legal Reference",[17,18,19,20],"ofac","sanctions","blockchain-tracing","evidence","\u002Fog\u002Fsanctions-blockchain-tracing-ofac-match-evidence.png",{"type":23,"children":24,"toc":782},"root",[25,33,38,45,50,75,80,94,108,114,121,135,147,161,166,172,177,190,196,219,233,238,244,249,263,276,282,287,300,306,311,356,368,382,388,393,442,455,476,482,487,492,504,510,524,529,543,556,562,567,572,577,583,687,693,699,709,715,724,730,739,745,754,760,769],{"type":26,"tag":27,"props":28,"children":29},"element","p",{},[30],{"type":31,"value":32},"text","A blockchain tracing report says a wallet is “connected to a sanctioned exchange.” That phrase may describe an exact address published by the U.S. Department of the Treasury's Office of Foreign Assets Control, a commercial attribution to a listed person, an indirect transaction path, or a vendor-generated risk score. Those findings are not interchangeable.",{"type":26,"tag":27,"props":34,"children":35},{},[36],{"type":31,"value":37},"A public blockchain can establish transactions between addresses. It does not, by itself, establish who controlled an address, who owned the property, what a party knew, which sanctions authority applied, or whether a transaction was prohibited. Counsel should begin with a narrower question: What exactly matched, on what date, under which authority, and based on what evidence?",{"type":26,"tag":39,"props":40,"children":42},"h2",{"id":41},"why-is-an-ofac-designation-not-a-tracing-conclusion",[43],{"type":31,"value":44},"Why is an OFAC designation not a tracing conclusion?",{"type":26,"tag":27,"props":46,"children":47},{},[48],{"type":31,"value":49},"OFAC administers sanctions programs under different statutes, executive orders, and regulations. The legal effect of a match depends on the governing program, the parties and property involved, jurisdiction, ownership, and timing. A blockchain trace may supply relevant facts, but it does not determine which legal rule applies.",{"type":26,"tag":27,"props":51,"children":52},{},[53,55,64,66,73],{"type":31,"value":54},"The September 17, 2026 BitBank action illustrates the distinction. OFAC added BitBank, its developer Pishtaz Simorgh Electronic Trade Company, and three individuals to the Specially Designated Nationals and Blocked Persons List. Treasury described BitBank as a digital asset venture controlled by OFAC-designated Iranian financier Babak Zanjani and stated that Zanjani used it to facilitate transfers of hundreds of millions of dollars' worth of Bitcoin to the Islamic Revolutionary Guard Corps. Those are Treasury's administrative findings and allegations, not judicial findings. (",{"type":26,"tag":56,"props":57,"children":61},"a",{"href":58,"rel":59},"https:\u002F\u002Fhome.treasury.gov\u002Fnews\u002Fpress-releases\u002Fsb0632",[60],"nofollow",[62],{"type":31,"value":63},"Treasury release",{"type":31,"value":65},"; ",{"type":26,"tag":56,"props":67,"children":70},{"href":68,"rel":69},"https:\u002F\u002Fofac.treasury.gov\u002Frecent-actions\u002F20260917",[60],[71],{"type":31,"value":72},"OFAC list update",{"type":31,"value":74},")",{"type":26,"tag":27,"props":76,"children":77},{},[78],{"type":31,"value":79},"The public entries issued with that action did not publish a digital currency address for BitBank. A later provider label connecting an address to BitBank would therefore be a third-party attribution unless OFAC separately published the address. Calling it an “OFAC-listed address” would overstate the official record.",{"type":26,"tag":27,"props":81,"children":82},{},[83,85,92],{"type":31,"value":84},"The designation date also is not necessarily the first date on which restrictions applied. ",{"type":26,"tag":56,"props":86,"children":89},{"href":87,"rel":88},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F1250",[60],[90],{"type":31,"value":91},"OFAC FAQ 1250",{"type":31,"value":93}," states that Iranian digital asset exchanges meet the regulatory definition of an Iranian financial institution and are blocked under Executive Order 13599 and the Iranian Transactions and Sanctions Regulations regardless of whether they appear by name on the SDN List. Property and interests in property of those exchanges within U.S. jurisdiction or the possession or control of a U.S. person are blocked and must be reported.",{"type":26,"tag":27,"props":95,"children":96},{},[97,99,106],{"type":31,"value":98},"The analysis for non-U.S. persons is different. ",{"type":26,"tag":56,"props":100,"children":103},{"href":101,"rel":102},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F1257",[60],[104],{"type":31,"value":105},"OFAC FAQ 1257",{"type":31,"value":107}," identifies separate potential consequences: designation of a person that materially assists or supports a designated exchange; correspondent or payable-through account restrictions on a foreign financial institution that knowingly conducts or facilitates a significant financial transaction for the exchange; and statutory sanctions involving significant transactions with designated Iranian financial institutions. Those authorities address different actors, conduct, and consequences.",{"type":26,"tag":39,"props":109,"children":111},{"id":110},"what-are-the-five-findings-that-reports-often-collapse-into-one-match",[112],{"type":31,"value":113},"What are the five findings that reports often collapse into one match?",{"type":26,"tag":115,"props":116,"children":118},"h3",{"id":117},"_1-an-exact-match-to-an-address-published-by-ofac",[119],{"type":31,"value":120},"1. An exact match to an address published by OFAC",{"type":26,"tag":27,"props":122,"children":123},{},[124,126,133],{"type":31,"value":125},"OFAC may add digital currency addresses to an SDN List entry as identifiers associated with a blocked person, although ",{"type":26,"tag":56,"props":127,"children":130},{"href":128,"rel":129},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F562",[60],[131],{"type":31,"value":132},"OFAC FAQ 562",{"type":31,"value":134}," warns that published addresses are not likely to be exhaustive. The absence of an address from an entry does not prove that the listed person has no interest in it.",{"type":26,"tag":27,"props":136,"children":137},{},[138,145],{"type":26,"tag":56,"props":139,"children":142},{"href":140,"rel":141},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F594",[60],[143],{"type":31,"value":144},"OFAC FAQ 594",{"type":31,"value":146}," directs users to enter a digital currency address in the Sanctions List Search tool's ID # field. That field does not use fuzzy logic, so it returns only exact matches. The search result should still be validated under the relevant network's parsing and canonicalization rules.",{"type":26,"tag":27,"props":148,"children":149},{},[150,152,159],{"type":31,"value":151},"Ethereum is an important example. An Ethereum address represents a 20-byte value, while mixed capitalization can encode an ",{"type":26,"tag":56,"props":153,"children":156},{"href":154,"rel":155},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-55",[60],[157],{"type":31,"value":158},"ERC-55 checksum",{"type":31,"value":160},". A casing correction can therefore identify the same underlying address. A report should not claim that every visible character difference necessarily creates a different Ethereum address without first applying the network's rules.",{"type":26,"tag":27,"props":162,"children":163},{},[164],{"type":31,"value":165},"A network-validated exact match supports the statement that OFAC publicly associated the identifier with the listed person as of the applicable entry. It does not independently establish who controlled the address on every earlier date, who authorized a transaction, or what another party knew.",{"type":26,"tag":115,"props":167,"children":169},{"id":168},"_2-a-third-party-attribution-to-a-listed-person-or-entity",[170],{"type":31,"value":171},"2. A third-party attribution to a listed person or entity",{"type":26,"tag":27,"props":173,"children":174},{},[175],{"type":31,"value":176},"A commercial analytics provider may attribute addresses that OFAC has not published. The report should identify the provider, product, query date, label, confidence or category, and disclosed basis. “The provider attributed this address to BitBank” accurately describes the evidence. “OFAC listed this address” does not, unless the official entry contains it.",{"type":26,"tag":27,"props":178,"children":179},{},[180,182,188],{"type":31,"value":181},"Attribution also does not necessarily resolve ownership. Exchange records, account data, device evidence, corporate records, signed messages, and testimony may be needed to connect an address to a person or entity. ",{"type":26,"tag":56,"props":183,"children":185},{"href":184},"\u002Fresources\u002Funderstanding-wallet-ownership-evidence",[186],{"type":31,"value":187},"Understanding wallet ownership evidence",{"type":31,"value":189}," explains why control of keys, account ownership, and ownership of the assets are separate questions.",{"type":26,"tag":115,"props":191,"children":193},{"id":192},"_3-an-unlisted-entity-blocked-under-the-50-percent-rule",[194],{"type":31,"value":195},"3. An unlisted entity blocked under the 50 Percent Rule",{"type":26,"tag":27,"props":197,"children":198},{},[199,201,208,210,217],{"type":31,"value":200},"An entity need not appear by name on the SDN List to be blocked. ",{"type":26,"tag":56,"props":202,"children":205},{"href":203,"rel":204},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F401",[60],[206],{"type":31,"value":207},"OFAC FAQ 401",{"type":31,"value":209}," states that an entity directly or indirectly owned 50 percent or more in the aggregate by one or more blocked persons is considered blocked. OFAC's ",{"type":26,"tag":56,"props":211,"children":214},{"href":212,"rel":213},"https:\u002F\u002Fofac.treasury.gov\u002Fmedia\u002F6186\u002Fdownload?inline",[60],[215],{"type":31,"value":216},"50 Percent Rule guidance",{"type":31,"value":218}," explains that qualifying interests held by multiple blocked persons are aggregated.",{"type":26,"tag":27,"props":220,"children":221},{},[222,224,231],{"type":31,"value":223},"Control is a separate issue. ",{"type":26,"tag":56,"props":225,"children":228},{"href":226,"rel":227},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F398",[60],[229],{"type":31,"value":230},"OFAC FAQ 398",{"type":31,"value":232}," states that an entity controlled by blocked persons, but not owned 50 percent or more in the aggregate, is not automatically blocked under the rule. OFAC may separately designate the entity and urges caution when blocked persons hold significant minority interests or exercise control.",{"type":26,"tag":27,"props":234,"children":235},{},[236],{"type":31,"value":237},"Blockchain activity rarely proves corporate ownership percentages by itself. Counsel may need shareholder records, beneficial-ownership information, formation documents, agreements, governance records, and testimony. Operational control of a wallet is not a substitute for the ownership analysis.",{"type":26,"tag":115,"props":239,"children":241},{"id":240},"_4-an-indirect-transaction-path",[242],{"type":31,"value":243},"4. An indirect transaction path",{"type":26,"tag":27,"props":245,"children":246},{},[247],{"type":31,"value":248},"A transaction graph may show funds moving from a listed or attributed address through intermediaries to the wallet under review. That path is transaction history. It is not automatic proof that each downstream wallet is blocked, owned by the sanctioned party, or involved in evasion.",{"type":26,"tag":27,"props":250,"children":251},{},[252,254,261],{"type":31,"value":253},"OFAC's ",{"type":26,"tag":56,"props":255,"children":258},{"href":256,"rel":257},"https:\u002F\u002Fofac.treasury.gov\u002Fsystem\u002Ffiles\u002F126\u002Fvirtual_currency_guidance_brochure.pdf",[60],[259],{"type":31,"value":260},"Sanctions Compliance Guidance for the Virtual Currency Industry",{"type":31,"value":262}," recommends a risk-based compliance program that may include address screening, transaction monitoring, investigation, and blockchain analytics. It does not establish a universal rule under which every wallet within a fixed number of hops acquires the legal status of the original listed address.",{"type":26,"tag":27,"props":264,"children":265},{},[266,268,274],{"type":31,"value":267},"Terms such as “direct,” “one hop,” and “indirect” should describe the transaction path. They should not silently substitute for an ownership, attribution, knowledge, or liability conclusion. A sound ",{"type":26,"tag":56,"props":269,"children":271},{"href":270},"\u002Fservices#blockchain-tracing",[272],{"type":31,"value":273},"blockchain tracing analysis",{"type":31,"value":275}," separates ledger facts from the inferences drawn from them.",{"type":26,"tag":115,"props":277,"children":279},{"id":278},"_5-a-vendor-generated-risk-score-or-alert",[280],{"type":31,"value":281},"5. A vendor-generated risk score or alert",{"type":26,"tag":27,"props":283,"children":284},{},[285],{"type":31,"value":286},"A risk score is an analytical output, not an OFAC determination. Counsel should obtain the transactions and attribution evidence behind it, including what triggered the alert, which addresses contributed, the exposure settings and time period, and when the provider applied or changed the label.",{"type":26,"tag":27,"props":288,"children":289},{},[290,292,298],{"type":31,"value":291},"A score may be useful for triage, but its meaning depends on the provider's methodology. ",{"type":26,"tag":56,"props":293,"children":295},{"href":294},"\u002Fresources\u002Fwhy-blockchain-forensic-reports-fail-daubert",[296],{"type":31,"value":297},"Why most blockchain forensic reports fail Daubert scrutiny",{"type":31,"value":299}," addresses the broader problems created when a dispositive conclusion rests on untested commercial labels or opaque rules.",{"type":26,"tag":39,"props":301,"children":303},{"id":302},"how-should-counsel-build-the-sanctions-timeline",[304],{"type":31,"value":305},"How should counsel build the sanctions timeline?",{"type":26,"tag":27,"props":307,"children":308},{},[309],{"type":31,"value":310},"Chronology is often the difference between a useful trace and a misleading conclusion. Record at least:",{"type":26,"tag":312,"props":313,"children":314},"ol",{},[315,321,326,331,336,341,346,351],{"type":26,"tag":316,"props":317,"children":318},"li",{},[319],{"type":31,"value":320},"the date and time of each relevant blockchain transaction;",{"type":26,"tag":316,"props":322,"children":323},{},[324],{"type":31,"value":325},"the block number and transaction hash;",{"type":26,"tag":316,"props":327,"children":328},{},[329],{"type":31,"value":330},"the date the person, entity, or address was listed;",{"type":26,"tag":316,"props":332,"children":333},{},[334],{"type":31,"value":335},"any earlier authority under which the person or property may already have been blocked;",{"type":26,"tag":316,"props":337,"children":338},{},[339],{"type":31,"value":340},"the date the analytics provider created, changed, or withdrew its attribution;",{"type":26,"tag":316,"props":342,"children":343},{},[344],{"type":31,"value":345},"the date the client or institution received the alert;",{"type":26,"tag":316,"props":347,"children":348},{},[349],{"type":31,"value":350},"any blocking, rejection, return, unblocking, or transfer date; and",{"type":26,"tag":316,"props":352,"children":353},{},[354],{"type":31,"value":355},"any report, license request, subpoena response, or OFAC communication date.",{"type":26,"tag":27,"props":357,"children":358},{},[359,366],{"type":26,"tag":56,"props":360,"children":363},{"href":361,"rel":362},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F5",[60],[364],{"type":31,"value":365},"OFAC FAQ 5",{"type":31,"value":367}," recommends that organizations investigating a potential name match identify the list or sanctions program that generated the alert, review the complete entry, compare available identifiers, obtain additional information where necessary, and follow their sanctions procedures for likely matches. It does not say that every doubtful match must be reported to OFAC. OFAC also explains that it does not confirm potential matches or false positives for organizations and instead expects risk-based determinations.",{"type":26,"tag":27,"props":369,"children":370},{},[371,373,380],{"type":31,"value":372},"As an evidentiary practice, preserve the search result, list data, provider output, and analysis date so the decision can be reconstructed. That preservation recommendation is separate from FAQ 5. Questions about whether virtual currency must be blocked may be directed to OFAC's Compliance Hotline under ",{"type":26,"tag":56,"props":374,"children":377},{"href":375,"rel":376},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F646",[60],[378],{"type":31,"value":379},"FAQ 646",{"type":31,"value":381},".",{"type":26,"tag":39,"props":383,"children":385},{"id":384},"what-should-a-reproducible-evidence-package-contain",[386],{"type":31,"value":387},"What should a reproducible evidence package contain?",{"type":26,"tag":27,"props":389,"children":390},{},[391],{"type":31,"value":392},"Preserve enough material for another qualified analyst to repeat the work:",{"type":26,"tag":394,"props":395,"children":396},"ul",{},[397,402,407,412,417,422,427,432,437],{"type":26,"tag":316,"props":398,"children":399},{},[400],{"type":31,"value":401},"the complete address in plain text and the relevant blockchain or network;",{"type":26,"tag":316,"props":403,"children":404},{},[405],{"type":31,"value":406},"the canonical or checksum-validated form used for comparison;",{"type":26,"tag":316,"props":408,"children":409},{},[410],{"type":31,"value":411},"transaction hashes, block numbers, timestamps, asset type, and amount;",{"type":26,"tag":316,"props":413,"children":414},{},[415],{"type":31,"value":416},"raw transaction and receipt data where available;",{"type":26,"tag":316,"props":418,"children":419},{},[420],{"type":31,"value":421},"the dated OFAC entry or sanctions-list data;",{"type":26,"tag":316,"props":423,"children":424},{},[425],{"type":31,"value":426},"the provider, product, version, query date, report identifier, and settings;",{"type":26,"tag":316,"props":428,"children":429},{},[430],{"type":31,"value":431},"labels, confidence levels, exposure thresholds, hop settings, and the relied-upon path;",{"type":26,"tag":316,"props":433,"children":434},{},[435],{"type":31,"value":436},"analyst notes and any manual changes to automated output; and",{"type":26,"tag":316,"props":438,"children":439},{},[440],{"type":31,"value":441},"records showing when the alert was received, investigated, and resolved.",{"type":26,"tag":27,"props":443,"children":444},{},[445,447,454],{"type":31,"value":446},"The current recordkeeping rule generally requires full and accurate transaction records for at least ten years. Records of blocked property must be retained while the property remains blocked and for at least ten years after it is unblocked. (",{"type":26,"tag":56,"props":448,"children":451},{"href":449,"rel":450},"https:\u002F\u002Fwww.ecfr.gov\u002Fcurrent\u002Ftitle-31\u002Fsubtitle-B\u002Fchapter-V\u002Fpart-501\u002Fsubpart-C\u002Fsection-501.601",[60],[452],{"type":31,"value":453},"31 C.F.R. § 501.601",{"type":31,"value":74},{"type":26,"tag":27,"props":456,"children":457},{},[458,460,467,468,475],{"type":31,"value":459},"OFAC's 2021 virtual currency guidance PDF still contains a five-year recordkeeping statement. That text predates the amendment that extended the regulatory period from five to ten years, effective in March 2025. The current regulation controls. (",{"type":26,"tag":56,"props":461,"children":464},{"href":462,"rel":463},"https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2024\u002F09\u002F13\u002F2024-20674\u002Freporting-recordkeeping-and-instructions-requirements-extension-of-recordkeeping-requirements",[60],[465],{"type":31,"value":466},"2024 interim final rule",{"type":31,"value":65},{"type":26,"tag":56,"props":469,"children":472},{"href":470,"rel":471},"https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2025\u002F03\u002F21\u002F2025-04864\u002Freporting-recordkeeping-and-instructions-requirements-extension-of-recordkeeping-requirements",[60],[473],{"type":31,"value":474},"2025 final rule",{"type":31,"value":74},{"type":26,"tag":39,"props":477,"children":479},{"id":478},"what-discovery-is-most-useful",[480],{"type":31,"value":481},"What discovery is most useful?",{"type":26,"tag":27,"props":483,"children":484},{},[485],{"type":31,"value":486},"Discovery should connect an address to a person, account, property interest, or business process. For a custodian, requests may seek KYC materials, beneficial owners, assigned deposit addresses, ledgers, internal identifiers, login and device data, withdrawal approvals, communications, sanctions alerts, investigation notes, and OFAC reports.",{"type":26,"tag":27,"props":488,"children":489},{},[490],{"type":31,"value":491},"For an analytics provider or expert, seek the transaction set, source and date of each attribution, software and ruleset, exposure settings, overrides, validation procedures, limitations, and label history. A protective order may address proprietary material without preventing meaningful testing of a dispositive attribution.",{"type":26,"tag":27,"props":493,"children":494},{},[495,497,503],{"type":31,"value":496},"For a 50 Percent Rule issue, request evidence of direct and indirect equity interests, intermediary entities, nominee arrangements, and ownership changes over time. Do not infer aggregate corporate ownership from wallet activity alone. The same separation of source data, method, and conclusion should appear in the final report and is part of ConsensusIntel's ",{"type":26,"tag":56,"props":498,"children":500},{"href":499},"\u002Fmethodology",[501],{"type":31,"value":502},"forensic methodology",{"type":31,"value":381},{"type":26,"tag":39,"props":505,"children":507},{"id":506},"what-happens-when-property-must-be-blocked",[508],{"type":31,"value":509},"What happens when property must be blocked?",{"type":26,"tag":27,"props":511,"children":512},{},[513,515,522],{"type":31,"value":514},"Blocking freezes property; it does not transfer title to the government. ",{"type":26,"tag":56,"props":516,"children":519},{"href":517,"rel":518},"https:\u002F\u002Fofac.treasury.gov\u002Ffaqs\u002F9",[60],[520],{"type":31,"value":521},"OFAC FAQ 9",{"type":31,"value":523}," states that title remains with the blocked person, while transfers and other exercises of ownership are prohibited without authorization.",{"type":26,"tag":27,"props":525,"children":526},{},[527],{"type":31,"value":528},"Once a U.S. person determines that it holds virtual currency required to be blocked, FAQ 646 requires denial of access, compliance with holding and reporting requirements, and risk-based controls. OFAC describes blocking each affected wallet or consolidating blocked virtual currency into another controlled wallet as permissible examples for a virtual currency company. It does not require every holder to move every blocked asset into a new wallet. Conversion to fiat currency is not required.",{"type":26,"tag":27,"props":530,"children":531},{},[532,534,541],{"type":31,"value":533},"The initial blocking report is due within ten business days, with annual reports required while the property remains blocked. ",{"type":26,"tag":56,"props":535,"children":538},{"href":536,"rel":537},"https:\u002F\u002Fwww.ecfr.gov\u002Fcurrent\u002Ftitle-31\u002Fsubtitle-B\u002Fchapter-V\u002Fpart-501\u002Fsubpart-C\u002Fsection-501.603",[60],[539],{"type":31,"value":540},"31 C.F.R. § 501.603",{"type":31,"value":542}," assigns primary responsibility to the holder or other specified person and permits an attorney or agent to file on that person's behalf.",{"type":26,"tag":27,"props":544,"children":545},{},[546,548,554],{"type":31,"value":547},"Regulatory blocking is also different from a stablecoin issuer's technical ability to blacklist tokens at an address. ",{"type":26,"tag":56,"props":549,"children":551},{"href":550},"\u002Fresources\u002Fstablecoins-freeze-option-usdt-usdc",[552],{"type":31,"value":553},"Stablecoins and the freeze option",{"type":31,"value":555}," explains that separate mechanism.",{"type":26,"tag":39,"props":557,"children":559},{"id":558},"how-does-the-framework-apply-to-a-transaction-path",[560],{"type":31,"value":561},"How does the framework apply to a transaction path?",{"type":26,"tag":27,"props":563,"children":564},{},[565],{"type":31,"value":566},"Hypothetical example: A client's wallet receives 12 ETH from Address B in June. In September, a tracing provider reports that Address B received funds two transactions earlier from an address the provider attributes to a newly designated exchange.",{"type":26,"tag":27,"props":568,"children":569},{},[570],{"type":31,"value":571},"The blockchain may establish the transaction path. The provider's records may establish that it applied the exchange label to the upstream address on a particular date. Neither fact alone establishes that Address B was controlled by the exchange, that the client's June receipt involved property in which the exchange had an interest, that the client knew of the upstream source, or that the September designation was the first restriction applicable to the exchange.",{"type":26,"tag":27,"props":573,"children":574},{},[575],{"type":31,"value":576},"A defensible analysis would verify the path, timing, any OFAC-published address, the governing authority, any earlier blocking status, ownership or control of Address B, available custodial records, and the client's jurisdictional status. The report should separate on-chain facts, third-party attribution, legal assumptions, and unresolved questions.",{"type":26,"tag":39,"props":578,"children":580},{"id":579},"what-is-the-practical-response-to-an-ofac-related-alert",[581],{"type":31,"value":582},"What is the practical response to an OFAC-related alert?",{"type":26,"tag":312,"props":584,"children":585},{},[586,597,607,617,627,637,647,657,667,677],{"type":26,"tag":316,"props":587,"children":588},{},[589,595],{"type":26,"tag":590,"props":591,"children":592},"strong",{},[593],{"type":31,"value":594},"Preserve the exact result.",{"type":31,"value":596}," Save the address, network, list entry, provider output, settings, date, and underlying transactions.",{"type":26,"tag":316,"props":598,"children":599},{},[600,605],{"type":26,"tag":590,"props":601,"children":602},{},[603],{"type":31,"value":604},"Validate the address correctly.",{"type":31,"value":606}," Use the OFAC ID # field and apply the blockchain's canonicalization and checksum rules.",{"type":26,"tag":316,"props":608,"children":609},{},[610,615],{"type":26,"tag":590,"props":611,"children":612},{},[613],{"type":31,"value":614},"Identify what matched.",{"type":31,"value":616}," Distinguish an OFAC-published address from a vendor attribution, ownership conclusion, indirect path, or score.",{"type":26,"tag":316,"props":618,"children":619},{},[620,625],{"type":26,"tag":590,"props":621,"children":622},{},[623],{"type":31,"value":624},"Identify the authority.",{"type":31,"value":626}," Determine the sanctions program, executive order, regulation, and any earlier blocking rule.",{"type":26,"tag":316,"props":628,"children":629},{},[630,635],{"type":26,"tag":590,"props":631,"children":632},{},[633],{"type":31,"value":634},"Build the timeline.",{"type":31,"value":636}," Separate transaction, designation, attribution, discovery, blocking, and reporting dates.",{"type":26,"tag":316,"props":638,"children":639},{},[640,645],{"type":26,"tag":590,"props":641,"children":642},{},[643],{"type":31,"value":644},"Determine jurisdiction and actor.",{"type":31,"value":646}," Identify the relevant person, institution, holder, property, and conduct.",{"type":26,"tag":316,"props":648,"children":649},{},[650,655],{"type":26,"tag":590,"props":651,"children":652},{},[653],{"type":31,"value":654},"Investigate ownership and control.",{"type":31,"value":656}," Apply the 50 Percent Rule to documented ownership, not wallet activity alone.",{"type":26,"tag":316,"props":658,"children":659},{},[660,665],{"type":26,"tag":590,"props":661,"children":662},{},[663],{"type":31,"value":664},"Separate fact from inference.",{"type":31,"value":666}," State what the ledger records, what a provider attributes, and what counsel or the expert concludes.",{"type":26,"tag":316,"props":668,"children":669},{},[670,675],{"type":26,"tag":590,"props":671,"children":672},{},[673],{"type":31,"value":674},"Assess blocking and reporting duties promptly.",{"type":31,"value":676}," Apply the governing authority rather than a generic “sanctions exposure” label.",{"type":26,"tag":316,"props":678,"children":679},{},[680,685],{"type":26,"tag":590,"props":681,"children":682},{},[683],{"type":31,"value":684},"Use program-specific legal advice.",{"type":31,"value":686}," Blockchain expertise reconstructs transactions; it does not replace sanctions counsel.",{"type":26,"tag":39,"props":688,"children":690},{"id":689},"frequently-asked-questions",[691],{"type":31,"value":692},"Frequently Asked Questions",{"type":26,"tag":115,"props":694,"children":696},{"id":695},"q-does-an-exact-match-to-an-ofac-published-address-prove-who-owned-the-wallet",[697],{"type":31,"value":698},"Q: Does an exact match to an OFAC-published address prove who owned the wallet?",{"type":26,"tag":27,"props":700,"children":701},{},[702,707],{"type":26,"tag":590,"props":703,"children":704},{},[705],{"type":31,"value":706},"A:",{"type":31,"value":708}," No. It proves that OFAC publicly associated that identifier with a listed person as of the relevant entry. Ownership or control on a particular date may require exchange records, account data, device evidence, corporate records, signed messages, or testimony.",{"type":26,"tag":115,"props":710,"children":712},{"id":711},"q-does-a-one-hop-or-indirect-connection-make-the-receiving-wallet-sanctioned",[713],{"type":31,"value":714},"Q: Does a one-hop or indirect connection make the receiving wallet sanctioned?",{"type":26,"tag":27,"props":716,"children":717},{},[718,722],{"type":26,"tag":590,"props":719,"children":720},{},[721],{"type":31,"value":706},{"type":31,"value":723}," Not automatically. The path establishes transaction history. Counsel must separately analyze attribution, property interests, ownership, jurisdiction, timing, knowledge where relevant, and the governing sanctions authority.",{"type":26,"tag":115,"props":725,"children":727},{"id":726},"q-can-an-entity-be-blocked-even-if-it-is-not-named-on-the-sdn-list",[728],{"type":31,"value":729},"Q: Can an entity be blocked even if it is not named on the SDN List?",{"type":26,"tag":27,"props":731,"children":732},{},[733,737],{"type":26,"tag":590,"props":734,"children":735},{},[736],{"type":31,"value":706},{"type":31,"value":738}," Yes. An entity directly or indirectly owned 50 percent or more in the aggregate by one or more blocked persons is considered blocked under OFAC's 50 Percent Rule. Control without the required ownership percentage does not automatically produce that result.",{"type":26,"tag":115,"props":740,"children":742},{"id":741},"q-how-long-should-sanctions-related-cryptocurrency-records-be-retained",[743],{"type":31,"value":744},"Q: How long should sanctions-related cryptocurrency records be retained?",{"type":26,"tag":27,"props":746,"children":747},{},[748,752],{"type":26,"tag":590,"props":749,"children":750},{},[751],{"type":31,"value":706},{"type":31,"value":753}," The current OFAC recordkeeping rule generally requires transaction records for at least ten years. Records of blocked property must be kept while the property remains blocked and for at least ten years after unblocking. Other litigation, regulatory, or contractual preservation duties may require longer retention.",{"type":26,"tag":115,"props":755,"children":757},{"id":756},"q-what-should-counsel-request-from-a-blockchain-analytics-provider",[758],{"type":31,"value":759},"Q: What should counsel request from a blockchain analytics provider?",{"type":26,"tag":27,"props":761,"children":762},{},[763,767],{"type":26,"tag":590,"props":764,"children":765},{},[766],{"type":31,"value":706},{"type":31,"value":768}," Request the underlying transactions, attribution sources and dates, product and version, ruleset, exposure and hop settings, confidence categories, overrides, validation procedures, limitations, and label history. The goal is to make the reported conclusion testable rather than relying on a score alone.",{"type":26,"tag":27,"props":770,"children":771},{},[772,774,780],{"type":31,"value":773},"Every matter turns on its facts, the applicable sanctions program, and the evidence available. For a case-specific tracing or evidentiary question, ",{"type":26,"tag":56,"props":775,"children":777},{"href":776},"\u002Fcontact",[778],{"type":31,"value":779},"contact ConsensusIntel",{"type":31,"value":781}," to discuss the record and the scope of analysis needed.",{"title":8,"searchDepth":783,"depth":783,"links":784},2,[785,786,794,795,796,797,798,799,800],{"id":41,"depth":783,"text":44},{"id":110,"depth":783,"text":113,"children":787},[788,790,791,792,793],{"id":117,"depth":789,"text":120},3,{"id":168,"depth":789,"text":171},{"id":192,"depth":789,"text":195},{"id":240,"depth":789,"text":243},{"id":278,"depth":789,"text":281},{"id":302,"depth":783,"text":305},{"id":384,"depth":783,"text":387},{"id":478,"depth":783,"text":481},{"id":506,"depth":783,"text":509},{"id":558,"depth":783,"text":561},{"id":579,"depth":783,"text":582},{"id":689,"depth":783,"text":692,"children":801},[802,803,804,805,806],{"id":695,"depth":789,"text":698},{"id":711,"depth":789,"text":714},{"id":726,"depth":789,"text":729},{"id":741,"depth":789,"text":744},{"id":756,"depth":789,"text":759},"markdown","content:articles:23-sanctions-blockchain-tracing-ofac-match-evidence.md","content","articles\u002F23-sanctions-blockchain-tracing-ofac-match-evidence.md","articles\u002F23-sanctions-blockchain-tracing-ofac-match-evidence","md",{"_path":814,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":815,"description":816,"slug":817,"date":818,"lastUpdated":818,"author":13,"readingTime":14,"category":819,"tags":820,"ogImage":824,"featured":7,"body":825,"_type":807,"_id":1524,"_source":809,"_file":1525,"_stem":1526,"_extension":812},"\u002Farticles\u002F39-crypto-seizure-warrant-trace-hamas-2026","What a seizure-warrant trace reveals about blockchain evidence","A case study of DOJ's September 2026 Hamas crypto seizures, showing how sworn warrant records layer blockchain paths with service-provider evidence.","crypto-seizure-warrant-trace-hamas-2026","2026-09-05","Methodology",[821,19,822,20,823],"case-study","seized-assets","litigation","\u002Fog\u002Fcrypto-seizure-warrant-trace-hamas-2026.png",{"type":23,"children":826,"toc":1501},[827,832,837,843,848,853,905,910,915,921,944,950,964,970,991,997,1002,1008,1013,1019,1024,1030,1035,1041,1046,1056,1066,1077,1083,1088,1098,1151,1156,1162,1167,1282,1288,1293,1303,1313,1323,1333,1353,1359,1364,1392,1419,1423,1429,1438,1444,1453,1459,1468,1474,1483,1489],{"type":26,"tag":27,"props":828,"children":829},{},[830],{"type":31,"value":831},"On September 1, 2026, the Justice Department announced that it had seized over $560,000 in cryptocurrency intended for Hamas and disrupted the domains and servers the group used to solicit donations and recruit supporters. The announcement was the cumulative public record of a longer investigation: seizure warrants issued in the District of Columbia on March 25, June 25, and October 10, 2025, followed by infrastructure warrants on July 29 and August 18, 2026. The government then posted the underlying sworn warrant materials online. The posted packets include AO 109 returns, but those return, inventory, and certification fields are blank, so the public file documents authorization, not the date of execution.",{"type":26,"tag":27,"props":833,"children":834},{},[835],{"type":31,"value":836},"This is a public, government-published example of a trace described in sworn warrant materials. This article walks through that record to extract a transferable method for litigators and forensic experts, while being careful about what the materials do and do not prove. The legal posture of a criminal seizure investigation differs substantially from a private civil dispute, and the value of this case study is methodological, not an invitation to import government conclusions wholesale.",{"type":26,"tag":39,"props":838,"children":840},{"id":839},"the-procedural-posture-allegations-probable-cause-and-seizure",[841],{"type":31,"value":842},"The Procedural Posture: Allegations, Probable Cause, and Seizure",{"type":26,"tag":27,"props":844,"children":845},{},[846],{"type":31,"value":847},"Before reading any warrant record, establish which legal conclusion the document supports. This case study is a useful lesson precisely because the September announcement reports a seizure premised on probable cause, not a judgment or conviction.",{"type":26,"tag":27,"props":849,"children":850},{},[851],{"type":31,"value":852},"These are the categories, in order of increasing legal weight:",{"type":26,"tag":394,"props":854,"children":855},{},[856,866,885,895],{"type":26,"tag":316,"props":857,"children":858},{},[859,864],{"type":26,"tag":590,"props":860,"children":861},{},[862],{"type":31,"value":863},"Attributed allegations.",{"type":31,"value":865}," The government states that Hamas, a designated Foreign Terrorist Organization, used the addresses and infrastructure to raise funds and recruit. At the point of a seizure, these are the government's allegations resting on its investigation, not judicial findings of fact.",{"type":26,"tag":316,"props":867,"children":868},{},[869,874,876,883],{"type":26,"tag":590,"props":870,"children":871},{},[872],{"type":31,"value":873},"Probable cause.",{"type":31,"value":875}," The authorizing judge issued each warrant on a probable-cause showing. Under ",{"type":26,"tag":56,"props":877,"children":880},{"href":878,"rel":879},"https:\u002F\u002Fwww.law.cornell.edu\u002Frules\u002Ffrcrmp\u002Frule_41",[60],[881],{"type":31,"value":882},"Federal Rule of Criminal Procedure 41",{"type":31,"value":884},", a judge must issue a warrant if probable cause is shown by affidavit or other information; the judge may also rely on sworn testimony.",{"type":26,"tag":316,"props":886,"children":887},{},[888,893],{"type":26,"tag":590,"props":889,"children":890},{},[891],{"type":31,"value":892},"The seizure itself.",{"type":31,"value":894}," The Department announced that the FBI seized the funds and infrastructure. A seizure does not itself resolve ownership; a completed forfeiture process is ordinarily needed for a final forfeiture determination.",{"type":26,"tag":316,"props":896,"children":897},{},[898,903],{"type":26,"tag":590,"props":899,"children":900},{},[901],{"type":31,"value":902},"Final adjudication.",{"type":31,"value":904}," Forfeiture, administrative or judicial, requires notice and an opportunity for claimants to contest before title finally vests. None of the materials in this announcement evidence an adjudicated finding against any person.",{"type":26,"tag":27,"props":906,"children":907},{},[908],{"type":31,"value":909},"For a private litigator, read a warrant document as a menu of investigative steps that were persuasive enough for a magistrate, and treat each fact asserted inside it as an allegation the government must still prove. That distinction matters enormously in civil work, where the burden of proof and the rules of evidence differ from a probable-cause determination.",{"type":26,"tag":27,"props":911,"children":912},{},[913],{"type":31,"value":914},"I have not and will not repeat specific unverified operational details from these affidavits here, because reproducing what an affidavit alleges about live infrastructure serves no legal-pedagogical purpose and can be inaccurate if read out of context. The lesson is in the structure.",{"type":26,"tag":39,"props":916,"children":918},{"id":917},"how-the-evidence-was-layered-not-just-traced",[919],{"type":31,"value":920},"How the Evidence Was Layered, Not Just Traced",{"type":26,"tag":27,"props":922,"children":923},{},[924,926,933,935,942],{"type":31,"value":925},"Reading the public record as a whole, the investigation assembled at least six distinct categories of evidence. Few are blockchain analysis alone. The ",{"type":26,"tag":56,"props":927,"children":930},{"href":928,"rel":929},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fpr\u002Fjustice-department-continues-disrupt-hamas-terrorist-financing-schemes-through-seizures",[60],[931],{"type":31,"value":932},"press release",{"type":31,"value":934}," describes cryptocurrency seizures, the seizure of domains and servers, and disruption of fundraising and recruitment platforms; industry reporting on the affidavits, such as ",{"type":26,"tag":56,"props":936,"children":939},{"href":937,"rel":938},"https:\u002F\u002Fwww.chainalysis.com\u002Fblog\u002Ffbi-seizes-hamas-crypto-fundraising-network\u002F",[60],[940],{"type":31,"value":941},"Chainalysis's review of the filings",{"type":31,"value":943},", adds detail on how the on-chain work connected to accounts and intermediaries.",{"type":26,"tag":115,"props":945,"children":947},{"id":946},"on-chain-transaction-paths",[948],{"type":31,"value":949},"On-Chain Transaction Paths",{"type":26,"tag":27,"props":951,"children":952},{},[953,955,962],{"type":31,"value":954},"The foundational layer is the public ledger record itself. The March 2025 warrant materials (25-sz-20, issued March 25, 2025, in the District of Columbia, in the ",{"type":26,"tag":56,"props":956,"children":959},{"href":957,"rel":958},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fmedia\u002F1459791\u002Fdl?inline",[60],[960],{"type":31,"value":961},"public media library",{"type":31,"value":963},") cover the initial action, which industry reporting describes as involving roughly $200,000 in stablecoins donated to Hamas. The blockchain showed what moved, when, in what amounts, and between which addresses.",{"type":26,"tag":115,"props":965,"children":967},{"id":966},"controlled-or-observed-transactions",[968],{"type":31,"value":969},"Controlled or Observed Transactions",{"type":26,"tag":27,"props":971,"children":972},{},[973,975,981,983,989],{"type":31,"value":974},"A distinctive feature in this record is that the government did not merely observe historical flows; it interposed itself. The June 25, 2025 warrant (25-sz-34, ",{"type":26,"tag":56,"props":976,"children":979},{"href":977,"rel":978},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fmedia\u002F1459796\u002Fdl?inline",[60],[980],{"type":31,"value":961},{"type":31,"value":982},") states in affidavit paragraph 1 that its subject matter is related to seizure 25-sz-20, approved March 25, 2025. Attachment A-1 of that packet is a Tether burn-and-reissue instruction listing USDT addresses; it has no footnotes. The June affidavit describes Tether freezing USDT at law-enforcement request, including a March 12, 2025 freeze of additional funds in accounts funded by an operational wallet, and a further freeze on or about April 15, 2025 of listed donation addresses. It also describes Binance independently freezing withdrawals from three target accounts on April 14, 2025. Those are issuer and exchange compliance actions, not a court restraining order. The October 10, 2025 warrant (25-sz-42, ",{"type":26,"tag":56,"props":984,"children":987},{"href":985,"rel":986},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fmedia\u002F1459801\u002Fdl?inline",[60],[988],{"type":31,"value":961},{"type":31,"value":990},") describes additional Tether freezes at FBI request on May 22, 2025 and June 14, 2025, and a Binance freeze of withdrawals from a listed account, likewise issuer and exchange actions. Controlled or blocked transactions create evidence that no purely passive observer could produce: the point at which value was diverted, frozen, or redirected is a documented event.",{"type":26,"tag":115,"props":992,"children":994},{"id":993},"communications-and-platform-content",[995],{"type":31,"value":996},"Communications and Platform Content",{"type":26,"tag":27,"props":998,"children":999},{},[1000],{"type":31,"value":1001},"The disruption of domains and servers gave investigators access to solicitation content and supporter interactions, not merely financial data. According to the DOJ, the action disrupted Hamas's fundraising and recruitment communication platforms and websites. Industry reporting on the filings adds that the seized domains and servers included infrastructure associated with the al-Qassam Brigades' main website, which investigators said allowed them to intercept intended donations and gather information about individuals attempting to contribute.",{"type":26,"tag":115,"props":1003,"children":1005},{"id":1004},"service-provider-records",[1006],{"type":31,"value":1007},"Service-Provider Records",{"type":26,"tag":27,"props":1009,"children":1010},{},[1011],{"type":31,"value":1012},"Per industry reporting on the June 2025 affidavit, the investigators traced original donations through a web of new addresses and accounts, and identified service-provider accounts, including one believed to be associated with a Lebanon-based over-the-counter broker and another exhibiting patterns consistent with money mule activity. Those descriptions are attributed allegations within a probable-cause document, reported secondhand; the underlying records, subpoenas, or production requests are not public. The affidavit leans on service-provider records as a bridge from pseudonymous addresses to operating accounts.",{"type":26,"tag":115,"props":1014,"children":1016},{"id":1015},"address-rotation-and-obfuscation",[1017],{"type":31,"value":1018},"Address Rotation and Obfuscation",{"type":26,"tag":27,"props":1020,"children":1021},{},[1022],{"type":31,"value":1023},"The same reporting describes Hamas adapting its techniques after the initial March 2025 seizure, moving funds through new addresses and, in the October 2025 affidavit, using bridging services and single-use donation wallets, with investigators following the trail despite the obfuscation. Address rotation is a fact pattern, not a dead end: every rotated address still transacts on a public ledger, and each new address can be examined for links to a cluster or a service provider.",{"type":26,"tag":115,"props":1025,"children":1027},{"id":1026},"legal-process-as-evidence",[1028],{"type":31,"value":1029},"Legal Process as Evidence",{"type":26,"tag":27,"props":1031,"children":1032},{},[1033],{"type":31,"value":1034},"Finally, the warrant process itself is part of the record. Multiple sequentially authorized warrants support an inference of an iterative investigation, and the June affidavit's paragraph 1 reference to 25-sz-20 shows investigators expressly building a later application on the earlier one. In private cases, the analog is the discovery sequence: each subpoena response or production can become the foundation for the next.",{"type":26,"tag":39,"props":1036,"children":1038},{"id":1037},"path-tracing-vs-actor-attribution",[1039],{"type":31,"value":1040},"Path Tracing vs. Actor Attribution",{"type":26,"tag":27,"props":1042,"children":1043},{},[1044],{"type":31,"value":1045},"Dissecting this record requires separating two questions that prosecutors and civil litigators constantly conflate.",{"type":26,"tag":27,"props":1047,"children":1048},{},[1049,1054],{"type":26,"tag":590,"props":1050,"children":1051},{},[1052],{"type":31,"value":1053},"Path tracing",{"type":31,"value":1055}," asks where value went. It is answered almost entirely on-chain: the March 25, June 25, and October 10, 2025 seizure warrants set out alleged donation flow through successive addresses as investigators followed the funds.",{"type":26,"tag":27,"props":1057,"children":1058},{},[1059,1064],{"type":26,"tag":590,"props":1060,"children":1061},{},[1062],{"type":31,"value":1063},"Actor attribution",{"type":31,"value":1065}," asks who controlled the addresses. On-chain data alone cannot answer this. The record answers it through everything off-chain: platform accounts, service-provider records, communications content, and the observable behavior of the infrastructure.",{"type":26,"tag":27,"props":1067,"children":1068},{},[1069,1071,1076],{"type":31,"value":1070},"A private civil expert should replicate this split explicitly in any report. The path analysis can be stated with high confidence; the attribution analysis should be stated with a confidence level tied to the caliber of the off-chain evidence actually obtained. When a proposed report merges the two, the opposing expert's job becomes easy. For a practical framework on this very division, see the discussion of address attribution in ",{"type":26,"tag":56,"props":1072,"children":1073},{"href":184},[1074],{"type":31,"value":1075},"wallet ownership evidence",{"type":31,"value":381},{"type":26,"tag":39,"props":1078,"children":1080},{"id":1079},"a-worked-hypothetical-modeled-on-the-structure",[1081],{"type":31,"value":1082},"A Worked Hypothetical Modeled on the Structure",{"type":26,"tag":27,"props":1084,"children":1085},{},[1086],{"type":31,"value":1087},"The following is a hypothetical illustration built to mirror the layering technique described above, not a description of any actual investigation.",{"type":26,"tag":27,"props":1089,"children":1090},{},[1091,1096],{"type":26,"tag":590,"props":1092,"children":1093},{},[1094],{"type":31,"value":1095},"Hypothetical example:",{"type":31,"value":1097}," You represent a judgment creditor whose debtor, a third-party vendor, is suspected of funneling kickbacks through cryptocurrency. You have a single lead: the vendor's tax return disclosed a wallet address used to receive client overpayments.",{"type":26,"tag":312,"props":1099,"children":1100},{},[1101,1111,1121,1131,1141],{"type":26,"tag":316,"props":1102,"children":1103},{},[1104,1109],{"type":26,"tag":590,"props":1105,"children":1106},{},[1107],{"type":31,"value":1108},"Establish the seed address.",{"type":31,"value":1110}," Query the disclosed address on a block explorer and capture the full transaction history, including inbound overpayments that match client remittance schedules. Document the queries and exports for reproducibility.",{"type":26,"tag":316,"props":1112,"children":1113},{},[1114,1119],{"type":26,"tag":590,"props":1115,"children":1116},{},[1117],{"type":31,"value":1118},"Follow the path.",{"type":31,"value":1120}," Trace outbound value from the seed address to subsequent addresses using standard clustering (common input ownership and change output). Identify a pattern of same-day movements into a single consolidation wallet: the analog of the Hamas affidavits' consolidation pattern.",{"type":26,"tag":316,"props":1122,"children":1123},{},[1124,1129],{"type":26,"tag":590,"props":1125,"children":1126},{},[1127],{"type":31,"value":1128},"Find the service-provider touchpoint.",{"type":31,"value":1130}," When the consolidation wallet funds are sent to a deposit address attributable to an exchange, subpoena the exchange for account records tied to that deposit address, including KYC documents.",{"type":26,"tag":316,"props":1132,"children":1133},{},[1134,1139],{"type":26,"tag":590,"props":1135,"children":1136},{},[1137],{"type":31,"value":1138},"Corroborate with communications and behavior.",{"type":31,"value":1140}," Depose the vendor about the exchange account and the consolidation wallet. Correlate transaction timestamps with vendor travel or project milestones to create the attribution layer the ledger alone cannot supply.",{"type":26,"tag":316,"props":1142,"children":1143},{},[1144,1149],{"type":26,"tag":590,"props":1145,"children":1146},{},[1147],{"type":31,"value":1148},"Preserve the control evidence.",{"type":31,"value":1150}," Move for production of device forensics or a signed message from the disputed addresses, exactly as the government's legal process secured the off-chain records in the seizure wave.",{"type":26,"tag":27,"props":1152,"children":1153},{},[1154],{"type":31,"value":1155},"This sequence is a scaled-down civil analog of the six evidence categories above: path, interposition (the discovery demand), communications, service-provider records, obfuscation detection, and legal process.",{"type":26,"tag":39,"props":1157,"children":1159},{"id":1158},"a-checklist-for-reading-any-public-warrant-or-seizure-record",[1160],{"type":31,"value":1161},"A Checklist for Reading Any Public Warrant or Seizure Record",{"type":26,"tag":27,"props":1163,"children":1164},{},[1165],{"type":31,"value":1166},"When a client hands you a government warrant, press release, or affidavit, run this checklist before forming any opinion:",{"type":26,"tag":394,"props":1168,"children":1171},{"className":1169},[1170],"contains-task-list",[1172,1192,1207,1222,1237,1252,1267],{"type":26,"tag":316,"props":1173,"children":1176},{"className":1174},[1175],"task-list-item",[1177,1183,1185,1190],{"type":26,"tag":1178,"props":1179,"children":1182},"input",{"disabled":1180,"type":1181},true,"checkbox",[],{"type":31,"value":1184}," ",{"type":26,"tag":590,"props":1186,"children":1187},{},[1188],{"type":31,"value":1189},"Identify the legal instrument.",{"type":31,"value":1191}," Is it a warrant application, a returned warrant, an affidavit, a forfeiture complaint, or a press release? Each supports a different conclusion.",{"type":26,"tag":316,"props":1193,"children":1195},{"className":1194},[1175],[1196,1199,1200,1205],{"type":26,"tag":1178,"props":1197,"children":1198},{"disabled":1180,"type":1181},[],{"type":31,"value":1184},{"type":26,"tag":590,"props":1201,"children":1202},{},[1203],{"type":31,"value":1204},"Separate allegations from findings.",{"type":31,"value":1206}," Flag every sentence the government asserts as investigatory belief rather than adjudicated fact.",{"type":26,"tag":316,"props":1208,"children":1210},{"className":1209},[1175],[1211,1214,1215,1220],{"type":26,"tag":1178,"props":1212,"children":1213},{"disabled":1180,"type":1181},[],{"type":31,"value":1184},{"type":26,"tag":590,"props":1216,"children":1217},{},[1218],{"type":31,"value":1219},"Locate the probable-cause foundation.",{"type":31,"value":1221}," If an affidavit exists, identify which factual predicates support it and which are speculative or attributed.",{"type":26,"tag":316,"props":1223,"children":1225},{"className":1224},[1175],[1226,1229,1230,1235],{"type":26,"tag":1178,"props":1227,"children":1228},{"disabled":1180,"type":1181},[],{"type":31,"value":1184},{"type":26,"tag":590,"props":1231,"children":1232},{},[1233],{"type":31,"value":1234},"Map each evidence category.",{"type":31,"value":1236}," Place every assertion into one of: on-chain path, interposed transaction, communications, service-provider records, obfuscation indicators, or legal process.",{"type":26,"tag":316,"props":1238,"children":1240},{"className":1239},[1175],[1241,1244,1245,1250],{"type":26,"tag":1178,"props":1242,"children":1243},{"disabled":1180,"type":1181},[],{"type":31,"value":1184},{"type":26,"tag":590,"props":1246,"children":1247},{},[1248],{"type":31,"value":1249},"Split path from attribution.",{"type":31,"value":1251}," State what the record proves about value movement versus what it proves about persons.",{"type":26,"tag":316,"props":1253,"children":1255},{"className":1254},[1175],[1256,1259,1260,1265],{"type":26,"tag":1178,"props":1257,"children":1258},{"disabled":1180,"type":1181},[],{"type":31,"value":1184},{"type":26,"tag":590,"props":1261,"children":1262},{},[1263],{"type":31,"value":1264},"Note what is sealed or withheld.",{"type":31,"value":1266}," Warrants are often unsealed only in part. Redactions and sealed exhibits leave gaps in the public record; they do not establish what the nonpublic material proves.",{"type":26,"tag":316,"props":1268,"children":1270},{"className":1269},[1175],[1271,1274,1275,1280],{"type":26,"tag":1178,"props":1272,"children":1273},{"disabled":1180,"type":1181},[],{"type":31,"value":1184},{"type":26,"tag":590,"props":1276,"children":1277},{},[1278],{"type":31,"value":1279},"Check the return.",{"type":31,"value":1281}," The warrant's return, inventory, and certification are the place to look for what was actually taken, which may differ from what was authorized. In the posted March, June, and October packets, those AO 109 fields are blank, so reconstruct execution from provider production rather than treating the public return as a filled inventory.",{"type":26,"tag":39,"props":1283,"children":1285},{"id":1284},"limitations-burdens-tools-and-sealed-material",[1286],{"type":31,"value":1287},"Limitations: Burdens, Tools, and Sealed Material",{"type":26,"tag":27,"props":1289,"children":1290},{},[1291],{"type":31,"value":1292},"A government seizure record is a persuasive and instructive document, but it is not a template to be transplanted into civil litigation without adaptation.",{"type":26,"tag":27,"props":1294,"children":1295},{},[1296,1301],{"type":26,"tag":590,"props":1297,"children":1298},{},[1299],{"type":31,"value":1300},"Lower burdens.",{"type":31,"value":1302}," Probable cause is a lower standard than proof by a preponderance of the evidence, and both are lower than proof beyond a reasonable doubt. A magistrate's authorization does not constitute a finding that any defendant is liable or guilty.",{"type":26,"tag":27,"props":1304,"children":1305},{},[1306,1311],{"type":26,"tag":590,"props":1307,"children":1308},{},[1309],{"type":31,"value":1310},"Different tools.",{"type":31,"value":1312}," The government can compel records from providers, request issuer or exchange freezes of stablecoin balances, and take control of infrastructure using authorities a civil litigant does not possess. A private party can pursue relevant nonprivileged discovery, but that process is subject to objections, privilege, and cross-jurisdictional enforcement problems.",{"type":26,"tag":27,"props":1314,"children":1315},{},[1316,1321],{"type":26,"tag":590,"props":1317,"children":1318},{},[1319],{"type":31,"value":1320},"Sealed and incomplete records.",{"type":31,"value":1322}," The affidavits posted by the DOJ are partial views. Significant portions of the underlying investigation, including provider communications and foreign records, are not public. An expert who builds a civil case on a partial warrant record without confirming the evidentiary foundation is building on sand. When the record is incomplete, the correct response is narrow analysis, not confidence.",{"type":26,"tag":27,"props":1324,"children":1325},{},[1326,1331],{"type":26,"tag":590,"props":1327,"children":1328},{},[1329],{"type":31,"value":1330},"No adjudication.",{"type":31,"value":1332}," None of the September 2026 materials reflect a conviction, a forfeiture order, or a finding against any individual. Any use of this case study must preserve that distinction.",{"type":26,"tag":27,"props":1334,"children":1335},{},[1336,1338,1344,1346,1352],{"type":31,"value":1337},"For the civil analog of these methods as applied to Ponzi and fraud structures, see the ",{"type":26,"tag":56,"props":1339,"children":1341},{"href":1340},"\u002Fresources\u002Fdeconstructing-ponzi-blockchain-methodology",[1342],{"type":31,"value":1343},"methodological walkthrough of blockchain Ponzi reconstruction",{"type":31,"value":1345},", and for the foundational question of what tracing can and cannot establish, see ",{"type":26,"tag":56,"props":1347,"children":1349},{"href":1348},"\u002Fresources\u002Fcan-blockchain-transactions-be-traced",[1350],{"type":31,"value":1351},"can blockchain transactions be traced",{"type":31,"value":381},{"type":26,"tag":39,"props":1354,"children":1356},{"id":1355},"discovery-and-evidence-questions-worth-asking",[1357],{"type":31,"value":1358},"Discovery and Evidence Questions Worth Asking",{"type":26,"tag":27,"props":1360,"children":1361},{},[1362],{"type":31,"value":1363},"If you are building or challenging a trace modeled on this record, these are the questions to ask of your own expert, or of the opposing expert in deposition if the opinion rests on a warrant or government filing:",{"type":26,"tag":312,"props":1365,"children":1366},{},[1367,1372,1377,1382,1387],{"type":26,"tag":316,"props":1368,"children":1369},{},[1370],{"type":31,"value":1371},"Which addresses are claimed to be connected, and which clustering heuristic supports each connection?",{"type":26,"tag":316,"props":1373,"children":1374},{},[1375],{"type":31,"value":1376},"What is the confidence level attached to the path analysis versus the attribution analysis?",{"type":26,"tag":316,"props":1378,"children":1379},{},[1380],{"type":31,"value":1381},"Which service-provider records were obtained, from whom, and by what legal authority?",{"type":26,"tag":316,"props":1383,"children":1384},{},[1385],{"type":31,"value":1386},"Were any transactions observed, frozen, or redirected by an investigator or third party, and what effect does that interposition have on the integrity of the trace?",{"type":26,"tag":316,"props":1388,"children":1389},{},[1390],{"type":31,"value":1391},"Which assertions in the opinion trace to a publicly available primary source, and which rest on sealed or secondhand material?",{"type":26,"tag":27,"props":1393,"children":1394},{},[1395,1397,1402,1404,1410,1412,1417],{"type":31,"value":1396},"An expert who cannot answer each of these questions with a specific, verifiable response has not yet completed the analysis. If you need to build this evidence layer yourself, ",{"type":26,"tag":56,"props":1398,"children":1399},{"href":270},[1400],{"type":31,"value":1401},"ConsensusIntel's blockchain tracing services",{"type":31,"value":1403}," cover the path and attribution work, and ",{"type":26,"tag":56,"props":1405,"children":1407},{"href":1406},"\u002Fservices#expert-witness",[1408],{"type":31,"value":1409},"expert witness services",{"type":31,"value":1411}," cover the report and testimony stage. The ",{"type":26,"tag":56,"props":1413,"children":1414},{"href":499},[1415],{"type":31,"value":1416},"methodology page",{"type":31,"value":1418}," explains how evidence produced in this layered fashion is documented for litigation.",{"type":26,"tag":39,"props":1420,"children":1421},{"id":689},[1422],{"type":31,"value":692},{"type":26,"tag":115,"props":1424,"children":1426},{"id":1425},"q-can-i-rely-on-a-doj-seizure-warrant-as-proof-in-my-civil-case",[1427],{"type":31,"value":1428},"Q: Can I rely on a DOJ seizure warrant as proof in my civil case?",{"type":26,"tag":27,"props":1430,"children":1431},{},[1432,1436],{"type":26,"tag":590,"props":1433,"children":1434},{},[1435],{"type":31,"value":706},{"type":31,"value":1437}," Not directly. A warrant establishes that a magistrate found probable cause to seize property, which is a lower threshold than civil proof and carries no finding of liability. You can use the warrant as a roadmap for what evidence exists and where it came from, then obtain and verify the underlying records yourself. Treat the government's factual assertions as allegations supported by an investigation you have not seen in full.",{"type":26,"tag":115,"props":1439,"children":1441},{"id":1440},"q-what-is-the-difference-between-path-tracing-and-actor-attribution-in-these-affidavits",[1442],{"type":31,"value":1443},"Q: What is the difference between path tracing and actor attribution in these affidavits?",{"type":26,"tag":27,"props":1445,"children":1446},{},[1447,1451],{"type":26,"tag":590,"props":1448,"children":1449},{},[1450],{"type":31,"value":706},{"type":31,"value":1452}," Path tracing shows where value moved on-chain: addresses, amounts, and timestamps, which is directly observable on the public ledger. Actor attribution connects addresses to persons or organizations, which the ledger cannot do alone. In the Hamas seizure record, attribution rests on the off-chain layers: platform accounts, service-provider records, communications content, and the government's control of infrastructure. Any expert report that merges the two without labeling the confidence of each will be vulnerable on cross-examination.",{"type":26,"tag":115,"props":1454,"children":1456},{"id":1455},"q-why-did-the-government-release-these-warrant-materials-to-the-public",[1457],{"type":31,"value":1458},"Q: Why did the government release these warrant materials to the public?",{"type":26,"tag":27,"props":1460,"children":1461},{},[1462,1466],{"type":26,"tag":590,"props":1463,"children":1464},{},[1465],{"type":31,"value":706},{"type":31,"value":1467}," The Department did not state a separate reason for publication. It posted the seizure warrants and related materials through its Office of Public Affairs with the September 1, 2026 announcement. The applications were filed under seal, and the posted packets are redacted, so the public record is partial. Practitioners should treat the posted documents as the evidentiary window the government chose to open, not the complete file.",{"type":26,"tag":115,"props":1469,"children":1471},{"id":1470},"q-do-blockchain-seizure-warrants-identify-real-people",[1472],{"type":31,"value":1473},"Q: Do blockchain seizure warrants identify real people?",{"type":26,"tag":27,"props":1475,"children":1476},{},[1477,1481],{"type":26,"tag":590,"props":1478,"children":1479},{},[1480],{"type":31,"value":706},{"type":31,"value":1482}," Sometimes, but their focus is property, not persons. Warrants name addresses, accounts, and infrastructure as the items to be seized, and affidavits describe the investigation supporting probable cause. Names can appear where service-provider records or communications tie an account to an individual, but a warrant is not a charging document or a conviction. Do not read an uncharged name in an affidavit as an adjudicated finding.",{"type":26,"tag":39,"props":1484,"children":1486},{"id":1485},"closing",[1487],{"type":31,"value":1488},"Closing",{"type":26,"tag":27,"props":1490,"children":1491},{},[1492,1494,1499],{"type":31,"value":1493},"This case study is a particularly clean example of investigative layering in a real enforcement record, but every matter differs in its facts, jurisdictions, and available evidence. If you are evaluating a trace, preparing to challenge an opposing expert, or considering whether a public seizure record can advance your client's interests, a consultation is the right next step. ",{"type":26,"tag":56,"props":1495,"children":1496},{"href":776},[1497],{"type":31,"value":1498},"Contact ConsensusIntel",{"type":31,"value":1500}," to discuss the specifics of your matter.",{"title":8,"searchDepth":783,"depth":783,"links":1502},[1503,1504,1512,1513,1514,1515,1516,1517,1523],{"id":839,"depth":783,"text":842},{"id":917,"depth":783,"text":920,"children":1505},[1506,1507,1508,1509,1510,1511],{"id":946,"depth":789,"text":949},{"id":966,"depth":789,"text":969},{"id":993,"depth":789,"text":996},{"id":1004,"depth":789,"text":1007},{"id":1015,"depth":789,"text":1018},{"id":1026,"depth":789,"text":1029},{"id":1037,"depth":783,"text":1040},{"id":1079,"depth":783,"text":1082},{"id":1158,"depth":783,"text":1161},{"id":1284,"depth":783,"text":1287},{"id":1355,"depth":783,"text":1358},{"id":689,"depth":783,"text":692,"children":1518},[1519,1520,1521,1522],{"id":1425,"depth":789,"text":1428},{"id":1440,"depth":789,"text":1443},{"id":1455,"depth":789,"text":1458},{"id":1470,"depth":789,"text":1473},{"id":1485,"depth":783,"text":1488},"content:articles:39-crypto-seizure-warrant-trace-hamas-2026.md","articles\u002F39-crypto-seizure-warrant-trace-hamas-2026.md","articles\u002F39-crypto-seizure-warrant-trace-hamas-2026",{"_path":1528,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":1529,"description":1530,"slug":1531,"date":1532,"lastUpdated":1532,"author":13,"readingTime":14,"category":819,"tags":1533,"ogImage":1537,"featured":7,"body":1538,"_type":807,"_id":2069,"_source":809,"_file":2070,"_stem":2071,"_extension":812},"\u002Farticles\u002F33-bitcoin-clustering-coinjoin-payjoin","What Bitcoin clusters prove and what CoinJoin and Payjoin break","Bitcoin address clustering is an analytical inference, not an on-chain fact. CoinJoin and Payjoin can break it. For attorneys evaluating tracing reports.","bitcoin-clustering-coinjoin-payjoin","2026-07-25",[19,1534,1535,1536],"bitcoin","coinjoin","payjoin","\u002Fog\u002Fbitcoin-clustering-coinjoin-payjoin.png",{"type":23,"children":1539,"toc":2047},[1540,1545,1551,1565,1570,1575,1581,1586,1591,1597,1602,1620,1625,1639,1645,1650,1655,1661,1666,1671,1677,1709,1723,1729,1743,1748,1754,1759,1764,1770,1775,1793,1804,1835,1841,1846,1879,1907,1913,1918,1961,1967,1972,1976,1982,1991,1997,2006,2012,2021,2027,2036],{"type":26,"tag":27,"props":1541,"children":1542},{},[1543],{"type":31,"value":1544},"A Bitcoin cluster is something an analyst constructs, not something the blockchain records. When a tracing report says several addresses belong to one entity, that is a statistical inference, and its soundness depends on the specific transactions it was applied to. Collaborative transaction formats such as CoinJoin and Payjoin exist precisely to defeat the assumptions that inference relies on. This guide explains what clustering proves, when it holds, and how to test it in a report you are evaluating.",{"type":26,"tag":39,"props":1546,"children":1548},{"id":1547},"why-addresses-are-not-accounts",[1549],{"type":31,"value":1550},"Why Addresses Are Not Accounts",{"type":26,"tag":27,"props":1552,"children":1553},{},[1554,1556,1563],{"type":31,"value":1555},"Bitcoin has a public ledger of transactions, and a transaction, as Meiklejohn et al. defined it, transfers funds between public keys (",{"type":26,"tag":56,"props":1557,"children":1560},{"href":1558,"rel":1559},"https:\u002F\u002Fdiscovery.ucl.ac.uk\u002F1490261\u002F1\u002FMeiklejohn%20et%20al%20A%20fistful%20of%20bitcoins.pdf",[60],[1561],{"type":31,"value":1562},"Meiklejohn et al., A Fistful of Bitcoins, IMC 2013",{"type":31,"value":1564},"). Every transaction consumes already-existing outputs and creates new ones, and an output can be spent exactly once and in full, with any surplus going to fees or back to the spender.",{"type":26,"tag":27,"props":1566,"children":1567},{},[1568],{"type":31,"value":1569},"To pay 0.4 bitcoin while holding a single output of 1 bitcoin, a wallet does not write a 0.4 bitcoin check. It spends the full output and creates two new ones: 0.4 bitcoin to the recipient and roughly 0.6 bitcoin, minus the fee, back to a fresh address it controls. That return output is the change, and recognizing change is one of the oldest techniques in blockchain analysis.",{"type":26,"tag":27,"props":1571,"children":1572},{},[1573],{"type":31,"value":1574},"A Bitcoin address identifies a spending condition, often one involving a public key, and nothing stops one person from generating thousands of them; standard wallet design discourages reuse and issues a fresh address for each payment. A person's holdings therefore sit across many addresses with no on-chain marker connecting them. The blockchain records addresses, not people. An analyst must reconstruct the person, and clustering is that reconstruction.",{"type":26,"tag":39,"props":1576,"children":1578},{"id":1577},"what-the-common-input-heuristic-assumes",[1579],{"type":31,"value":1580},"What the Common-Input Heuristic Assumes",{"type":26,"tag":27,"props":1582,"children":1583},{},[1584],{"type":31,"value":1585},"The most powerful clustering rule is the common-input heuristic: when one transaction spends two or more inputs, those inputs are presumed to be controlled by the same entity. The intuition is that spending an output requires satisfying its spending conditions, so a transaction assembling inputs from addresses 1A and 1B looks like one wallet pulling together its own funds.",{"type":26,"tag":27,"props":1587,"children":1588},{},[1589],{"type":31,"value":1590},"The heuristic was stated and tested in that 2013 study. The authors clustered addresses by shared inputs and by behavior such as repeated payments to the same services, then re-identified clusters through controlled purchases, specifically to expose what they called \"idioms of use\" in real wallet software. The paper presents the common-input rule as Heuristic 1 and notes that earlier work had already used it.",{"type":26,"tag":115,"props":1592,"children":1594},{"id":1593},"the-assumptions-stated",[1595],{"type":31,"value":1596},"The Assumptions, Stated",{"type":26,"tag":27,"props":1598,"children":1599},{},[1600],{"type":31,"value":1601},"The rule depends on three assumptions:",{"type":26,"tag":312,"props":1603,"children":1604},{},[1605,1610,1615],{"type":26,"tag":316,"props":1606,"children":1607},{},[1608],{"type":31,"value":1609},"A single wallet constructed the transaction and selected every input.",{"type":26,"tag":316,"props":1611,"children":1612},{},[1613],{"type":31,"value":1614},"The inputs are authorized by one person or entity.",{"type":26,"tag":316,"props":1616,"children":1617},{},[1618],{"type":31,"value":1619},"No one collaborated to place different parties' inputs in one transaction.",{"type":26,"tag":27,"props":1621,"children":1622},{},[1623],{"type":31,"value":1624},"The third assumption is the vulnerable one, because the Bitcoin protocol does not require it. Signatures inside a transaction are independent of each other: the transaction is valid if every input carries a correct signature, and the network neither knows nor cares whether one, ten, or fifty people signed it.",{"type":26,"tag":27,"props":1626,"children":1627},{},[1628,1630,1637],{"type":31,"value":1629},"Gregory Maxwell made exactly this point in August 2013 when he introduced the term CoinJoin in a forum post (",{"type":26,"tag":56,"props":1631,"children":1634},{"href":1632,"rel":1633},"https:\u002F\u002Fbitcointalk.org\u002Findex.php?topic=279249.0",[60],[1635],{"type":31,"value":1636},"CoinJoin: Bitcoin privacy for the real world",{"type":31,"value":1638},"). Spending multiple addresses in one transaction, he wrote, is suggestive of common control but does not prove it, because users can agree on a set of inputs and outputs and then sign independently. Even when all three assumptions hold, a cluster is a group of addresses, not a person, and it says nothing about identity, which is a separate layer of analysis.",{"type":26,"tag":39,"props":1640,"children":1642},{"id":1641},"what-the-change-address-heuristic-assumes",[1643],{"type":31,"value":1644},"What the Change-Address Heuristic Assumes",{"type":26,"tag":27,"props":1646,"children":1647},{},[1648],{"type":31,"value":1649},"Change detection is the second pillar. Because the full value of a transaction's inputs must be accounted for, a wallet that spends more than it pays must send the surplus somewhere, and the standard design is a change output back to an address the spender controls. The heuristic runs the design backward: given a transaction whose recipient output is known, the remaining output is change and belongs to the sender.",{"type":26,"tag":27,"props":1651,"children":1652},{},[1653],{"type":31,"value":1654},"As a behavioral guess, it fails whenever behavior deviates. Meiklejohn et al. tested change-address definitions against the blockchain history then available, and their automated labeling flagged 555,348 candidate false positives, about 13 percent of labeled change addresses. A manual inspection of some of those candidates found many associated with Satoshi Dice and similar dice games, whose payouts return to the betting address and so look like reuse of a one-time change address. The lesson is that change is not marked on the blockchain. It is inferred from amount patterns, address freshness, and transaction shape, and each clue can be equivocal. Transactions with no change, round payments that resemble change, batched payments to several recipients, and payjoin all degrade the guess.",{"type":26,"tag":39,"props":1656,"children":1658},{"id":1657},"how-coinjoin-breaks-the-common-input-heuristic",[1659],{"type":31,"value":1660},"How CoinJoin Breaks the Common-Input Heuristic",{"type":26,"tag":27,"props":1662,"children":1663},{},[1664],{"type":31,"value":1665},"CoinJoin combines Bitcoin payments from multiple spenders into a single transaction, making it more difficult for an outside observer to determine which spender paid which recipient. Participants agree on a shared set of inputs and outputs, often uniform output amounts, and sign only their own inputs; the transaction is invalid until every signature is present, and no participant will sign a version that does not pay them. The result is a transaction whose inputs are held by many different people, exactly the pattern the common-input heuristic reads as a single wallet.",{"type":26,"tag":27,"props":1667,"children":1668},{},[1669],{"type":31,"value":1670},"Two consequences matter for litigation. First, a multi-input transaction can be collaborative, so an analyst should consider that possibility rather than treat common control as a given. Second, as Maxwell observed in 2013, if such transactions become widespread they improve the privacy even of people who never use them, because input co-spending stops being strong evidence of common control. A heuristic's reliability depends on the whole ecosystem, not just the transactions in your case.",{"type":26,"tag":115,"props":1672,"children":1674},{"id":1673},"privacy-tools-in-enforcement-cases",[1675],{"type":31,"value":1676},"Privacy Tools in Enforcement Cases",{"type":26,"tag":27,"props":1678,"children":1679},{},[1680,1682,1689,1691,1698,1700,1707],{"type":31,"value":1681},"Public enforcement has put clustering, and the tools designed to defeat it, before juries. Bitcoin Fog was a cryptocurrency mixer. In March 2024 a federal jury in the District of Columbia convicted Roman Sterlingov of money laundering conspiracy and related counts for operating it. The service moved well over 1.2 million bitcoin from 2011 to 2021 (",{"type":26,"tag":56,"props":1683,"children":1686},{"href":1684,"rel":1685},"https:\u002F\u002Fwww.justice.gov\u002Fusao-dc\u002Fpr\u002Fjury-finds-russian-swedish-operator-bitcoin-fog-guilty-running-darknet-cryptocurrency",[60],[1687],{"type":31,"value":1688},"USAO-DC conviction press release",{"type":31,"value":1690},"). Prosecutors described tracing the funds through the blockchain (",{"type":26,"tag":56,"props":1692,"children":1695},{"href":1693,"rel":1694},"https:\u002F\u002Fwww.justice.gov\u002Farchives\u002Fopa\u002Fpr\u002Fbitcoin-fog-operator-convicted-money-laundering-conspiracy",[60],[1696],{"type":31,"value":1697},"DOJ Office of Public Affairs",{"type":31,"value":1699},"). In November 2024 Sterlingov was sentenced to 150 months (",{"type":26,"tag":56,"props":1701,"children":1704},{"href":1702,"rel":1703},"https:\u002F\u002Fwww.justice.gov\u002Fusao-dc\u002Fpr\u002Foperator-bitcoin-fog-sentenced-more-12-years-prison-running-notorious-darknet",[60],[1705],{"type":31,"value":1706},"USAO-DC sentencing press release",{"type":31,"value":1708},").",{"type":26,"tag":27,"props":1710,"children":1711},{},[1712,1714,1721],{"type":31,"value":1713},"In April 2024 prosecutors in the Southern District of New York charged the two co-founders of Samourai Wallet, alleging that the mixing service executed over $2 billion in unlawful transactions and laundered over $100 million in criminal proceeds (",{"type":26,"tag":56,"props":1715,"children":1718},{"href":1716,"rel":1717},"https:\u002F\u002Fwww.justice.gov\u002Fusao-sdny\u002Fpr\u002Ffounders-and-ceo-cryptocurrency-mixing-service-arrested-and-charged-money-laundering",[60],[1719],{"type":31,"value":1720},"USAO-SDNY charging press release",{"type":31,"value":1722},"). Those charging figures were allegations. The same release describes Samourai's Whirlpool as coordinating batches of cryptocurrency exchanges among groups of users, the multi-input pattern the common-input heuristic reads as one wallet.",{"type":26,"tag":39,"props":1724,"children":1726},{"id":1725},"how-payjoin-breaks-the-same-assumptions-without-mixing",[1727],{"type":31,"value":1728},"How Payjoin Breaks the Same Assumptions Without Mixing",{"type":26,"tag":27,"props":1730,"children":1731},{},[1732,1734,1741],{"type":31,"value":1733},"Payjoin breaks the same heuristics with just two parties, while looking like an ordinary transaction. BIP 78, \"A Simple Payjoin Proposal,\" assigned May 1, 2019, is a protocol for two parties to negotiate a coinjoin during a payment between them (",{"type":26,"tag":56,"props":1735,"children":1738},{"href":1736,"rel":1737},"https:\u002F\u002Fgithub.com\u002Fbitcoin\u002Fbips\u002Fblob\u002Fmaster\u002Fbip-0078.mediawiki",[60],[1739],{"type":31,"value":1740},"BIP 78",{"type":31,"value":1742},"). In a normal payment the sender alone builds the transaction. In a payjoin the recipient adds one of its own inputs to the transaction that pays it and collects its own change, consolidating its coins while obscuring the sender's wallet structure.",{"type":26,"tag":27,"props":1744,"children":1745},{},[1746],{"type":31,"value":1747},"The effect on clustering is blunt. A payjoin transaction contains inputs from two independent controllers, so applying the common-input heuristic merges the customer and the merchant into one cluster, and change identification becomes ambiguous because two possible change outputs belong to two different owners. BIP 78 is explicit about the design goal: it lets the sender invalidate the standard heuristics, and with the recipient's involvement the heuristics \"can even be poisoned,\" meaning deliberately used to mislead blockchain analysis. The proposal also notes that by degrading the heuristics generally, it improves privacy for parties who never use it. The raw transaction does not label itself as a payjoin, so an analyst should not treat a routine-looking multi-input spend as proof of common control without considering the available context.",{"type":26,"tag":39,"props":1749,"children":1751},{"id":1750},"hypothetical-example-a-cluster-that-merges-a-customer-and-a-merchant",[1752],{"type":31,"value":1753},"Hypothetical Example: A Cluster That Merges a Customer and a Merchant",{"type":26,"tag":27,"props":1755,"children":1756},{},[1757],{"type":31,"value":1758},"Hypothetical example: A vendor report in a civil fraud case clusters addresses 1A, 1B, and 1C and states that the defendant controls all three. Transaction 1 has two inputs, 1A and 1B, and two outputs: 0.7 bitcoin to an exchange deposit address and 0.3 bitcoin back to 1B. The tool applies the common-input rule and assigns 1A and 1B to one cluster. Transaction 2 spends 0.3 bitcoin from 1B to 1C with no change output, and the change heuristic attaches 1C to the same wallet. The report now shows one defendant funneling funds from a three-address cluster into an exchange.",{"type":26,"tag":27,"props":1760,"children":1761},{},[1762],{"type":31,"value":1763},"Change one fact: 1A belongs to a customer and 1B to a merchant who accepted a payjoin. The customer paid 0.7 bitcoin; the merchant contributed its own input and took its own change. Transaction 2 is the merchant moving its remaining funds to a second wallet. The actual facts show two unrelated people, and the defendant was never involved. The cluster is a false positive produced by applying a systemic heuristic to a transaction designed to defeat it, and every downstream conclusion about the defendant inherits the error.",{"type":26,"tag":39,"props":1765,"children":1767},{"id":1766},"from-cluster-to-service-to-person",[1768],{"type":31,"value":1769},"From Cluster to Service to Person",{"type":26,"tag":27,"props":1771,"children":1772},{},[1773],{"type":31,"value":1774},"A cluster is the first layer of attribution, not the last. Sound analysis distinguishes three layers:",{"type":26,"tag":312,"props":1776,"children":1777},{},[1778,1783,1788],{"type":26,"tag":316,"props":1779,"children":1780},{},[1781],{"type":31,"value":1782},"Cluster: addresses linked by heuristics.",{"type":26,"tag":316,"props":1784,"children":1785},{},[1786],{"type":31,"value":1787},"Service: contact with addresses attributable to exchanges or other businesses with identity records.",{"type":26,"tag":316,"props":1789,"children":1790},{},[1791],{"type":31,"value":1792},"Person: account records, device evidence, or admissions tying the account to an individual.",{"type":26,"tag":27,"props":1794,"children":1795},{},[1796,1798,1803],{"type":31,"value":1797},"A vendor's entity tag usually reflects layers 1 and 2. It is a cluster that the vendor has labeled with a name based on its own accumulated observations, and it is not identity. The blockchain alone cannot name a person; that step requires subpoenaed records and other off-chain evidence, as explained in ",{"type":26,"tag":56,"props":1799,"children":1800},{"href":1348},[1801],{"type":31,"value":1802},"Can Blockchain Transactions Be Traced?",{"type":31,"value":381},{"type":26,"tag":27,"props":1805,"children":1806},{},[1807,1809,1816,1818,1824,1826,1833],{"type":31,"value":1808},"The February 2022 Bitfinex announcement illustrates how attribution actually lands. The Justice Department arrested Ilya Lichtenstein and Heather Morgan and charged a conspiracy to launder 119,754 bitcoin stolen in the 2016 Bitfinex hack. At the February 2022 arrest that stolen bitcoin was valued at about $4.5 billion, and the government announced a seizure of over $3.6 billion (",{"type":26,"tag":56,"props":1810,"children":1813},{"href":1811,"rel":1812},"https:\u002F\u002Fwww.justice.gov\u002Fusao-dc\u002Fpr\u002Ftwo-arrested-alleged-conspiracy-launder-45-billion-stolen-cryptocurrency",[60],[1814],{"type":31,"value":1815},"USAO-DC press release",{"type":31,"value":1817},"). Both later pleaded guilty to money laundering conspiracy, and Lichtenstein was sentenced in November 2024 to 60 months (",{"type":26,"tag":56,"props":1819,"children":1822},{"href":1820,"rel":1821},"https:\u002F\u002Fwww.justice.gov\u002Fusao-dc\u002Fpr\u002Fbitfinex-hacker-sentenced-money-laundering-conspiracy-involving-billions-stolen",[60],[1823],{"type":31,"value":1706},{"type":31,"value":1825},"). The February 2022 IRS-CI affidavit states that agents traced the stolen funds on the Bitcoin blockchain as they moved across accounts and platforms. Naming the couple required off-chain material, including exchange account records in their names. A file in a Lichtenstein cloud account listing 2,000 addresses with their private keys was used to seize the remaining stolen wallet (",{"type":26,"tag":56,"props":1827,"children":1830},{"href":1828,"rel":1829},"https:\u002F\u002Fwww.justice.gov\u002Farchives\u002Fopa\u002Fpress-release\u002Ffile\u002F1470211\u002Fdl",[60],[1831],{"type":31,"value":1832},"Statement of Facts",{"type":31,"value":1834},"). On-chain analysis narrowed and corroborated the picture; the records that name people came from elsewhere.",{"type":26,"tag":39,"props":1836,"children":1838},{"id":1837},"what-a-tracing-report-must-show-to-withstand-scrutiny",[1839],{"type":31,"value":1840},"What a Tracing Report Must Show to Withstand Scrutiny",{"type":26,"tag":27,"props":1842,"children":1843},{},[1844],{"type":31,"value":1845},"Where a report rests on clustering, six things should be present, and their absence is a challenge lever:",{"type":26,"tag":312,"props":1847,"children":1848},{},[1849,1854,1859,1864,1869,1874],{"type":26,"tag":316,"props":1850,"children":1851},{},[1852],{"type":31,"value":1853},"Named heuristics, applied to identified transactions.",{"type":26,"tag":316,"props":1855,"children":1856},{},[1857],{"type":31,"value":1858},"Transaction-level exhibits: hashes, inputs, outputs, and amounts for every linkage.",{"type":26,"tag":316,"props":1860,"children":1861},{},[1862],{"type":31,"value":1863},"Confidence language. Clustering is probabilistic, and the report should say so instead of asserting that addresses \"belong to\" an entity.",{"type":26,"tag":316,"props":1865,"children":1866},{},[1867],{"type":31,"value":1868},"Competing explanations. If a transaction could be a payjoin, a CoinJoin, a shared custody arrangement, or a batched payment, the report should explain why the inference survives in this specific case.",{"type":26,"tag":316,"props":1870,"children":1871},{},[1872],{"type":31,"value":1873},"Verification of vendor labels. Which commercial platform tags were relied on, and what did the analyst verify independently?",{"type":26,"tag":316,"props":1875,"children":1876},{},[1877],{"type":31,"value":1878},"A limitations section.",{"type":26,"tag":27,"props":1880,"children":1881},{},[1882,1884,1890,1892,1898,1900,1905],{"type":31,"value":1883},"A report that offers only a dashboard screenshot and entity labels may invite a reliability challenge under Fed. R. Evid. 702 or, in Missouri state court, Mo. Rev. Stat. § 490.065. Two companion guides cover the attack and the common errors: ",{"type":26,"tag":56,"props":1885,"children":1887},{"href":1886},"\u002Fresources\u002Fchallenging-opposing-expert-blockchain-analysis",[1888],{"type":31,"value":1889},"How the Opposing Expert's Blockchain Analysis Can Be Challenged",{"type":31,"value":1891}," and ",{"type":26,"tag":56,"props":1893,"children":1895},{"href":1894},"\u002Fresources\u002Fcommon-mistakes-crypto-investigations",[1896],{"type":31,"value":1897},"Common Mistakes in Cryptocurrency Investigations",{"type":31,"value":1899},". For building the affirmative case, ConsensusIntel's ",{"type":26,"tag":56,"props":1901,"children":1902},{"href":270},[1903],{"type":31,"value":1904},"blockchain tracing services",{"type":31,"value":1906}," document methodology at the transaction level.",{"type":26,"tag":39,"props":1908,"children":1910},{"id":1909},"deposition-questions-for-cluster-based-attribution",[1911],{"type":31,"value":1912},"Deposition Questions for Cluster-Based Attribution",{"type":26,"tag":27,"props":1914,"children":1915},{},[1916],{"type":31,"value":1917},"When a report's conclusions ride on clustering, these questions test the load-bearing joints:",{"type":26,"tag":312,"props":1919,"children":1920},{},[1921,1926,1931,1936,1941,1946,1951,1956],{"type":26,"tag":316,"props":1922,"children":1923},{},[1924],{"type":31,"value":1925},"Which heuristic placed each address in this cluster, and which transactions triggered it?",{"type":26,"tag":316,"props":1927,"children":1928},{},[1929],{"type":31,"value":1930},"For each change output, what rule identified it, and what follows if that output belonged to the counterparty instead?",{"type":26,"tag":316,"props":1932,"children":1933},{},[1934],{"type":31,"value":1935},"Did you test whether any transaction in the cluster is a CoinJoin or a payjoin under BIP 78, and if not, why not?",{"type":26,"tag":316,"props":1937,"children":1938},{},[1939],{"type":31,"value":1940},"Did you validate this cluster against ground truth such as exchange records or admissions, or is it purely heuristic?",{"type":26,"tag":316,"props":1942,"children":1943},{},[1944],{"type":31,"value":1945},"What is the false positive rate for this heuristic on modern wallet data, and did you measure it in this dataset?",{"type":26,"tag":316,"props":1947,"children":1948},{},[1949],{"type":31,"value":1950},"If any two inputs in a clustered transaction were controlled by different people, which conclusions change?",{"type":26,"tag":316,"props":1952,"children":1953},{},[1954],{"type":31,"value":1955},"Which entity tags came from a commercial platform, what did you verify independently, and can another analyst reproduce your method?",{"type":26,"tag":316,"props":1957,"children":1958},{},[1959],{"type":31,"value":1960},"What off-chain evidence connects any address in this cluster to a named individual, and what does the blockchain evidence add beyond the cluster label?",{"type":26,"tag":39,"props":1962,"children":1964},{"id":1963},"limitations",[1965],{"type":31,"value":1966},"Limitations",{"type":26,"tag":27,"props":1968,"children":1969},{},[1970],{"type":31,"value":1971},"The heuristics described here were characterized on Bitcoin usage from the early 2010s, and the ecosystem has changed. Address reuse has fallen, wallets implement coin control, Lightning moves activity off the main chain, and collaborative protocols ship in mainstream software. Every such change degrades a heuristic's prior, and the degradation compounds: one misattributed address contaminates everything downstream of it in the transaction graph. Vendor methods are often proprietary, which can limit reproduction and testing. The fair summary is that clustering is a useful triage tool and a weak identity claim. Treat it as a lead to verify, not a fact to recite.",{"type":26,"tag":39,"props":1973,"children":1974},{"id":689},[1975],{"type":31,"value":692},{"type":26,"tag":115,"props":1977,"children":1979},{"id":1978},"q-does-a-cluster-label-mean-the-same-person-controlled-every-address",[1980],{"type":31,"value":1981},"Q: Does a cluster label mean the same person controlled every address?",{"type":26,"tag":27,"props":1983,"children":1984},{},[1985,1989],{"type":26,"tag":590,"props":1986,"children":1987},{},[1988],{"type":31,"value":706},{"type":31,"value":1990}," No. A cluster is an inference that addresses share a controller, usually built from common-input and change patterns, and the inference can fail. A payjoin merges a customer and a merchant into one cluster; a CoinJoin merges many unrelated people; a shared custody wallet can group several people together. Identity is a separate question answered with off-chain records such as exchange account data, device evidence, or admissions, not with the cluster label.",{"type":26,"tag":115,"props":1992,"children":1994},{"id":1993},"q-what-is-the-difference-between-coinjoin-and-payjoin",[1995],{"type":31,"value":1996},"Q: What is the difference between CoinJoin and Payjoin?",{"type":26,"tag":27,"props":1998,"children":1999},{},[2000,2004],{"type":26,"tag":590,"props":2001,"children":2002},{},[2003],{"type":31,"value":706},{"type":31,"value":2005}," CoinJoin combines payments from many spenders into one transaction, often with uniform outputs, so an observer cannot reliably map payer to payee. Payjoin, standardized in BIP 78, is a two-party variant: during an ordinary payment, the recipient adds its own input, so the transaction can defeat input-based clustering for that payment.",{"type":26,"tag":115,"props":2007,"children":2009},{"id":2008},"q-do-coinjoin-and-payjoin-make-blockchain-tracing-useless",[2010],{"type":31,"value":2011},"Q: Do CoinJoin and Payjoin make blockchain tracing useless?",{"type":26,"tag":27,"props":2013,"children":2014},{},[2015,2019],{"type":26,"tag":590,"props":2016,"children":2017},{},[2018],{"type":31,"value":706},{"type":31,"value":2020}," No. They break specific heuristics; the ledger, the amounts, the timing, and the points where funds touch exchanges remain visible. Attribution of an address to a person almost always depends on off-chain records. The practical effect is on confidence: a report that cannot exclude collaborative transactions in its dataset should state that its cluster labels are weaker than they look.",{"type":26,"tag":115,"props":2022,"children":2024},{"id":2023},"q-if-the-other-side-relies-on-a-commercial-analytics-tool-can-i-obtain-its-methodology",[2025],{"type":31,"value":2026},"Q: If the other side relies on a commercial analytics tool, can I obtain its methodology?",{"type":26,"tag":27,"props":2028,"children":2029},{},[2030,2034],{"type":26,"tag":590,"props":2031,"children":2032},{},[2033],{"type":31,"value":706},{"type":31,"value":2035}," The tool's outputs are disclosed with the report, but vendors often treat the underlying heuristics as trade secrets, and you may never see the code. The discovery fight should therefore focus on what the expert did with the output: which heuristics were applied, which transactions were tested, what ground truth was checked, and what was verified independently of the vendor. If the expert cannot defend those layers, you do not need the vendor's source code to make the point.",{"type":26,"tag":27,"props":2037,"children":2038},{},[2039,2041,2045],{"type":31,"value":2040},"Every case is different, and no article can substitute for the facts of yours. If you are evaluating a tracing report that rests on clustering, ",{"type":26,"tag":56,"props":2042,"children":2043},{"href":776},[2044],{"type":31,"value":779},{"type":31,"value":2046}," for a conversation about the specific transactions. A short review of the exhibits usually reveals whether the cluster labels survive contact with the data.",{"title":8,"searchDepth":783,"depth":783,"links":2048},[2049,2050,2053,2054,2057,2058,2059,2060,2061,2062,2063],{"id":1547,"depth":783,"text":1550},{"id":1577,"depth":783,"text":1580,"children":2051},[2052],{"id":1593,"depth":789,"text":1596},{"id":1641,"depth":783,"text":1644},{"id":1657,"depth":783,"text":1660,"children":2055},[2056],{"id":1673,"depth":789,"text":1676},{"id":1725,"depth":783,"text":1728},{"id":1750,"depth":783,"text":1753},{"id":1766,"depth":783,"text":1769},{"id":1837,"depth":783,"text":1840},{"id":1909,"depth":783,"text":1912},{"id":1963,"depth":783,"text":1966},{"id":689,"depth":783,"text":692,"children":2064},[2065,2066,2067,2068],{"id":1978,"depth":789,"text":1981},{"id":1993,"depth":789,"text":1996},{"id":2008,"depth":789,"text":2011},{"id":2023,"depth":789,"text":2026},"content:articles:33-bitcoin-clustering-coinjoin-payjoin.md","articles\u002F33-bitcoin-clustering-coinjoin-payjoin.md","articles\u002F33-bitcoin-clustering-coinjoin-payjoin",{"_path":2073,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":2074,"description":2075,"slug":2076,"date":2077,"lastUpdated":2077,"author":13,"readingTime":2078,"category":2079,"tags":2080,"ogImage":2085,"featured":7,"body":2086,"_type":807,"_id":2592,"_source":809,"_file":2593,"_stem":2594,"_extension":812},"\u002Farticles\u002F29-huione-infrastructure-seizure-chokepoints","Huione infrastructure seizure: chokepoints beyond the wallet","The June 2026 Huione seizure shows fraud counsel where to look beyond destination wallets: domains, cloud accounts, escrow services, and payment rails.","huione-infrastructure-seizure-chokepoints","2026-06-27",16,"Industry Analysis",[19,2081,2082,2083,2084],"money-laundering","subpoena","asset-recovery","enforcement","\u002Fog\u002Fhuione-infrastructure-seizure-chokepoints.png",{"type":23,"children":2087,"toc":2565},[2088,2093,2099,2113,2119,2133,2139,2162,2168,2199,2205,2210,2216,2221,2227,2239,2245,2250,2256,2261,2267,2272,2278,2290,2296,2301,2306,2312,2317,2322,2360,2365,2371,2376,2382,2387,2436,2455,2461,2475,2479,2485,2494,2500,2509,2515,2524,2530,2539,2545,2554],{"type":26,"tag":27,"props":2089,"children":2090},{},[2091],{"type":31,"value":2092},"When a fraud victim's funds vanish into a large laundering marketplace, the reflexive question is where the money ended up. The destination wallet feels like the prize: the last address in the trace, the exchange deposit, the fiat conversion. The coordinated U.S. announcements on June 23, 2026 involving Cambodia-based Huione Group show why that reflex can be a trap. The Justice Department seized a cloud computing account that hosted backend infrastructure for Huione Group subsidiaries, FinCEN proposed cutting additional Huione-linked entities off from the U.S. banking system, and OFAC sanctioned nine individuals and 26 entities linked to the Prince Group, which Treasury said used Huione Group to transfer and consolidate scam-derived assets. None of those measures was aimed at a wallet. The seizure and the proposed banking cut-off targeted Huione's operational backbone: servers, hosting accounts, and the payment rails a laundering marketplace needs to run. For fraud and asset-recovery counsel, the lesson is about evidence strategy as much as enforcement news: the assets that make a criminal network identifiable and reachable are often not wallet addresses at all.",{"type":26,"tag":39,"props":2094,"children":2096},{"id":2095},"what-the-june-2026-action-did-and-did-not-establish",[2097],{"type":31,"value":2098},"What the June 2026 Action Did and Did Not Establish",{"type":26,"tag":27,"props":2100,"children":2101},{},[2102,2104,2111],{"type":31,"value":2103},"The Huione matter has moved through a sequence of public actions since 2025, and keeping the dates and legal character of each step straight matters when you describe the case to a court or a client. These are administrative determinations and investigative actions, not adjudicated criminal findings. FinCEN acts under Section 311 of the USA PATRIOT Act, codified at 31 U.S.C. § 5318A, which authorizes special measures against foreign financial institutions of primary money laundering concern. The ",{"type":26,"tag":56,"props":2105,"children":2108},{"href":2106,"rel":2107},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fpr\u002Fjustice-department-seizes-backend-infrastructure-used-huione-group-money-laundering-services",[60],[2109],{"type":31,"value":2110},"Justice Department's June 23, 2026 announcement",{"type":31,"value":2112}," describes a seizure of a cloud computing account in an investigation conducted by the FBI's San Francisco Field Office and IRS Criminal Investigation and prosecuted by the Criminal Division's Computer Crime and Intellectual Property Section together with the U.S. Attorney's Office for the Northern District of California. No conviction has been announced in connection with the seizure, and the conduct described in the court documents remains alleged.",{"type":26,"tag":115,"props":2114,"children":2116},{"id":2115},"the-may-2025-finding-and-proposed-rule",[2117],{"type":31,"value":2118},"The May 2025 finding and proposed rule",{"type":26,"tag":27,"props":2120,"children":2121},{},[2122,2124,2131],{"type":31,"value":2123},"On May 1, 2025, FinCEN issued a finding and notice of proposed rulemaking identifying Huione Group, described as a Cambodia-based corporate conglomerate, as a financial institution of primary money laundering concern. In that ",{"type":26,"tag":56,"props":2125,"children":2128},{"href":2126,"rel":2127},"https:\u002F\u002Fwww.fincen.gov\u002Fnews\u002Fnews-releases\u002Ffincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern",[60],[2129],{"type":31,"value":2130},"NPRM",{"type":31,"value":2132},", FinCEN stated its investigation found that Huione Group laundered at least $4 billion in illicit proceeds between August 2021 and January 2025, including at least $37 million derived from cyber heists conducted by the Democratic People's Republic of Korea, at least $36 million from convertible virtual currency investment scams, and $300 million from other cyber scams. FinCEN also observed that none of the three Huione Group components it examined had published anti-money laundering or KYC policies. These are FinCEN's administrative findings, the official factual predicates for the rule that followed, not decisions of any court.",{"type":26,"tag":115,"props":2134,"children":2136},{"id":2135},"the-october-2025-final-rule",[2137],{"type":31,"value":2138},"The October 2025 final rule",{"type":26,"tag":27,"props":2140,"children":2141},{},[2142,2144,2151,2153,2160],{"type":31,"value":2143},"On October 14, 2025, FinCEN issued a ",{"type":26,"tag":56,"props":2145,"children":2148},{"href":2146,"rel":2147},"https:\u002F\u002Fwww.fincen.gov\u002Fnews\u002Fnews-releases\u002Ffincen-issues-final-rule-severing-huione-group-us-financial-system",[60],[2149],{"type":31,"value":2150},"final rule severing Huione Group from the U.S. financial system",{"type":31,"value":2152},". The ",{"type":26,"tag":56,"props":2154,"children":2157},{"href":2155,"rel":2156},"https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2025\u002F10\u002F16\u002F2025-19571\u002Fimposition-of-special-measure-regarding-huione-group-as-a-foreign-financial-institution-of-primary",[60],[2158],{"type":31,"value":2159},"Federal Register text",{"type":31,"value":2161}," (90 FR 48295, published October 16, 2025) makes the rule effective November 17, 2025; it is codified at 31 CFR 1010.664. Covered financial institutions may not open or maintain a correspondent account in the United States for or on behalf of Huione Group, and must take reasonable steps not to process a transaction for a foreign bank's U.S. correspondent account if the transaction involves Huione Group. The mechanism matters for your practice. The rule restricts U.S. correspondent-account access. It is not a direct on-chain freeze or a recovery order. FinCEN described Huione Group as a critical node for laundering proceeds of cyber heists and virtual currency investment scams, commonly called pig butchering scams.",{"type":26,"tag":115,"props":2163,"children":2165},{"id":2164},"the-june-23-2026-coordinated-action",[2166],{"type":31,"value":2167},"The June 23, 2026 coordinated action",{"type":26,"tag":27,"props":2169,"children":2170},{},[2171,2173,2179,2181,2188,2190,2197],{"type":31,"value":2172},"On June 23, 2026, three agencies acted on the same day. The ",{"type":26,"tag":56,"props":2174,"children":2176},{"href":2106,"rel":2175},[60],[2177],{"type":31,"value":2178},"DOJ seized the cloud computing account",{"type":31,"value":2180}," that hosted backend infrastructure for Huione Group subsidiaries. According to court documents, that account was used to help operate Huione Guarantee, also known as Haowang Guarantee. The department credited the intelligence teams at Chainalysis and Elliptic and Google's CyberCrime Investigation Team with voluntarily providing information. FinCEN ",{"type":26,"tag":56,"props":2182,"children":2185},{"href":2183,"rel":2184},"https:\u002F\u002Fwww.fincen.gov\u002Fnews\u002Fnews-releases\u002Ffincen-proposes-sever-h-pay-service-plc-and-other-huione-group-successor",[60],[2186],{"type":31,"value":2187},"proposed a rule",{"type":31,"value":2189}," amending the October 2025 final rule to add Cambodia-based H-Pay Service PLC and any successor entity to the definition of Huione Group, expressly to counter attempts to circumvent the 2025 ban. The same day, the ",{"type":26,"tag":56,"props":2191,"children":2194},{"href":2192,"rel":2193},"https:\u002F\u002Fhome.treasury.gov\u002Fnews\u002Fpress-releases\u002Fsb0538",[60],[2195],{"type":31,"value":2196},"Treasury Department",{"type":31,"value":2198}," reported that OFAC sanctioned nine individuals and 26 entities linked to the Prince Group transnational criminal organization, which Treasury described as having used Huione Group to transfer and consolidate scam-derived assets. The DOJ release notes the seizure is part of Operation Riptide, an FBI campaign against the infrastructure and financial networks behind cyber-enabled fraud.",{"type":26,"tag":115,"props":2200,"children":2202},{"id":2201},"what-remains-allegation",[2203],{"type":31,"value":2204},"What remains allegation",{"type":26,"tag":27,"props":2206,"children":2207},{},[2208],{"type":31,"value":2209},"Every description of this conduct in the DOJ release is framed as allegation: that Huione Group subsidiaries assisted transfers of fraud proceeds and their conversion into the legitimate banking sector undetected; that Huione Guarantee operated Telegram channels discussing stolen credit card and identity information, malware-enabled theft, procurement of individuals for human trafficking schemes, and laundering of romance and investment scam proceeds; and that Huione Guarantee provided escrow services to criminals, including cryptocurrency money launderers. The department also reported that law enforcement has continuously traced cyber-enabled fraud proceeds to cryptocurrency addresses attributed to Huione Group, including Huione Guarantee. Tracing language of that kind is an investigative assertion, not a judicial finding, and \"attributed to\" is precisely the kind of probabilistic conclusion an analyst can explain and an opponent can probe. If you cite this action in a filing, attribute it as an allegation or government assertion, with the date and source.",{"type":26,"tag":39,"props":2211,"children":2213},{"id":2212},"mapping-the-chokepoints-five-layers-beyond-the-wallet",[2214],{"type":31,"value":2215},"Mapping the Chokepoints: Five Layers Beyond the Wallet",{"type":26,"tag":27,"props":2217,"children":2218},{},[2219],{"type":31,"value":2220},"The value of the Huione record for your cases is how it separates the network into layers an investigator can act on. A wallet-only picture gives you a long list of addresses and a label. An infrastructure picture gives you accounts, providers, and possible record sources. Five layers are worth internalizing.",{"type":26,"tag":115,"props":2222,"children":2224},{"id":2223},"the-wallet-layer",[2225],{"type":31,"value":2226},"The wallet layer",{"type":26,"tag":27,"props":2228,"children":2229},{},[2230,2232,2237],{"type":31,"value":2231},"This is where most investigations start and, often, where they stall. On-chain analysis can cluster addresses, identify exchange deposit addresses, and show the logical flow of value, but it produces nothing documentary about people, as ",{"type":26,"tag":56,"props":2233,"children":2234},{"href":1348},[2235],{"type":31,"value":2236},"how blockchain transactions can be traced",{"type":31,"value":2238}," explains in detail. The Huione record shows the ceiling of this layer: even with sophisticated attribution, the government described addresses as attributed to the group rather than proven to be controlled by it.",{"type":26,"tag":115,"props":2240,"children":2242},{"id":2241},"the-escrow-and-marketplace-layer",[2243],{"type":31,"value":2244},"The escrow and marketplace layer",{"type":26,"tag":27,"props":2246,"children":2247},{},[2248],{"type":31,"value":2249},"Huione Guarantee's escrow function is the most instructive piece of the record for counsel. An escrow service may hold deposits, release them on confirmation, and create records of payments and counterparties. If your victim's funds moved through an escrow service, the service's operators and records may be investigative targets, and the escrow addresses are a mapping point between the victim's trace and the network's internal accounting.",{"type":26,"tag":115,"props":2251,"children":2253},{"id":2252},"the-communications-layer",[2254],{"type":31,"value":2255},"The communications layer",{"type":26,"tag":27,"props":2257,"children":2258},{},[2259],{"type":31,"value":2260},"The Telegram channels are operational assets in the same sense a storefront is. Admin accounts, invitation links, and channel metadata can provide leads to individuals, while public channel content can show what the marketplace advertised and how it instructed users. Public content changes or disappears, so make time-stamped captures when you first see a channel.",{"type":26,"tag":115,"props":2262,"children":2264},{"id":2263},"the-hosting-and-domain-layer",[2265],{"type":31,"value":2266},"The hosting and domain layer",{"type":26,"tag":27,"props":2268,"children":2269},{},[2270],{"type":31,"value":2271},"The seized cloud account hosted backend infrastructure, and that is the quiet core of the case. Domains resolve to hosting, and hosting sits in accounts that may contain billing emails, payment instruments, phone numbers, or IP logs. A domain registration or hosting account may provide record leads that an address alone does not. The DOJ action illustrates why an account that operates a marketplace can be an investigative target. Whether civil process reaches a registrar or cloud provider depends on jurisdiction, the provider, and applicable law.",{"type":26,"tag":115,"props":2273,"children":2275},{"id":2274},"the-financial-rails-layer",[2276],{"type":31,"value":2277},"The financial rails layer",{"type":26,"tag":27,"props":2279,"children":2280},{},[2281,2283,2289],{"type":31,"value":2282},"The FinCEN action and the DOJ's description of converting proceeds into the legitimate banking sector undetected point at the same chokepoint from two directions: the fiat interface. Correspondent banking, payment processors, money services businesses, and exchange accounts are the places where cryptocurrency becomes spendable money and where KYC and record-keeping attach. If your trace ends at a conversion, the records of whoever performed it are the bridge from an address to a person. Flows that move across blockchains before conversion add another layer of complexity, covered in ",{"type":26,"tag":56,"props":2284,"children":2286},{"href":2285},"\u002Fresources\u002Fcross-chain-bridges-asset-tracing",[2287],{"type":31,"value":2288},"an explainer on cross-chain bridges and asset tracing",{"type":31,"value":381},{"type":26,"tag":39,"props":2291,"children":2293},{"id":2292},"why-infrastructure-evidence-can-be-stronger-than-a-wallet-label",[2294],{"type":31,"value":2295},"Why Infrastructure Evidence Can Be Stronger Than a Wallet Label",{"type":26,"tag":27,"props":2297,"children":2298},{},[2299],{"type":31,"value":2300},"Attribution is the weak point of pure on-chain work. Address clustering is heuristic: strong in aggregate, probabilistic in individual cases, and always open to challenge about whether a conclusion that an address belongs to a person is actually grounded. A wallet label, however confidently stated, is an inference. An operational account is different. A cloud account, a domain registration, a payment processor relationship, or a bank relationship may leave identity-bearing records such as billing details, KYC files, and device or IP logs. Where available through appropriate process, those records can corroborate or test an analyst's inference.",{"type":26,"tag":27,"props":2302,"children":2303},{},[2304],{"type":31,"value":2305},"There is also an asymmetry worth exploiting. Criminals can mint unlimited addresses, but banking relationships, hosting accounts, and merchant accounts may take time to establish and can create provider records. The DOJ release shows the pattern: the operational target was the account that ran the marketplace. In a private matter, the same logic supports early attention to possible provider records, rather than months of address counting alone. The analyst's question should shift from where the funds went to what assets the network needs to keep operating, and who holds the records for those assets.",{"type":26,"tag":39,"props":2307,"children":2309},{"id":2308},"turning-infrastructure-leads-into-preservation-and-subpoena-targets",[2310],{"type":31,"value":2311},"Turning Infrastructure Leads into Preservation and Subpoena Targets",{"type":26,"tag":27,"props":2313,"children":2314},{},[2315],{"type":31,"value":2316},"Hypothetical example: your client lost $180,000 to an investment scam that directed deposits to a wallet cluster that a tracing analyst tied to an escrow service advertising on a messaging app. The wallet-only plan is to keep following addresses and hope for a lucky break. The infrastructure plan asks five questions. What domains does the service use, and who registered them? What hosting or cloud account serves the site, and what billing identifiers does it carry? What messenger channels and admin accounts does the service operate, and what do invitation links reveal? Which payment processors, money services businesses, or exchanges converted deposits to fiat, and are any U.S.-based? Which accounts received the fiat outflows? Each answer identifies a possible record holder and requires a separate analysis of what process, if any, can reach the records. A lawful production may include an operator name, a phone number, or a bank account that an address list does not itself disclose.",{"type":26,"tag":27,"props":2318,"children":2319},{},[2320],{"type":31,"value":2321},"Useful discovery questions for the provider or the opponent, adapted to your theory of the case:",{"type":26,"tag":394,"props":2323,"children":2324},{},[2325,2330,2335,2340,2345,2350,2355],{"type":26,"tag":316,"props":2326,"children":2327},{},[2328],{"type":31,"value":2329},"Which wallet addresses received marketplace deposits and which paid out, and over what period?",{"type":26,"tag":316,"props":2331,"children":2332},{},[2333],{"type":31,"value":2334},"What brand names, domains, and pages did the operation use, and who administers them?",{"type":26,"tag":316,"props":2336,"children":2337},{},[2338],{"type":31,"value":2339},"Who is the registrant of each domain, and what payment method was used at registration?",{"type":26,"tag":316,"props":2341,"children":2342},{},[2343],{"type":31,"value":2344},"Which hosting, cloud, or content delivery accounts serve the infrastructure, and what billing and access records do they carry?",{"type":26,"tag":316,"props":2346,"children":2347},{},[2348],{"type":31,"value":2349},"What messenger channels and groups are operated, and what account identifiers and IP logs attach to their administrators?",{"type":26,"tag":316,"props":2351,"children":2352},{},[2353],{"type":31,"value":2354},"Which exchanges, payment processors, or money services businesses handled conversions, and what KYC and counterparty records do they hold?",{"type":26,"tag":316,"props":2356,"children":2357},{},[2358],{"type":31,"value":2359},"Which bank accounts received the fiat withdrawals, and under whose names?",{"type":26,"tag":27,"props":2361,"children":2362},{},[2363],{"type":31,"value":2364},"Direct requests to the institution that holds the records: cloud providers, registrars, messaging platforms, exchanges, payment processors, and banks. For each provider, assess jurisdiction, the governing discovery rules, and statutory limits on disclosure before requesting preservation or serving process. Foreign institutions raise the problems covered in the limitations section below.",{"type":26,"tag":39,"props":2366,"children":2368},{"id":2367},"disruption-is-not-recovery-separate-the-objectives",[2369],{"type":31,"value":2370},"Disruption Is Not Recovery: Separate the Objectives",{"type":26,"tag":27,"props":2372,"children":2373},{},[2374],{"type":31,"value":2375},"Read the June 23 announcement for what it does not promise: it does not announce victim restitution. The announcement describes a seizure intended to disrupt infrastructure, not to repay investors, and disruption, compensation, and forfeiture are different tracks with different evidence requirements. Criminal restitution and forfeiture can return funds to victims, and the DOJ notes that its computer crime section has secured court orders for the return of over $350 million in victim funds since 2020, but that money comes from separate proceedings on their own timelines. Civil recovery for your client depends on your own tracing, freezing steps, and judgment collection against identifiable assets. A government seizure does not substitute for private recovery, and it does not end one. It can help in two ways: the public record names components for further investigation, and an IC3 complaint is a legitimate channel for victims because law enforcement uses those complaints in its investigations. Treat disruption news as context, not recovery.",{"type":26,"tag":39,"props":2377,"children":2379},{"id":2378},"a-reusable-investigation-plan-for-private-counsel",[2380],{"type":31,"value":2381},"A Reusable Investigation Plan for Private Counsel",{"type":26,"tag":27,"props":2383,"children":2384},{},[2385],{"type":31,"value":2386},"Nothing in this plan borrows government powers. You cannot seize a domain, block a bank account, or sanction anyone as a private attorney. You can request preservation, pursue lawful discovery, trace, litigate, and refer matters to agencies that hold the disruptive tools. The plan:",{"type":26,"tag":312,"props":2388,"children":2389},{},[2390,2395,2406,2411,2416,2421,2426,2431],{"type":26,"tag":316,"props":2391,"children":2392},{},[2393],{"type":31,"value":2394},"Fix the starting facts: the victim's bank trail, receipts, communications, and any wallet addresses or transaction identifiers already in hand.",{"type":26,"tag":316,"props":2396,"children":2397},{},[2398,2400,2405],{"type":31,"value":2399},"Commission tracing from the known addresses into the network, and require the analyst to state confidence levels and to separate address facts from attribution, following the discipline in ",{"type":26,"tag":56,"props":2401,"children":2402},{"href":1894},[2403],{"type":31,"value":2404},"common mistakes in cryptocurrency investigations",{"type":31,"value":381},{"type":26,"tag":316,"props":2407,"children":2408},{},[2409],{"type":31,"value":2410},"Map the operational surface: domains, hosting, messenger channels, escrow pages, payment pages, and advertised payment methods.",{"type":26,"tag":316,"props":2412,"children":2413},{},[2414],{"type":31,"value":2415},"Correlate identity anchors across that surface: registrant details, billing emails, reused usernames, invitation mechanics, and shared admin accounts.",{"type":26,"tag":316,"props":2417,"children":2418},{},[2419],{"type":31,"value":2420},"Preserve before interrogating: time-stamped captures of public pages and channels, preservation requests to providers, and early process where jurisdiction and the governing rules permit it.",{"type":26,"tag":316,"props":2422,"children":2423},{},[2424],{"type":31,"value":2425},"Assess the fiat interface: where conversions occurred, which institutions processed them, and which accounts received the money.",{"type":26,"tag":316,"props":2427,"children":2428},{},[2429],{"type":31,"value":2430},"Choose the forum and theory after the identity evidence exists, from civil claims against identified operators to support for a criminal referral.",{"type":26,"tag":316,"props":2432,"children":2433},{},[2434],{"type":31,"value":2435},"Set expectations with the client: agency disruption may outpace private recovery, funds may keep moving, and everything must be documented for eventual expert testimony.",{"type":26,"tag":27,"props":2437,"children":2438},{},[2439,2441,2446,2448,2453],{"type":31,"value":2440},"For engagements structured around this sequence, ",{"type":26,"tag":56,"props":2442,"children":2443},{"href":270},[2444],{"type":31,"value":2445},"ConsensusIntel's blockchain tracing service",{"type":31,"value":2447}," covers the on-chain and infrastructure layers, and the ",{"type":26,"tag":56,"props":2449,"children":2450},{"href":499},[2451],{"type":31,"value":2452},"documented methodology",{"type":31,"value":2454}," explains how findings are packaged for litigation.",{"type":26,"tag":39,"props":2456,"children":2458},{"id":2457},"limitations-of-this-playbook",[2459],{"type":31,"value":2460},"Limitations of This Playbook",{"type":26,"tag":27,"props":2462,"children":2463},{},[2464,2466,2473],{"type":31,"value":2465},"Several limitations are worth stating plainly. Everything in the DOJ release about the conduct of Huione Guarantee and its operators is allegation, and the cited release announces no conviction. The DOJ release does not name the cloud provider, so the practical mechanics of the seizure are unknown, and you should not extrapolate a template for how any provider will answer your requests. The FinCEN June 2026 action is a proposed rule, not a final one. The ",{"type":26,"tag":56,"props":2467,"children":2470},{"href":2468,"rel":2469},"https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2026\u002F06\u002F25\u002F2026-12794\u002Fdefinition-of-huione-group-a-financial-institution-operating-outside-the-united-states-of-primary",[60],[2471],{"type":31,"value":2472},"Federal Register NPRM",{"type":31,"value":2474}," (91 FR 38340, published June 25, 2026) set comments due July 27, 2026, and its status should be checked before you rely on it to confirm whether FinCEN has finalized the amendment adding H-Pay and successor entities to the Huione Group definition. The existing special measure at 31 CFR 1010.664 remains in effect as to Huione Group as then defined. International process is the hard case: Cambodian and other foreign providers may not respond to U.S. civil subpoenas, and data protection law may block production even from responsive providers. Public wallet labels are contested ground, and attribution language in a government release does not immunize your analysis from challenge. Finally, timing cuts both ways: the on-chain record persists, but operator content and provider records are perishable, and a criminal seizure does not preserve civil claims for you.",{"type":26,"tag":39,"props":2476,"children":2477},{"id":689},[2478],{"type":31,"value":692},{"type":26,"tag":115,"props":2480,"children":2482},{"id":2481},"q-does-the-huione-seizure-mean-my-clients-stolen-funds-will-be-returned",[2483],{"type":31,"value":2484},"Q: Does the Huione seizure mean my client's stolen funds will be returned?",{"type":26,"tag":27,"props":2486,"children":2487},{},[2488,2492],{"type":26,"tag":590,"props":2489,"children":2490},{},[2491],{"type":31,"value":706},{"type":31,"value":2493}," Not by itself. The June 23, 2026 announcements describe disruption actions, not a restitution plan. Recovery for a private victim still depends on identifying specific assets, freezing or attaching them, and obtaining a judgment or settlement. Treat the seizure as context for further investigation, not as a recovery event, and preserve and trace your own evidence promptly.",{"type":26,"tag":115,"props":2495,"children":2497},{"id":2496},"q-the-government-says-funds-were-traced-to-huione-addresses-is-that-proof-the-group-controlled-those-wallets",[2498],{"type":31,"value":2499},"Q: The government says funds were traced to Huione addresses. Is that proof the group controlled those wallets?",{"type":26,"tag":27,"props":2501,"children":2502},{},[2503,2507],{"type":26,"tag":590,"props":2504,"children":2505},{},[2506],{"type":31,"value":706},{"type":31,"value":2508}," No. \"Attributed to\" is an investigative conclusion, not an adjudicated fact. It can support an investigative lead, but it does not by itself prove control. In your own matter, require the analyst to separate what the blockchain shows, that addresses moved value at specific times, from what is inferred, who controlled them, and be prepared to defend each inference.",{"type":26,"tag":115,"props":2510,"children":2512},{"id":2511},"q-can-private-counsel-subpoena-the-same-providers-the-government-used-such-as-cloud-and-hosting-companies",[2513],{"type":31,"value":2514},"Q: Can private counsel subpoena the same providers the government used, such as cloud and hosting companies?",{"type":26,"tag":27,"props":2516,"children":2517},{},[2518,2522],{"type":26,"tag":590,"props":2519,"children":2520},{},[2521],{"type":31,"value":706},{"type":31,"value":2523}," Sometimes. A U.S.-based provider may be reachable through civil discovery for records it may lawfully disclose, but jurisdiction, the applicable discovery rules, and statutes governing electronic communications can limit what private counsel can obtain. A preservation request does not itself compel retention. Foreign providers add problems of service, jurisdiction, and data protection law. Map the infrastructure early, then identify the provider, record type, and available process before content disappears.",{"type":26,"tag":115,"props":2525,"children":2527},{"id":2526},"q-what-is-section-311-and-why-does-a-correspondent-account-ban-matter-for-my-case",[2528],{"type":31,"value":2529},"Q: What is Section 311 and why does a correspondent account ban matter for my case?",{"type":26,"tag":27,"props":2531,"children":2532},{},[2533,2537],{"type":26,"tag":590,"props":2534,"children":2535},{},[2536],{"type":31,"value":706},{"type":31,"value":2538}," Section 311 of the USA PATRIOT Act, codified at 31 U.S.C. § 5318A, lets FinCEN impose special measures on foreign financial institutions of primary money laundering concern. Special measure five, the correspondent-account prohibition, may be imposed only by regulation. Following its May 2025 finding and proposal, FinCEN's October 2025 final rule (31 CFR 1010.664) prohibits covered financial institutions from opening or maintaining a U.S. correspondent account for or on behalf of Huione Group, and requires them to take reasonable steps not to process a transaction for a foreign bank's U.S. correspondent account if the transaction involves Huione Group. The ban closes U.S. dollar correspondent access. It is an access control on U.S. bank clearing, not a recovery mechanism and not a bar on conversion outside that channel, but it explains where the network's U.S. vulnerability sits.",{"type":26,"tag":115,"props":2540,"children":2542},{"id":2541},"q-what-should-my-client-do-today-if-their-funds-went-through-a-similar-marketplace",[2543],{"type":31,"value":2544},"Q: What should my client do today if their funds went through a similar marketplace?",{"type":26,"tag":27,"props":2546,"children":2547},{},[2548,2552],{"type":26,"tag":590,"props":2549,"children":2550},{},[2551],{"type":31,"value":706},{"type":31,"value":2553}," Preserve everything perishable: bank statements, receipts, conversation screenshots, channel and page captures with timestamps, and any wallet addresses or transaction identifiers. If the conduct affected U.S. persons, report it to the FBI's IC3, since those complaints feed investigations. Then have the likely flow traced from the known addresses before more time passes. The on-chain record will wait for you; the operator's content and the provider's records will not.",{"type":26,"tag":27,"props":2555,"children":2556},{},[2557,2559,2563],{"type":31,"value":2558},"The Huione record is a reminder that a laundering network is a business: it has infrastructure, accounts, and providers, and those assets generate evidence that wallets never will. Every case turns on its own facts, timelines, and jurisdictions, so the right move for a specific matter is a conversation about what is actually available. If yours involves funds that passed through a marketplace or escrow service, ",{"type":26,"tag":56,"props":2560,"children":2561},{"href":776},[2562],{"type":31,"value":779},{"type":31,"value":2564}," with the facts and the timeline.",{"title":8,"searchDepth":783,"depth":783,"links":2566},[2567,2573,2580,2581,2582,2583,2584,2585],{"id":2095,"depth":783,"text":2098,"children":2568},[2569,2570,2571,2572],{"id":2115,"depth":789,"text":2118},{"id":2135,"depth":789,"text":2138},{"id":2164,"depth":789,"text":2167},{"id":2201,"depth":789,"text":2204},{"id":2212,"depth":783,"text":2215,"children":2574},[2575,2576,2577,2578,2579],{"id":2223,"depth":789,"text":2226},{"id":2241,"depth":789,"text":2244},{"id":2252,"depth":789,"text":2255},{"id":2263,"depth":789,"text":2266},{"id":2274,"depth":789,"text":2277},{"id":2292,"depth":783,"text":2295},{"id":2308,"depth":783,"text":2311},{"id":2367,"depth":783,"text":2370},{"id":2378,"depth":783,"text":2381},{"id":2457,"depth":783,"text":2460},{"id":689,"depth":783,"text":692,"children":2586},[2587,2588,2589,2590,2591],{"id":2481,"depth":789,"text":2484},{"id":2496,"depth":789,"text":2499},{"id":2511,"depth":789,"text":2514},{"id":2526,"depth":789,"text":2529},{"id":2541,"depth":789,"text":2544},"content:articles:29-huione-infrastructure-seizure-chokepoints.md","articles\u002F29-huione-infrastructure-seizure-chokepoints.md","articles\u002F29-huione-infrastructure-seizure-chokepoints",{"_path":2596,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":2597,"description":2598,"slug":2599,"date":2600,"lastUpdated":2600,"author":13,"readingTime":2601,"category":819,"tags":2602,"ogImage":2605,"featured":7,"body":2606,"_type":807,"_id":3616,"_source":809,"_file":3617,"_stem":3618,"_extension":812},"\u002Farticles\u002F27-evm-receipts-logs-execution-traces","Beyond the transaction hash: receipts, logs, and EVM traces","A transaction hash proves submission, not success. Receipts, event logs, and EVM traces answer whether execution succeeded and what assets moved.","evm-receipts-logs-execution-traces","2026-06-13",12,[2603,2604,19,20],"ethereum","smart-contracts","\u002Fog\u002Fevm-receipts-logs-execution-traces.png",{"type":23,"children":2607,"toc":3597},[2608,2620,2626,2693,2726,2732,2791,2821,2827,2878,2884,2897,2972,3007,3013,3058,3086,3143,3149,3154,3191,3217,3223,3231,3243,3276,3310,3336,3371,3376,3382,3387,3392,3397,3402,3407,3412,3418,3487,3491,3496,3500,3506,3529,3535,3544,3550,3571,3577,3586],{"type":26,"tag":27,"props":2609,"children":2610},{},[2611,2613,2619],{"type":31,"value":2612},"A transaction hash is where most investigations start and where too many stop. The hash identifies the envelope: the signed message broadcast to the network, containing the sender, the recipient, the value, and the input data. It does not say whether execution succeeded, which contracts actually ran, or what assets moved. Those facts live in other artifacts: the receipt, the event logs, the call tree, and the execution trace. Each answers a different question and each carries different evidentiary weight. Explorer pages fuse these layers into one screen, which is exactly why lawyers overstate what a hash proves. For the fundamentals of reading a single transaction, ",{"type":26,"tag":56,"props":2614,"children":2616},{"href":2615},"\u002Fresources\u002Fhow-to-read-a-blockchain-transaction",[2617],{"type":31,"value":2618},"start with the basic guide",{"type":31,"value":381},{"type":26,"tag":39,"props":2621,"children":2623},{"id":2622},"why-the-transaction-hash-proves-submission-not-execution",[2624],{"type":31,"value":2625},"Why the Transaction Hash Proves Submission, Not Execution",{"type":26,"tag":27,"props":2627,"children":2628},{},[2629,2631,2638,2640,2647,2649,2655,2657,2663,2664,2670,2671,2676,2678,2684,2686,2691],{"type":31,"value":2630},"The hash is a cryptographic fingerprint of the signed transaction, computed from the transaction data at signing time. Retrieving the transaction object through ",{"type":26,"tag":2632,"props":2633,"children":2635},"code",{"className":2634},[],[2636],{"type":31,"value":2637},"eth_getTransactionByHash",{"type":31,"value":2639},", a method in the ",{"type":26,"tag":56,"props":2641,"children":2644},{"href":2642,"rel":2643},"https:\u002F\u002Fgithub.com\u002Fethereum\u002Fexecution-apis",[60],[2645],{"type":31,"value":2646},"execution-apis JSON-RPC collection",{"type":31,"value":2648},", returns the envelope: ",{"type":26,"tag":2632,"props":2650,"children":2652},{"className":2651},[],[2653],{"type":31,"value":2654},"from",{"type":31,"value":2656},", ",{"type":26,"tag":2632,"props":2658,"children":2660},{"className":2659},[],[2661],{"type":31,"value":2662},"to",{"type":31,"value":2656},{"type":26,"tag":2632,"props":2665,"children":2667},{"className":2666},[],[2668],{"type":31,"value":2669},"value",{"type":31,"value":2656},{"type":26,"tag":2632,"props":2672,"children":2674},{"className":2673},[],[2675],{"type":31,"value":1178},{"type":31,"value":2677}," data, ",{"type":26,"tag":2632,"props":2679,"children":2681},{"className":2680},[],[2682],{"type":31,"value":2683},"nonce",{"type":31,"value":2685},", gas parameters, fee fields, block number, and index. The ",{"type":26,"tag":2632,"props":2687,"children":2689},{"className":2688},[],[2690],{"type":31,"value":2654},{"type":31,"value":2692}," address is derived from the cryptographic signature, so the envelope establishes which account signed the message, not which person held that account.",{"type":26,"tag":27,"props":2694,"children":2695},{},[2696,2698,2703,2705,2710,2712,2717,2719,2724],{"type":31,"value":2697},"If ",{"type":26,"tag":2632,"props":2699,"children":2701},{"className":2700},[],[2702],{"type":31,"value":2662},{"type":31,"value":2704}," is a contract address, the ",{"type":26,"tag":2632,"props":2706,"children":2708},{"className":2707},[],[2709],{"type":31,"value":1178},{"type":31,"value":2711}," field is an encoded function call, and the envelope alone does not reveal what that function did, whether it succeeded, or whether any token changed hands. The ",{"type":26,"tag":2632,"props":2713,"children":2715},{"className":2714},[],[2716],{"type":31,"value":2669},{"type":31,"value":2718}," field carries only native ETH and only the top-level amount: a 5,000 USDC transfer typically appears with a ",{"type":26,"tag":2632,"props":2720,"children":2722},{"className":2721},[],[2723],{"type":31,"value":2669},{"type":31,"value":2725}," of zero. Confirm finality before treating a mined hash as settled: a transaction in a block reorganized out of the canonical chain can disappear from the record.",{"type":26,"tag":39,"props":2727,"children":2729},{"id":2728},"the-receipt-the-networks-verdict-on-success",[2730],{"type":31,"value":2731},"The Receipt: The Network's Verdict on Success",{"type":26,"tag":27,"props":2733,"children":2734},{},[2735,2737,2743,2744,2751,2753,2759,2761,2767,2768,2774,2775,2781,2783,2789],{"type":31,"value":2736},"Unlike a trace, a receipt is consensus data. Blocks commit a receipts root, and a node that still holds the relevant history can serve the receipt via ",{"type":26,"tag":2632,"props":2738,"children":2740},{"className":2739},[],[2741],{"type":31,"value":2742},"eth_getTransactionReceipt",{"type":31,"value":2152},{"type":26,"tag":56,"props":2745,"children":2748},{"href":2746,"rel":2747},"https:\u002F\u002Fgithub.com\u002Fethereum\u002Fexecution-apis\u002Fblob\u002Fmain\u002Fsrc\u002Fschemas\u002Freceipt.yaml",[60],[2749],{"type":31,"value":2750},"execution-apis receipt schema",{"type":31,"value":2752}," requires ",{"type":26,"tag":2632,"props":2754,"children":2756},{"className":2755},[],[2757],{"type":31,"value":2758},"status",{"type":31,"value":2760}," (after Byzantium), ",{"type":26,"tag":2632,"props":2762,"children":2764},{"className":2763},[],[2765],{"type":31,"value":2766},"gasUsed",{"type":31,"value":2656},{"type":26,"tag":2632,"props":2769,"children":2771},{"className":2770},[],[2772],{"type":31,"value":2773},"cumulativeGasUsed",{"type":31,"value":2656},{"type":26,"tag":2632,"props":2776,"children":2778},{"className":2777},[],[2779],{"type":31,"value":2780},"logs",{"type":31,"value":2782},", and ",{"type":26,"tag":2632,"props":2784,"children":2786},{"className":2785},[],[2787],{"type":31,"value":2788},"effectiveGasPrice",{"type":31,"value":2790},", the amount actually deducted per gas. Some clients prune old receipts and return a \"pruned history unavailable\" error, so confirm the node still holds the block before treating a missing receipt as proof that the transaction never existed.",{"type":26,"tag":27,"props":2792,"children":2793},{},[2794,2796,2803,2805,2812,2814,2819],{"type":31,"value":2795},"Status semantics come from ",{"type":26,"tag":56,"props":2797,"children":2800},{"href":2798,"rel":2799},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-658",[60],[2801],{"type":31,"value":2802},"EIP-658",{"type":31,"value":2804},", which replaced the receipt's intermediate state root with a status code: 1 for success, 0 for failure. The change activated with the ",{"type":26,"tag":56,"props":2806,"children":2809},{"href":2807,"rel":2808},"https:\u002F\u002Fblog.ethereum.org\u002F2017\u002F10\u002F12\u002Fbyzantium-hf-announcement",[60],[2810],{"type":31,"value":2811},"Byzantium hard fork",{"type":31,"value":2813}," at block 4,370,000 on October 16, 2017. Transactions before that fork have no status field, and failure was inferred by comparing ",{"type":26,"tag":2632,"props":2815,"children":2817},{"className":2816},[],[2818],{"type":31,"value":2766},{"type":31,"value":2820}," against the gas limit. EIP-658's own motivation explains why that heuristic became unsound: with the REVERT opcode, \"it is no longer possible for users to assume that a transaction failed iff it consumed all gas.\" For pre-Byzantium transactions, the outcome can only be reconstructed by replaying execution.",{"type":26,"tag":115,"props":2822,"children":2824},{"id":2823},"failed-transactions-still-cost-money",[2825],{"type":31,"value":2826},"Failed Transactions Still Cost Money",{"type":26,"tag":27,"props":2828,"children":2829},{},[2830,2832,2839,2841,2847,2848,2854,2856,2861,2863,2868,2870,2876],{"type":31,"value":2831},"A status of 0 means the top-level call failed and every state change rolled back. The transaction is still recorded, its nonce is consumed, and the sender pays for gas actually used. After Byzantium that is often well below the gas limit: ",{"type":26,"tag":56,"props":2833,"children":2836},{"href":2834,"rel":2835},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-140",[60],[2837],{"type":31,"value":2838},"EIP-140",{"type":31,"value":2840}," added REVERT so a contract can \"stop execution and revert state changes, without consuming all provided gas.\" Solidity ",{"type":26,"tag":2632,"props":2842,"children":2844},{"className":2843},[],[2845],{"type":31,"value":2846},"require",{"type":31,"value":1891},{"type":26,"tag":2632,"props":2849,"children":2851},{"className":2850},[],[2852],{"type":31,"value":2853},"revert",{"type":31,"value":2855}," use that opcode. Exceptional failures such as out-of-gas still consume remaining gas. ",{"type":26,"tag":2632,"props":2857,"children":2859},{"className":2858},[],[2860],{"type":31,"value":2766},{"type":31,"value":2862}," multiplied by ",{"type":26,"tag":2632,"props":2864,"children":2866},{"className":2865},[],[2867],{"type":31,"value":2788},{"type":31,"value":2869}," (or ",{"type":26,"tag":2632,"props":2871,"children":2873},{"className":2872},[],[2874],{"type":31,"value":2875},"gasPrice",{"type":31,"value":2877}," where that is the legacy price) is the fee figure, usable for damages even when the transfer failed. Success means only that the call did not revert, so no asset conclusion should rest on the status field alone.",{"type":26,"tag":39,"props":2879,"children":2881},{"id":2880},"event-logs-the-contracts-own-testimony",[2882],{"type":31,"value":2883},"Event Logs: The Contract's Own Testimony",{"type":26,"tag":27,"props":2885,"children":2886},{},[2887,2889,2895],{"type":31,"value":2888},"Logs are stored inside the receipt and emitted by contract code during execution. Each log carries the emitting contract address, up to four indexed topics, and a data payload, and history can be queried with ",{"type":26,"tag":2632,"props":2890,"children":2892},{"className":2891},[],[2893],{"type":31,"value":2894},"eth_getLogs",{"type":31,"value":2896},", filtered by address and topic signature. The \"token transfers\" panels on explorers are decodes of these logs, not independent data.",{"type":26,"tag":27,"props":2898,"children":2899},{},[2900,2902,2909,2911,2917,2919,2925,2926,2932,2934,2940,2942,2948,2950,2955,2957,2963,2965,2970],{"type":31,"value":2901},"The ",{"type":26,"tag":56,"props":2903,"children":2906},{"href":2904,"rel":2905},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-20",[60],[2907],{"type":31,"value":2908},"ERC-20 standard (EIP-20)",{"type":31,"value":2910}," requires a ",{"type":26,"tag":2632,"props":2912,"children":2914},{"className":2913},[],[2915],{"type":31,"value":2916},"Transfer",{"type":31,"value":2918}," event on every ",{"type":26,"tag":2632,"props":2920,"children":2922},{"className":2921},[],[2923],{"type":31,"value":2924},"transfer",{"type":31,"value":1891},{"type":26,"tag":2632,"props":2927,"children":2929},{"className":2928},[],[2930],{"type":31,"value":2931},"transferFrom",{"type":31,"value":2933}," call, including zero-value transfers, and an ",{"type":26,"tag":2632,"props":2935,"children":2937},{"className":2936},[],[2938],{"type":31,"value":2939},"Approval",{"type":31,"value":2941}," event on every successful ",{"type":26,"tag":2632,"props":2943,"children":2945},{"className":2944},[],[2946],{"type":31,"value":2947},"approve",{"type":31,"value":2949},". A token that creates new tokens SHOULD emit a ",{"type":26,"tag":2632,"props":2951,"children":2953},{"className":2952},[],[2954],{"type":31,"value":2916},{"type":31,"value":2956}," with ",{"type":26,"tag":2632,"props":2958,"children":2960},{"className":2959},[],[2961],{"type":31,"value":2962},"_from",{"type":31,"value":2964}," set to the zero address. Those conventions are why ",{"type":26,"tag":2632,"props":2966,"children":2968},{"className":2967},[],[2969],{"type":31,"value":2916},{"type":31,"value":2971}," logs are the backbone of token-flow reconstruction.",{"type":26,"tag":27,"props":2973,"children":2974},{},[2975,2977,2982,2984,2989,2991,2997,2999,3005],{"type":31,"value":2976},"The protocol does not enforce any of it. Events are emitted by whatever code the contract runs, and the EVM does not check whether an emitted ",{"type":26,"tag":2632,"props":2978,"children":2980},{"className":2979},[],[2981],{"type":31,"value":2916},{"type":31,"value":2983}," corresponds to a real balance change. A noncompliant contract can emit a ",{"type":26,"tag":2632,"props":2985,"children":2987},{"className":2986},[],[2988],{"type":31,"value":2916},{"type":31,"value":2990}," without moving a token, or move tokens while emitting nothing. EIP-140 notes that reverting an EVM execution means \"all changes, including LOGs, are lost,\" so a failed transaction's receipt carries no logs, and an event from a failed subcall disappears even when the surrounding transaction succeeds. Fee-on-transfer and rebasing tokens can log an amount that differs from the balance delta. Treat logs as admissions by the contract, not ground truth. Corroborate with ",{"type":26,"tag":2632,"props":2992,"children":2994},{"className":2993},[],[2995],{"type":31,"value":2996},"balanceOf",{"type":31,"value":2998}," at the relevant block via ",{"type":26,"tag":2632,"props":3000,"children":3002},{"className":3001},[],[3003],{"type":31,"value":3004},"eth_call",{"type":31,"value":3006},", check that an allowance was consumed, and confirm the flow against the call tree.",{"type":26,"tag":39,"props":3008,"children":3010},{"id":3009},"the-call-tree-what-actually-executed",[3011],{"type":31,"value":3012},"The Call Tree: What Actually Executed",{"type":26,"tag":27,"props":3014,"children":3015},{},[3016,3018,3024,3026,3033,3035,3040,3041,3047,3049,3056],{"type":31,"value":3017},"One envelope can fan out into many internal executions, and the shape of that tree is often the entire case. A contract that calls another executes the callee's code in the callee's context, with the caller as ",{"type":26,"tag":2632,"props":3019,"children":3021},{"className":3020},[],[3022],{"type":31,"value":3023},"msg.sender",{"type":31,"value":3025},". Delegatecall, the opcode ",{"type":26,"tag":56,"props":3027,"children":3030},{"href":3028,"rel":3029},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-7",[60],[3031],{"type":31,"value":3032},"added in the Homestead fork (EIP-7)",{"type":31,"value":3034},", inverts that: the callee's code runs in the caller's storage context, preserving ",{"type":26,"tag":2632,"props":3036,"children":3038},{"className":3037},[],[3039],{"type":31,"value":3023},{"type":31,"value":1891},{"type":26,"tag":2632,"props":3042,"children":3044},{"className":3043},[],[3045],{"type":31,"value":3046},"msg.value",{"type":31,"value":3048},". This is the mechanism behind ",{"type":26,"tag":56,"props":3050,"children":3053},{"href":3051,"rel":3052},"https:\u002F\u002Fwww.openzeppelin.com\u002Fnews\u002Fproxy-patterns",[60],[3054],{"type":31,"value":3055},"upgradeable proxies",{"type":31,"value":3057},", where a user calls a proxy address and the proxy delegatecalls an implementation contract. The forensic consequence is direct: the address that received the call is not necessarily the address whose code ran, and a plain transaction page will not tell you which is which.",{"type":26,"tag":27,"props":3059,"children":3060},{},[3061,3063,3068,3070,3076,3078,3084],{"type":31,"value":3062},"Routers and aggregators add a third layer. A swap transaction shows ",{"type":26,"tag":2632,"props":3064,"children":3066},{"className":3065},[],[3067],{"type":31,"value":2662},{"type":31,"value":3069}," equal to a router address; the call tree shows the router calling pair contracts, which move tokens on their own ledgers. ETH that a contract forwards onward appears only in the trace, and ERC-20 movement appears only in the token contract's logs and ledger. Where holdings pass through several protocol contracts inside one transaction, ",{"type":26,"tag":56,"props":3071,"children":3073},{"href":3072},"\u002Fresources\u002Fwhat-lawyers-need-to-know-about-defi",[3074],{"type":31,"value":3075},"tracing through DeFi mechanics",{"type":31,"value":3077}," is where that analysis gets its teeth, while ",{"type":26,"tag":56,"props":3079,"children":3081},{"href":3080},"\u002Fresources\u002Fsmart-contract-disputes",[3082],{"type":31,"value":3083},"smart contract disputes",{"type":31,"value":3085}," covers the contract interpretation and remedies side of the same record.",{"type":26,"tag":27,"props":3087,"children":3088},{},[3089,3091,3098,3100,3107,3109,3116,3118,3124,3126,3133,3135,3141],{"type":31,"value":3090},"Retrieval is where standardization ends. Tracing RPCs are client-specific: geth exposes trace methods in its ",{"type":26,"tag":56,"props":3092,"children":3095},{"href":3093,"rel":3094},"https:\u002F\u002Fgeth.ethereum.org\u002Fdocs\u002Finteracting-with-geth\u002Frpc\u002Fns-debug",[60],[3096],{"type":31,"value":3097},"debug namespace",{"type":31,"value":3099}," and documents tracing as ",{"type":26,"tag":56,"props":3101,"children":3104},{"href":3102,"rel":3103},"https:\u002F\u002Fgeth.ethereum.org\u002Fdocs\u002Fdevelopers\u002Fevm-tracing",[60],[3105],{"type":31,"value":3106},"re-running transactions locally",{"type":31,"value":3108},". ",{"type":26,"tag":56,"props":3110,"children":3113},{"href":3111,"rel":3112},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-3155",[60],[3114],{"type":31,"value":3115},"EIP-3155",{"type":31,"value":3117}," proposed a JSON format for EVM traces during state tests; it remains at Last Call and is not a finalized ",{"type":26,"tag":2632,"props":3119,"children":3121},{"className":3120},[],[3122],{"type":31,"value":3123},"debug_traceTransaction",{"type":31,"value":3125}," standard. ",{"type":26,"tag":56,"props":3127,"children":3130},{"href":3128,"rel":3129},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-1474",[60],[3131],{"type":31,"value":3132},"EIP-1474",{"type":31,"value":3134},", which cataloged JSON-RPC methods, is stagnant; the maintained specification is the ",{"type":26,"tag":56,"props":3136,"children":3138},{"href":2642,"rel":3137},[60],[3139],{"type":31,"value":3140},"execution-apis repository",{"type":31,"value":3142},". Because output depends on the client, its version, and the tracer, an expert's methodology documentation matters as much as the trace itself.",{"type":26,"tag":39,"props":3144,"children":3146},{"id":3145},"node-and-archive-requirements-for-reproducible-tracing",[3147],{"type":31,"value":3148},"Node and Archive Requirements for Reproducible Tracing",{"type":26,"tag":27,"props":3150,"children":3151},{},[3152],{"type":31,"value":3153},"Traces are re-execution, not stored data. Reproducing what a transaction did requires the state that existed at that block.",{"type":26,"tag":27,"props":3155,"children":3156},{},[3157,3159,3166,3167,3173,3175,3181,3183,3189],{"type":31,"value":3158},"A full node caches only recent state, on the order of the last 128 blocks, per ",{"type":26,"tag":56,"props":3160,"children":3163},{"href":3161,"rel":3162},"https:\u002F\u002Fethereum.org\u002Fdevelopers\u002Fdocs\u002Fnodes-and-clients\u002Farchive-nodes\u002F",[60],[3164],{"type":31,"value":3165},"ethereum.org's archive-node documentation",{"type":31,"value":1891},{"type":26,"tag":56,"props":3168,"children":3170},{"href":3102,"rel":3169},[60],[3171],{"type":31,"value":3172},"geth's tracing notes",{"type":31,"value":3174},". Older states can be regenerated from checkpoints, which becomes expensive the further back you go. Geth's default ",{"type":26,"tag":2632,"props":3176,"children":3178},{"className":3177},[],[3179],{"type":31,"value":3180},"reexec",{"type":31,"value":3182}," window is 128 blocks; beyond it, a trace fails unless the window is increased or the node is an archive node. An ",{"type":26,"tag":56,"props":3184,"children":3186},{"href":3161,"rel":3185},[60],[3187],{"type":31,"value":3188},"archive node",{"type":31,"value":3190}," stores historical states so those queries return immediately, at the cost of multiple terabytes of disk. Confirm archive-state access or provider tracing support before promising a trace of an old transaction, and record the node type, client version, sync mode, tracer, and block height.",{"type":26,"tag":27,"props":3192,"children":3193},{},[3194,3196,3201,3203,3208,3209,3215],{"type":31,"value":3195},"Opcode-level traces can run to hundreds of megabytes for a busy transaction, which makes them impractical to attach wholesale; high-level call tracers are compact but capture a different layer. Execution is deterministic given the same client, state, and tracer, but different client versions can produce different output. Our ",{"type":26,"tag":56,"props":3197,"children":3198},{"href":499},[3199],{"type":31,"value":3200},"methodology",{"type":31,"value":3202}," treats reproducibility and documented retrieval as core requirements of blockchain forensic work; for packaging this evidence for court, ConsensusIntel offers ",{"type":26,"tag":56,"props":3204,"children":3205},{"href":270},[3206],{"type":31,"value":3207},"blockchain tracing",{"type":31,"value":1891},{"type":26,"tag":56,"props":3210,"children":3212},{"href":3211},"\u002Fservices#evidence-review",[3213],{"type":31,"value":3214},"evidence review",{"type":31,"value":3216}," built around artifact-level preservation rather than explorer screenshots.",{"type":26,"tag":39,"props":3218,"children":3220},{"id":3219},"hypothetical-example-one-transaction-four-evidence-layers",[3221],{"type":31,"value":3222},"Hypothetical Example: One Transaction, Four Evidence Layers",{"type":26,"tag":27,"props":3224,"children":3225},{},[3226],{"type":26,"tag":590,"props":3227,"children":3228},{},[3229],{"type":31,"value":3230},"Hypothetical example: the addresses and amounts below are invented for illustration; no real matter is described.",{"type":26,"tag":27,"props":3232,"children":3233},{},[3234,3236,3241],{"type":31,"value":3235},"A victim account (V) has an outstanding ",{"type":26,"tag":2632,"props":3237,"children":3239},{"className":3238},[],[3240],{"type":31,"value":2947},{"type":31,"value":3242}," to an attacker-controlled contract (D) for 5,000 USDC. D was deployed with code that delegatecalls a reusable template (T). V signs a single transaction to D. The explorer shows \"Method: transfer\", \"Status: Success\", and a tokens-transferred panel reading \"USDC 5,000 from V to A\".",{"type":26,"tag":27,"props":3244,"children":3245},{},[3246,3248,3253,3255,3260,3262,3267,3269,3274],{"type":31,"value":3247},"Layer 1, the envelope: ",{"type":26,"tag":2632,"props":3249,"children":3251},{"className":3250},[],[3252],{"type":31,"value":2654},{"type":31,"value":3254}," V, ",{"type":26,"tag":2632,"props":3256,"children":3258},{"className":3257},[],[3259],{"type":31,"value":2662},{"type":31,"value":3261}," D, ",{"type":26,"tag":2632,"props":3263,"children":3265},{"className":3264},[],[3266],{"type":31,"value":2669},{"type":31,"value":3268}," 0, a small ",{"type":26,"tag":2632,"props":3270,"children":3272},{"className":3271},[],[3273],{"type":31,"value":1178},{"type":31,"value":3275}," payload. V submitted a message to D; no ETH moved to D; there is no USDC in this artifact.",{"type":26,"tag":27,"props":3277,"children":3278},{},[3279,3281,3286,3288,3293,3295,3300,3302,3308],{"type":31,"value":3280},"Layer 2, the receipt: status 1, ",{"type":26,"tag":2632,"props":3282,"children":3284},{"className":3283},[],[3285],{"type":31,"value":2766},{"type":31,"value":3287}," 94,220, and three logs: ",{"type":26,"tag":2632,"props":3289,"children":3291},{"className":3290},[],[3292],{"type":31,"value":2916},{"type":31,"value":3294}," from V to D of 5,000 USDC, ",{"type":26,"tag":2632,"props":3296,"children":3298},{"className":3297},[],[3299],{"type":31,"value":2916},{"type":31,"value":3301}," from D to A of 5,000 USDC, and ",{"type":26,"tag":2632,"props":3303,"children":3305},{"className":3304},[],[3306],{"type":31,"value":3307},"RewardsClaimed",{"type":31,"value":3309}," for V. Execution succeeded, the sender paid for the gas, and the USDC contract recorded two transfers.",{"type":26,"tag":27,"props":3311,"children":3312},{},[3313,3315,3320,3322,3327,3329,3334],{"type":31,"value":3314},"Layer 3, logs plus ledger state: ",{"type":26,"tag":2632,"props":3316,"children":3318},{"className":3317},[],[3319],{"type":31,"value":2996},{"type":31,"value":3321}," at the final block shows V's USDC fell by 5,000, D's rose and then fell, and A's rose by 5,000. The ledger corroborates the two ",{"type":26,"tag":2632,"props":3323,"children":3325},{"className":3324},[],[3326],{"type":31,"value":2916},{"type":31,"value":3328}," logs. ",{"type":26,"tag":2632,"props":3330,"children":3332},{"className":3331},[],[3333],{"type":31,"value":3307},{"type":31,"value":3335}," corresponds to no balance change: a fabricated reward event with no asset behind it.",{"type":26,"tag":27,"props":3337,"children":3338},{},[3339,3341,3346,3348,3354,3356,3362,3364,3369],{"type":31,"value":3340},"Layer 4, the call tree: D delegatecalled T, so template code ran in D's storage with ",{"type":26,"tag":2632,"props":3342,"children":3344},{"className":3343},[],[3345],{"type":31,"value":3023},{"type":31,"value":3347}," still V. D then called ",{"type":26,"tag":2632,"props":3349,"children":3351},{"className":3350},[],[3352],{"type":31,"value":3353},"USDC.transferFrom",{"type":31,"value":3355}," to pull the allowance, ",{"type":26,"tag":2632,"props":3357,"children":3359},{"className":3358},[],[3360],{"type":31,"value":3361},"USDC.transfer",{"type":31,"value":3363}," to send on to A, and forwarded 0.02 ETH to A internally. The executing code was T's, running in D's context, and 0.02 ETH reached A inside a transaction whose ",{"type":26,"tag":2632,"props":3365,"children":3367},{"className":3366},[],[3368],{"type":31,"value":2669},{"type":31,"value":3370}," field says zero.",{"type":26,"tag":27,"props":3372,"children":3373},{},[3374],{"type":31,"value":3375},"A careless report says \"V transferred USDC to A.\" A defensible report stacks the layers: the envelope proves V signed to D; the ledger plus logs prove the USDC flow; the trace proves which code ran and where the ETH landed.",{"type":26,"tag":39,"props":3377,"children":3379},{"id":3378},"a-hierarchy-of-claims-an-expert-can-defend",[3380],{"type":31,"value":3381},"A Hierarchy of Claims an Expert Can Defend",{"type":26,"tag":27,"props":3383,"children":3384},{},[3385],{"type":31,"value":3386},"From the envelope alone: submission, sender account, recipient, payload, fee parameters, and block inclusion.",{"type":26,"tag":27,"props":3388,"children":3389},{},[3390],{"type":31,"value":3391},"From the receipt: inclusion, success or failure, execution cost, and the set of logs emitted. Nothing about assets.",{"type":26,"tag":27,"props":3393,"children":3394},{},[3395],{"type":31,"value":3396},"From logs plus ledger reads: token flows as recorded by the token contract, always subject to that contract's truthfulness about its own state.",{"type":26,"tag":27,"props":3398,"children":3399},{},[3400],{"type":31,"value":3401},"From the call tree: which code executed, in whose storage context, in what order, and where ETH flowed internally.",{"type":26,"tag":27,"props":3403,"children":3404},{},[3405],{"type":31,"value":3406},"From state at a block: balances, allowances, and storage as the network recorded them, the ground-truth layer for assets.",{"type":26,"tag":27,"props":3408,"children":3409},{},[3410],{"type":31,"value":3411},"Below the line sit claims no artifact supports: who physically held the private key, what the sender intended, and anything that happened off-chain. Label every conclusion with its source layer. A report that lets a receipt's status carry the weight of a token movement, or a log carry the weight of a balance, has overstated the evidence.",{"type":26,"tag":39,"props":3413,"children":3415},{"id":3414},"a-practitioner-checklist-for-preserving-execution-evidence",[3416],{"type":31,"value":3417},"A Practitioner Checklist for Preserving Execution Evidence",{"type":26,"tag":312,"props":3419,"children":3420},{},[3421,3426,3450,3455,3467,3472,3477,3482],{"type":26,"tag":316,"props":3422,"children":3423},{},[3424],{"type":31,"value":3425},"Confirm the transaction is on the canonical chain and check finality before treating the hash as settled.",{"type":26,"tag":316,"props":3427,"children":3428},{},[3429,3431,3436,3437,3442,3443,3448],{"type":31,"value":3430},"Capture raw JSON output for ",{"type":26,"tag":2632,"props":3432,"children":3434},{"className":3433},[],[3435],{"type":31,"value":2637},{"type":31,"value":2656},{"type":26,"tag":2632,"props":3438,"children":3440},{"className":3439},[],[3441],{"type":31,"value":2742},{"type":31,"value":2782},{"type":26,"tag":2632,"props":3444,"children":3446},{"className":3445},[],[3447],{"type":31,"value":2894},{"type":31,"value":3449}," at query time; record the timestamp, the node or provider, the client and version, and the exact parameters.",{"type":26,"tag":316,"props":3451,"children":3452},{},[3453],{"type":31,"value":3454},"Preserve a hash of every exported file and note whether the data came from a direct node query, a provider API, or an explorer, because those sources differ in provenance.",{"type":26,"tag":316,"props":3456,"children":3457},{},[3458,3460,3465],{"type":31,"value":3459},"Read token balances and relevant storage at the final block with ",{"type":26,"tag":2632,"props":3461,"children":3463},{"className":3462},[],[3464],{"type":31,"value":3004},{"type":31,"value":3466},", and check that allowances were consumed.",{"type":26,"tag":316,"props":3468,"children":3469},{},[3470],{"type":31,"value":3471},"Obtain a call-level trace with call types and depths, plus a state diff showing pre and post values for the balances at issue.",{"type":26,"tag":316,"props":3473,"children":3474},{},[3475],{"type":31,"value":3476},"If the transaction failed, preserve the revert reason from the trace alongside the receipt.",{"type":26,"tag":316,"props":3478,"children":3479},{},[3480],{"type":31,"value":3481},"For transactions older than roughly the state-retention window, confirm archive-state access or provider tracing before commissioning a trace, and record the tracer configuration.",{"type":26,"tag":316,"props":3483,"children":3484},{},[3485],{"type":31,"value":3486},"Cross-check at least one field against a second independent source. Use explorer screenshots only as supporting exhibits; the raw JSON is the primary record.",{"type":26,"tag":39,"props":3488,"children":3489},{"id":1963},[3490],{"type":31,"value":1966},{"type":26,"tag":27,"props":3492,"children":3493},{},[3494],{"type":31,"value":3495},"Traces and logs reconstruct execution, not people. They cannot prove who held a private key, what a party intended, or any off-chain fact. Explorer \"internal transactions\" tabs are client-generated renderings, not consensus data. Reorganizations can orphan a transaction, log queries can be range-limited, and some nodes prune old receipts. On layer-2 rollups, receipts describe sequencer-era execution and the layer-1 commitments are a separate artifact. Everything before October 2017 on Ethereum lacks a receipt status, and the absence of an event proves nothing. How a court weighs these artifacts depends on the forum's evidence rules.",{"type":26,"tag":39,"props":3497,"children":3498},{"id":689},[3499],{"type":31,"value":692},{"type":26,"tag":115,"props":3501,"children":3503},{"id":3502},"q-the-explorer-shows-method-transfer-and-status-success-does-that-prove-the-tokens-were-sent",[3504],{"type":31,"value":3505},"Q: The explorer shows \"Method: transfer\" and \"Status: Success\". Does that prove the tokens were sent?",{"type":26,"tag":27,"props":3507,"children":3508},{},[3509,3513,3515,3520,3522,3527],{"type":26,"tag":590,"props":3510,"children":3511},{},[3512],{"type":31,"value":706},{"type":31,"value":3514}," No. Status proves only that the transaction did not revert. Token movement is evidenced by the token contract's ",{"type":26,"tag":2632,"props":3516,"children":3518},{"className":3517},[],[3519],{"type":31,"value":2916},{"type":31,"value":3521}," logs and by ",{"type":26,"tag":2632,"props":3523,"children":3525},{"className":3524},[],[3526],{"type":31,"value":2996},{"type":31,"value":3528}," at the relevant block. The explorer's \"transfer\" label is a decode of the input data and says nothing about whether tokens moved.",{"type":26,"tag":115,"props":3530,"children":3532},{"id":3531},"q-what-is-the-difference-between-a-receipt-and-a-trace",[3533],{"type":31,"value":3534},"Q: What is the difference between a receipt and a trace?",{"type":26,"tag":27,"props":3536,"children":3537},{},[3538,3542],{"type":26,"tag":590,"props":3539,"children":3540},{},[3541],{"type":31,"value":706},{"type":31,"value":3543}," A receipt is consensus data: status, gas used, and logs, stored with the block. A trace is a reconstruction: a node re-executes the transaction locally. Receipts exist for every included transaction the node still holds. Traces depend on the client, the tracer, and historical state, which generally means an archive node for old transactions. There is no finalized trace-format standard.",{"type":26,"tag":115,"props":3545,"children":3547},{"id":3546},"q-a-failed-transaction-still-costs-gas-what-can-the-fee-evidence-prove",[3548],{"type":31,"value":3549},"Q: A failed transaction still costs gas. What can the fee evidence prove?",{"type":26,"tag":27,"props":3551,"children":3552},{},[3553,3557,3558,3563,3564,3569],{"type":26,"tag":590,"props":3554,"children":3555},{},[3556],{"type":31,"value":706},{"type":31,"value":1184},{"type":26,"tag":2632,"props":3559,"children":3561},{"className":3560},[],[3562],{"type":31,"value":2766},{"type":31,"value":2862},{"type":26,"tag":2632,"props":3565,"children":3567},{"className":3566},[],[3568],{"type":31,"value":2788},{"type":31,"value":3570}," is the fee the sender paid, which can support damages even when the transfer failed. The receipt also proves the failure: status 0, state changes rolled back, nonce consumed. That pairing can establish that the account was operated, that an attempt occurred, and what it cost.",{"type":26,"tag":115,"props":3572,"children":3574},{"id":3573},"q-how-far-back-can-execution-traces-be-recovered",[3575],{"type":31,"value":3576},"Q: How far back can execution traces be recovered?",{"type":26,"tag":27,"props":3578,"children":3579},{},[3580,3584],{"type":26,"tag":590,"props":3581,"children":3582},{},[3583],{"type":31,"value":706},{"type":31,"value":3585}," Envelope, receipt, and logs are available only if the node still holds that history; some clients prune old receipts. Traces require state as of the target block. Recent transactions can be traced on a full node; old ones generally need an archive node or a tracing provider. Pre-Byzantium transactions (before October 2017) have no receipt status and can only be reconstructed by replay.",{"type":26,"tag":27,"props":3587,"children":3588},{},[3589,3591,3595],{"type":31,"value":3590},"Every matter turns on its own facts, and the weight a court gives these artifacts depends on the jurisdiction, the claims, and how the evidence was collected and preserved. If you are litigating or investigating a matter where EVM execution details matter, ",{"type":26,"tag":56,"props":3592,"children":3593},{"href":776},[3594],{"type":31,"value":779},{"type":31,"value":3596}," to discuss what a forensic analysis can defensibly establish from your specific transactions.",{"title":8,"searchDepth":783,"depth":783,"links":3598},[3599,3600,3603,3604,3605,3606,3607,3608,3609,3610],{"id":2622,"depth":783,"text":2625},{"id":2728,"depth":783,"text":2731,"children":3601},[3602],{"id":2823,"depth":789,"text":2826},{"id":2880,"depth":783,"text":2883},{"id":3009,"depth":783,"text":3012},{"id":3145,"depth":783,"text":3148},{"id":3219,"depth":783,"text":3222},{"id":3378,"depth":783,"text":3381},{"id":3414,"depth":783,"text":3417},{"id":1963,"depth":783,"text":1966},{"id":689,"depth":783,"text":692,"children":3611},[3612,3613,3614,3615],{"id":3502,"depth":789,"text":3505},{"id":3531,"depth":789,"text":3534},{"id":3546,"depth":789,"text":3549},{"id":3573,"depth":789,"text":3576},"content:articles:27-evm-receipts-logs-execution-traces.md","articles\u002F27-evm-receipts-logs-execution-traces.md","articles\u002F27-evm-receipts-logs-execution-traces",{"_path":3620,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":3621,"description":3622,"slug":3623,"date":3624,"lastUpdated":3624,"author":13,"readingTime":3625,"category":15,"tags":3626,"ogImage":3628,"featured":7,"body":3629,"_type":807,"_id":4238,"_source":809,"_file":4239,"_stem":4240,"_extension":812},"\u002Farticles\u002F24-rule-1006-blockchain-summary-evidence","Rule 1006 summaries in blockchain cases","A practical framework for admitting blockchain transaction summaries under Rule 1006 while preserving source access, reproducibility, and cross-examination.","rule-1006-blockchain-summary-evidence","2026-05-23",11,[20,823,19,3627],"expert-witness","\u002Fog\u002Frule-1006-blockchain-summary-evidence.png",{"type":23,"children":3630,"toc":4213},[3631,3636,3649,3655,3660,3665,3677,3683,3696,3702,3707,3719,3725,3730,3735,3741,3746,3751,3757,3771,3776,3881,3886,3892,3903,3909,3931,3937,3942,3948,3953,3958,3964,3969,3979,3985,3994,3999,4004,4010,4015,4058,4063,4069,4074,4117,4122,4128,4133,4138,4142,4148,4157,4163,4172,4178,4187,4193,4202],{"type":26,"tag":27,"props":3632,"children":3633},{},[3634],{"type":31,"value":3635},"A complete blockchain trace can contain thousands or millions of transaction records, token-transfer events, and intermediate calculations. Federal Rule of Evidence 1006 can permit a party to prove the content of that voluminous material through an admitted summary, chart, or calculation. It does not excuse the proponent from establishing that the underlying records are admissible, defining what was summarized, or giving the other parties a fair opportunity to examine the source material.",{"type":26,"tag":27,"props":3637,"children":3638},{},[3639,3641,3647],{"type":31,"value":3640},"This article addresses federal evidence practice. State rules, local practice, and scheduling orders may differ. Broader authentication questions are covered in ",{"type":26,"tag":56,"props":3642,"children":3644},{"href":3643},"\u002Fresources\u002Fblockchain-evidence-admissibility",[3645],{"type":31,"value":3646},"Blockchain Evidence in Litigation",{"type":31,"value":3648},". The narrower question here is how to convert a large transaction dataset into usable proof without severing it from its foundation.",{"type":26,"tag":39,"props":3650,"children":3652},{"id":3651},"why-are-blockchain-cases-a-natural-fit-for-rule-1006",[3653],{"type":31,"value":3654},"Why Are Blockchain Cases a Natural Fit for Rule 1006?",{"type":26,"tag":27,"props":3656,"children":3657},{},[3658],{"type":31,"value":3659},"A tracing opinion rarely depends on only one transaction. The relevant proof may include every transfer involving identified addresses during a defined period, token events from specified contracts, exchange exports, price data, and a table connecting each derived value to its source record.",{"type":26,"tag":27,"props":3661,"children":3662},{},[3663],{"type":31,"value":3664},"Printing or examining that material row by row would obscure the point of the evidence. A summary can answer a litigation question such as how much value entered a group of addresses, what portion moved to identified exchanges, or how frequently funds passed through specified services. Rule 1006 addresses this presentation problem, but only when the summary proves the content of a genuinely voluminous set of admissible materials that cannot conveniently be examined in court.",{"type":26,"tag":27,"props":3666,"children":3667},{},[3668,3670,3675],{"type":31,"value":3669},"This differs from ",{"type":26,"tag":56,"props":3671,"children":3672},{"href":2615},[3673],{"type":31,"value":3674},"reading a single blockchain transaction",{"type":31,"value":3676},". The expert must explain what individual records mean, why the selected universe is complete, and how source records became totals.",{"type":26,"tag":39,"props":3678,"children":3680},{"id":3679},"what-does-current-rule-1006-require",[3681],{"type":31,"value":3682},"What Does Current Rule 1006 Require?",{"type":26,"tag":27,"props":3684,"children":3685},{},[3686,3687,3694],{"type":31,"value":2901},{"type":26,"tag":56,"props":3688,"children":3691},{"href":3689,"rel":3690},"https:\u002F\u002Fwww.uscourts.gov\u002Fsites\u002Fdefault\u002Ffiles\u002F2025-02\u002Ffederal-rules-of-evidence-dec-1-2024.pdf",[60],[3692],{"type":31,"value":3693},"current text of Federal Rule of Evidence 1006",{"type":31,"value":3695}," has three operational components.",{"type":26,"tag":115,"props":3697,"children":3699},{"id":3698},"the-underlying-materials-must-be-voluminous-and-admissible",[3700],{"type":31,"value":3701},"The underlying materials must be voluminous and admissible",{"type":26,"tag":27,"props":3703,"children":3704},{},[3705],{"type":31,"value":3706},"Rule 1006(a) applies to voluminous admissible writings, recordings, or photographs that cannot conveniently be examined in court. A party seeking to use the rule for blockchain data would ordinarily identify the electronic records being summarized, explain the form in which they were collected, and establish the applicable foundation for each source category.",{"type":26,"tag":27,"props":3708,"children":3709},{},[3710,3712,3718],{"type":31,"value":3711},"Admissibility cannot be established only at the summary level. Rule 1006 does not cleanse unauthenticated screenshots, unexplained commercial labels, inadmissible exchange records, or unsupported price data. The proponent should map each source category to its authentication, hearsay, and expert-testimony foundation. See ",{"type":26,"tag":56,"props":3713,"children":3715},{"href":3714},"\u002Fresources\u002Fblockchain-evidence-federal-missouri-rules",[3716],{"type":31,"value":3717},"the federal and Missouri rules governing blockchain evidence",{"type":31,"value":381},{"type":26,"tag":115,"props":3720,"children":3722},{"id":3721},"the-summary-may-be-evidence-even-if-the-source-records-are-not-admitted",[3723],{"type":31,"value":3724},"The summary may be evidence even if the source records are not admitted",{"type":26,"tag":27,"props":3726,"children":3727},{},[3728],{"type":31,"value":3729},"The amendment effective December 1, 2024 clarified that the court may admit a qualifying summary whether or not the underlying materials have themselves been introduced. The underlying records must be admissible, but they do not all have to become trial exhibits. Some or all of them may still be admitted when otherwise appropriate.",{"type":26,"tag":27,"props":3731,"children":3732},{},[3733],{"type":31,"value":3734},"Counsel can therefore offer transaction totals without asking the factfinder to navigate millions of rows. The summary is substantive evidence, not merely a visual displayed during testimony. It must be accurate and capable of standing as proof of the summarized content.",{"type":26,"tag":115,"props":3736,"children":3738},{"id":3737},"other-parties-must-receive-meaningful-access",[3739],{"type":31,"value":3740},"Other parties must receive meaningful access",{"type":26,"tag":27,"props":3742,"children":3743},{},[3744],{"type":31,"value":3745},"Rule 1006(b) requires the proponent to make the underlying originals or duplicates available for examination or copying, or both, at a reasonable time and place. The court may also order production in court. The rule does not prescribe a particular file format or a universal notice period.",{"type":26,"tag":27,"props":3747,"children":3748},{},[3749],{"type":31,"value":3750},"For complex data, bare technical availability may not be meaningful. A defensible production should usually include the preserved export, a field dictionary, query boundaries, and enough documentation to connect summary rows to underlying records. A PDF chart or proprietary dashboard alone may not permit meaningful testing.",{"type":26,"tag":39,"props":3752,"children":3754},{"id":3753},"is-the-chart-rule-1006-evidence-or-a-rule-107-aid",[3755],{"type":31,"value":3756},"Is the Chart Rule 1006 Evidence or a Rule 107 Aid?",{"type":26,"tag":27,"props":3758,"children":3759},{},[3760,3762,3769],{"type":31,"value":3761},"The distinction changed in form on December 1, 2024. New Rule 107 now governs illustrative aids. The ",{"type":26,"tag":56,"props":3763,"children":3766},{"href":3764,"rel":3765},"https:\u002F\u002Fwww.supremecourt.gov\u002Forders\u002Fcourtorders\u002Ffrev24_9o6b.pdf",[60],[3767],{"type":31,"value":3768},"Supreme Court's April 2, 2024 amendments",{"type":31,"value":3770}," state that an illustrative aid helps the trier of fact understand evidence or argument, is not itself evidence, and ordinarily does not go to the jury during deliberations. Rule 107(d) directs admitted summaries of voluminous evidence back to Rule 1006.",{"type":26,"tag":27,"props":3772,"children":3773},{},[3774],{"type":31,"value":3775},"The practical question is what function the chart performs:",{"type":26,"tag":3777,"props":3778,"children":3779},"table",{},[3780,3804],{"type":26,"tag":3781,"props":3782,"children":3783},"thead",{},[3784],{"type":26,"tag":3785,"props":3786,"children":3787},"tr",{},[3788,3794,3799],{"type":26,"tag":3789,"props":3790,"children":3791},"th",{},[3792],{"type":31,"value":3793},"Question",{"type":26,"tag":3789,"props":3795,"children":3796},{},[3797],{"type":31,"value":3798},"Rule 1006 summary",{"type":26,"tag":3789,"props":3800,"children":3801},{},[3802],{"type":31,"value":3803},"Rule 107 illustrative aid",{"type":26,"tag":3805,"props":3806,"children":3807},"tbody",{},[3808,3827,3845,3863],{"type":26,"tag":3785,"props":3809,"children":3810},{},[3811,3817,3822],{"type":26,"tag":3812,"props":3813,"children":3814},"td",{},[3815],{"type":31,"value":3816},"What does it do?",{"type":26,"tag":3812,"props":3818,"children":3819},{},[3820],{"type":31,"value":3821},"Proves the content of voluminous admissible materials",{"type":26,"tag":3812,"props":3823,"children":3824},{},[3825],{"type":31,"value":3826},"Helps explain evidence or argument",{"type":26,"tag":3785,"props":3828,"children":3829},{},[3830,3835,3840],{"type":26,"tag":3812,"props":3831,"children":3832},{},[3833],{"type":31,"value":3834},"Is it evidence?",{"type":26,"tag":3812,"props":3836,"children":3837},{},[3838],{"type":31,"value":3839},"Yes, if admitted",{"type":26,"tag":3812,"props":3841,"children":3842},{},[3843],{"type":31,"value":3844},"No",{"type":26,"tag":3785,"props":3846,"children":3847},{},[3848,3853,3858],{"type":26,"tag":3812,"props":3849,"children":3850},{},[3851],{"type":31,"value":3852},"Must the underlying material be admissible?",{"type":26,"tag":3812,"props":3854,"children":3855},{},[3856],{"type":31,"value":3857},"Yes",{"type":26,"tag":3812,"props":3859,"children":3860},{},[3861],{"type":31,"value":3862},"The aid must fairly assist understanding, but it is not a substitute for proof",{"type":26,"tag":3785,"props":3864,"children":3865},{},[3866,3871,3876],{"type":26,"tag":3812,"props":3867,"children":3868},{},[3869],{"type":31,"value":3870},"Can it go to deliberations?",{"type":26,"tag":3812,"props":3872,"children":3873},{},[3874],{"type":31,"value":3875},"As admitted evidence, subject to the court's management",{"type":26,"tag":3812,"props":3877,"children":3878},{},[3879],{"type":31,"value":3880},"Not ordinarily, absent consent or a good-cause order",{"type":26,"tag":27,"props":3882,"children":3883},{},[3884],{"type":31,"value":3885},"Calling a chart “demonstrative” does not determine its status. If transaction totals are offered as proof, address Rule 1006. If a chart merely colors arrows on admitted transactions to assist testimony, Rule 107 may fit. One exhibit should not drift between those roles without a clear ruling.",{"type":26,"tag":39,"props":3887,"children":3889},{"id":3888},"what-work-product-supports-a-defensible-summary",[3890],{"type":31,"value":3891},"What Work Product Supports a Defensible Summary?",{"type":26,"tag":27,"props":3893,"children":3894},{},[3895,3897,3901],{"type":31,"value":3896},"A reliable summary begins with a reproducible specification, not a finished graphic. The analyst performing ",{"type":26,"tag":56,"props":3898,"children":3899},{"href":270},[3900],{"type":31,"value":3207},{"type":31,"value":3902}," should preserve enough detail for another qualified person to rerun the process and identify any judgment calls.",{"type":26,"tag":115,"props":3904,"children":3906},{"id":3905},"define-the-source-universe",[3907],{"type":31,"value":3908},"Define the source universe",{"type":26,"tag":27,"props":3910,"children":3911},{},[3912,3914,3921,3922,3929],{"type":31,"value":3913},"Record the blockchain and network, date range, block boundaries where applicable, addresses, transaction types, token contracts, and off-chain records included. Keep source identifiers attached to every row. Depending on the network, those may include transaction hashes, block identifiers, output indexes, event-log indexes, and contract addresses. Official ",{"type":26,"tag":56,"props":3915,"children":3918},{"href":3916,"rel":3917},"https:\u002F\u002Fethereum.org\u002Fdevelopers\u002Fdocs\u002Fapis\u002Fjson-rpc\u002F",[60],[3919],{"type":31,"value":3920},"Ethereum JSON-RPC documentation",{"type":31,"value":1891},{"type":26,"tag":56,"props":3923,"children":3926},{"href":3924,"rel":3925},"https:\u002F\u002Fbitcoincore.org\u002Fen\u002Fdoc\u002F30.0.0\u002Frpc\u002Frawtransactions\u002Fgetrawtransaction\u002F",[60],[3927],{"type":31,"value":3928},"Bitcoin Core transaction documentation",{"type":31,"value":3930}," show why a generic “transaction ID” column may be insufficient.",{"type":26,"tag":115,"props":3932,"children":3934},{"id":3933},"state-inclusion-and-exclusion-rules-before-totaling",[3935],{"type":31,"value":3936},"State inclusion and exclusion rules before totaling",{"type":26,"tag":27,"props":3938,"children":3939},{},[3940],{"type":31,"value":3941},"Specify whether the dataset includes failed transactions, internal calls, token events, fees, change outputs, self-transfers, bridge events, duplicates, and transactions below a threshold. Tie each exclusion to the question being answered. Rules created after seeing the totals invite a selection-bias challenge.",{"type":26,"tag":115,"props":3943,"children":3945},{"id":3944},"separate-observed-facts-from-derived-fields",[3946],{"type":31,"value":3947},"Separate observed facts from derived fields",{"type":26,"tag":27,"props":3949,"children":3950},{},[3951],{"type":31,"value":3952},"Transaction hash, block, sender field, recipient field, asset, and native-unit amount are source-level fields. Wallet clustering, entity attribution, transaction purpose, and ownership are analytical conclusions. The summary should not present an inferred entity label as though it were written on the blockchain.",{"type":26,"tag":27,"props":3954,"children":3955},{},[3956],{"type":31,"value":3957},"Derived monetary values need their own protocol. Identify the price source, currency, timestamp convention, time zone, and treatment of illiquid assets or missing observations. A transfer amount and its historical dollar valuation are different propositions with different foundations.",{"type":26,"tag":115,"props":3959,"children":3961},{"id":3960},"preserve-an-audit-path",[3962],{"type":31,"value":3963},"Preserve an audit path",{"type":26,"tag":27,"props":3965,"children":3966},{},[3967],{"type":31,"value":3968},"Maintain original exports, normalized data, transformation logic, an exception log, and final output as separate layers. Use stable row identifiers and reconcile counts and totals at each stage. Preserve the version or export date of commercial labels because attribution may change even when the on-chain transaction does not.",{"type":26,"tag":27,"props":3970,"children":3971},{},[3972,3974,3978],{"type":31,"value":3973},"A witness should be able to explain this process in plain language. The witness need not necessarily be an expert merely because a summary was prepared. Specialized clustering, attribution, valuation, or interpretation may, however, implicate Rule 702 and expert disclosure obligations. The engagement should be structured with that distinction in mind, consistent with the firm's documented ",{"type":26,"tag":56,"props":3975,"children":3976},{"href":499},[3977],{"type":31,"value":3200},{"type":31,"value":381},{"type":26,"tag":39,"props":3980,"children":3982},{"id":3981},"worked-hypothetical-summarizing-token-transfers",[3983],{"type":31,"value":3984},"Worked Hypothetical: Summarizing Token Transfers",{"type":26,"tag":27,"props":3986,"children":3987},{},[3988,3992],{"type":26,"tag":590,"props":3989,"children":3990},{},[3991],{"type":31,"value":1095},{"type":31,"value":3993}," A plaintiff alleges that assets were diverted from a project treasury over eighteen months. The preserved dataset contains 1.8 million transaction and token-event rows from twelve contracts and forty addresses. The proposed Rule 1006 exhibit reports monthly inflows, outflows, fees, and transfers to separately identified exchange deposit addresses.",{"type":26,"tag":27,"props":3995,"children":3996},{},[3997],{"type":31,"value":3998},"The analyst defines the block range, contract list, address list, event types, and duplicate-removal key before calculating totals. Failed transactions are retained in an exception table but excluded from transferred-value totals because no asserted token transfer was completed. Dollar values use a named daily price source and a stated UTC convention. Every summary cell links through a schedule to source rows identified by transaction hash and event-log index.",{"type":26,"tag":27,"props":4000,"children":4001},{},[4002],{"type":31,"value":4003},"The plaintiff produces the raw exports, normalized table, data dictionary, calculation logic, exception table, and attribution support. At trial, the witness explains how the 1.8 million rows became the exhibit and distinguishes observed transfers from opinions about address control. Rule 1006 may solve the volume problem, but it does not establish that the defendant owned an address or that a transfer was wrongful. Those propositions require separate evidence.",{"type":26,"tag":39,"props":4005,"children":4007},{"id":4006},"how-can-opposing-counsel-test-the-summary",[4008],{"type":31,"value":4009},"How Can Opposing Counsel Test the Summary?",{"type":26,"tag":27,"props":4011,"children":4012},{},[4013],{"type":31,"value":4014},"The most productive challenge usually targets the boundary and transformation, not arithmetic alone. Discovery and examination should ask:",{"type":26,"tag":312,"props":4016,"children":4017},{},[4018,4023,4028,4033,4038,4043,4048,4053],{"type":26,"tag":316,"props":4019,"children":4020},{},[4021],{"type":31,"value":4022},"What exact records form the universe, and who selected the addresses, contracts, and dates?",{"type":26,"tag":316,"props":4024,"children":4025},{},[4026],{"type":31,"value":4027},"Can the record count be reproduced directly from the preserved source files?",{"type":26,"tag":316,"props":4029,"children":4030},{},[4031],{"type":31,"value":4032},"Were failed, duplicated, bridged, or self-directed transactions handled consistently?",{"type":26,"tag":316,"props":4034,"children":4035},{},[4036],{"type":31,"value":4037},"Which columns are direct observations, and which are labels, classifications, or opinions?",{"type":26,"tag":316,"props":4039,"children":4040},{},[4041],{"type":31,"value":4042},"Did the analyst change inclusion rules after reviewing preliminary results?",{"type":26,"tag":316,"props":4044,"children":4045},{},[4046],{"type":31,"value":4047},"Can each total be traced to identified source rows without access to the analyst's proprietary interface?",{"type":26,"tag":316,"props":4049,"children":4050},{},[4051],{"type":31,"value":4052},"What admissibility foundation supports exchange records, vendor labels, and price data?",{"type":26,"tag":316,"props":4054,"children":4055},{},[4056],{"type":31,"value":4057},"Do omitted records materially change the stated totals or narrative?",{"type":26,"tag":27,"props":4059,"children":4060},{},[4061],{"type":31,"value":4062},"Counsel should also request prior summary versions, query logs, transformation scripts or formulas, exception reports, and reconciliation results, subject to applicable discovery and expert-disclosure rules. A difference between totals may reflect a defensible scope choice, but the choice must be visible.",{"type":26,"tag":39,"props":4064,"children":4066},{"id":4065},"what-should-be-resolved-before-trial",[4067],{"type":31,"value":4068},"What Should Be Resolved Before Trial?",{"type":26,"tag":27,"props":4070,"children":4071},{},[4072],{"type":31,"value":4073},"Use a pretrial process that separates admissibility from presentation:",{"type":26,"tag":394,"props":4075,"children":4076},{},[4077,4082,4087,4092,4097,4102,4107,4112],{"type":26,"tag":316,"props":4078,"children":4079},{},[4080],{"type":31,"value":4081},"Identify the fact each proposed summary is offered to prove.",{"type":26,"tag":316,"props":4083,"children":4084},{},[4085],{"type":31,"value":4086},"Define the complete source universe and the foundation for every source category.",{"type":26,"tag":316,"props":4088,"children":4089},{},[4090],{"type":31,"value":4091},"Produce originals or duplicates early enough for meaningful examination and copying.",{"type":26,"tag":316,"props":4093,"children":4094},{},[4095],{"type":31,"value":4096},"Disclose normalization, deduplication, valuation, attribution, and exception rules.",{"type":26,"tag":316,"props":4098,"children":4099},{},[4100],{"type":31,"value":4101},"Reconcile source counts to normalized counts and normalized totals to the exhibit.",{"type":26,"tag":316,"props":4103,"children":4104},{},[4105],{"type":31,"value":4106},"Decide whether each visual is Rule 1006 evidence, a Rule 107 aid, or a separate expert opinion exhibit.",{"type":26,"tag":316,"props":4108,"children":4109},{},[4110],{"type":31,"value":4111},"Prepare the sponsoring witness to explain both the data pipeline and its limits.",{"type":26,"tag":316,"props":4113,"children":4114},{},[4115],{"type":31,"value":4116},"Address objections, exhibit status, jury access, and any limiting instruction in limine rather than during testimony.",{"type":26,"tag":27,"props":4118,"children":4119},{},[4120],{"type":31,"value":4121},"The Advisory Committee materials explain that the 2024 amendment was intended to stop confusion between substantive summaries and illustrative aids. That clarification does not make admission automatic. The Committee also recognized that an inaccurate or argumentative summary remains subject to Rule 403 concerns.",{"type":26,"tag":39,"props":4123,"children":4125},{"id":4124},"what-are-the-limits-of-a-rule-1006-summary",[4126],{"type":31,"value":4127},"What Are the Limits of a Rule 1006 Summary?",{"type":26,"tag":27,"props":4129,"children":4130},{},[4131],{"type":31,"value":4132},"Rule 1006 addresses how voluminous content may be proved. It does not authenticate every input, resolve hearsay objections, validate an expert method, establish wallet ownership, or convert association into causation. It also does not answer whether a state court follows the same framework.",{"type":26,"tag":27,"props":4134,"children":4135},{},[4136],{"type":31,"value":4137},"A narrow summary is often stronger than an ambitious one. A table proving amounts and dates can remain separate from opinions about control, intent, tracing heuristics, or damages. That separation makes the exhibit easier to reproduce and prevents disputed interpretation from being embedded invisibly inside arithmetic.",{"type":26,"tag":39,"props":4139,"children":4140},{"id":689},[4141],{"type":31,"value":692},{"type":26,"tag":115,"props":4143,"children":4145},{"id":4144},"q-must-every-blockchain-record-summarized-under-rule-1006-be-admitted-into-evidence",[4146],{"type":31,"value":4147},"Q: Must every blockchain record summarized under Rule 1006 be admitted into evidence?",{"type":26,"tag":27,"props":4149,"children":4150},{},[4151,4155],{"type":26,"tag":590,"props":4152,"children":4153},{},[4154],{"type":31,"value":706},{"type":31,"value":4156}," No. Under the rule effective December 1, 2024, the underlying voluminous materials must be admissible, but the summary may be admitted whether or not those materials have themselves been introduced. The proponent must still make the originals or duplicates available for examination or copying at a reasonable time and place.",{"type":26,"tag":115,"props":4158,"children":4160},{"id":4159},"q-is-a-transaction-flow-diagram-automatically-a-rule-1006-summary",[4161],{"type":31,"value":4162},"Q: Is a transaction-flow diagram automatically a Rule 1006 summary?",{"type":26,"tag":27,"props":4164,"children":4165},{},[4166,4170],{"type":26,"tag":590,"props":4167,"children":4168},{},[4169],{"type":31,"value":706},{"type":31,"value":4171}," No. Its function controls. A diagram offered to prove totals or the content of voluminous admissible records may require a Rule 1006 foundation. A diagram used only to help the trier of fact understand evidence or argument is an illustrative aid governed by Rule 107 and is not itself evidence.",{"type":26,"tag":115,"props":4173,"children":4175},{"id":4174},"q-does-the-person-who-prepared-the-summary-have-to-testify",[4176],{"type":31,"value":4177},"Q: Does the person who prepared the summary have to testify?",{"type":26,"tag":27,"props":4179,"children":4180},{},[4181,4185],{"type":26,"tag":590,"props":4182,"children":4183},{},[4184],{"type":31,"value":706},{"type":31,"value":4186}," Rule 1006 does not state a universal witness requirement, but the proponent needs a sufficient foundation for the source materials and the summary's accuracy. A witness who performed or supervised the transformation is often best positioned to explain scope, calculations, and exceptions. Specialized opinions may also require a properly disclosed expert.",{"type":26,"tag":115,"props":4188,"children":4190},{"id":4189},"q-what-should-be-produced-with-a-blockchain-summary",[4191],{"type":31,"value":4192},"Q: What should be produced with a blockchain summary?",{"type":26,"tag":27,"props":4194,"children":4195},{},[4196,4200],{"type":26,"tag":590,"props":4197,"children":4198},{},[4199],{"type":31,"value":706},{"type":31,"value":4201}," At minimum, counsel should consider producing the preserved source data, data dictionary, query boundaries, inclusion and exclusion rules, normalization and deduplication methods, calculation logic, exception log, and a crosswalk from summary values to source records. The precise legal obligation depends on Rule 1006, discovery rules, expert-disclosure requirements, court orders, and local practice.",{"type":26,"tag":27,"props":4203,"children":4204},{},[4205,4207,4211],{"type":31,"value":4206},"For a specific transaction dataset or proposed exhibit, ",{"type":26,"tag":56,"props":4208,"children":4209},{"href":776},[4210],{"type":31,"value":779},{"type":31,"value":4212}," to discuss evidence review and a reproducible summary protocol.",{"title":8,"searchDepth":783,"depth":783,"links":4214},[4215,4216,4221,4222,4228,4229,4230,4231,4232],{"id":3651,"depth":783,"text":3654},{"id":3679,"depth":783,"text":3682,"children":4217},[4218,4219,4220],{"id":3698,"depth":789,"text":3701},{"id":3721,"depth":789,"text":3724},{"id":3737,"depth":789,"text":3740},{"id":3753,"depth":783,"text":3756},{"id":3888,"depth":783,"text":3891,"children":4223},[4224,4225,4226,4227],{"id":3905,"depth":789,"text":3908},{"id":3933,"depth":789,"text":3936},{"id":3944,"depth":789,"text":3947},{"id":3960,"depth":789,"text":3963},{"id":3981,"depth":783,"text":3984},{"id":4006,"depth":783,"text":4009},{"id":4065,"depth":783,"text":4068},{"id":4124,"depth":783,"text":4127},{"id":689,"depth":783,"text":692,"children":4233},[4234,4235,4236,4237],{"id":4144,"depth":789,"text":4147},{"id":4159,"depth":789,"text":4162},{"id":4174,"depth":789,"text":4177},{"id":4189,"depth":789,"text":4192},"content:articles:24-rule-1006-blockchain-summary-evidence.md","articles\u002F24-rule-1006-blockchain-summary-evidence.md","articles\u002F24-rule-1006-blockchain-summary-evidence",{"_path":4242,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":4243,"description":4244,"slug":4245,"date":4246,"lastUpdated":4246,"author":13,"readingTime":2601,"category":4247,"tags":4248,"ogImage":4251,"featured":7,"body":4252,"_type":807,"_id":4635,"_source":809,"_file":4636,"_stem":4637,"_extension":812},"\u002Farticles\u002F02-can-blockchain-transactions-be-traced","Can blockchain transactions be traced? A primer for attorneys","An attorney-focused explanation of tracing public blockchain transactions, address attribution, exchange records, and the limits of on-chain evidence.","can-blockchain-transactions-be-traced","2026-04-10","Education",[19,4249,20,4250],"transaction-analysis","forensics","\u002Fog\u002Fcan-blockchain-transactions-be-traced.png",{"type":23,"children":4253,"toc":4616},[4254,4259,4265,4270,4275,4280,4286,4291,4296,4301,4307,4312,4317,4322,4327,4333,4338,4343,4348,4354,4359,4364,4376,4382,4387,4392,4398,4403,4408,4413,4418,4423,4429,4434,4439,4444,4449,4455,4460,4479,4485,4490,4495,4514,4518,4522,4528,4537,4543,4552,4558,4567,4573,4582,4587,4593,4602,4605],{"type":26,"tag":27,"props":4255,"children":4256},{},[4257],{"type":31,"value":4258},"The short answer is yes, blockchain transactions can be traced, but what tracing can establish and what it cannot establish are questions that matter enormously in litigation. Cryptocurrency is frequently described as either completely anonymous or completely traceable, depending on who is doing the describing and what point they are trying to make. Neither characterization is accurate. A more precise understanding of what blockchain forensics actually produces is essential for any attorney who intends to use, challenge, or evaluate this kind of evidence.",{"type":26,"tag":39,"props":4260,"children":4262},{"id":4261},"how-public-blockchains-work",[4263],{"type":31,"value":4264},"How Public Blockchains Work",{"type":26,"tag":27,"props":4266,"children":4267},{},[4268],{"type":31,"value":4269},"A blockchain is a distributed ledger: a database maintained simultaneously by thousands of computers around the world, none of which has singular authority over the record. When a cryptocurrency transaction occurs, it is broadcast to the network, validated by nodes operating on the network, and then permanently recorded in a block that is appended to the chain of prior blocks. Every block contains a cryptographic reference to the block before it, which is why altering history would require redoing an enormous amount of computational work and would be immediately visible to the rest of the network.",{"type":26,"tag":27,"props":4271,"children":4272},{},[4273],{"type":31,"value":4274},"For the most widely used public blockchains, including Bitcoin, Ethereum, and most of their derivatives, this ledger is fully public. Anyone can view it. There are websites, commonly called block explorers, that allow a person to look up any address or transaction by entering it into a search field. The amount transferred, the sending address, the receiving address, the transaction fee paid, and the exact timestamp of inclusion in the blockchain are all visible to any observer.",{"type":26,"tag":27,"props":4276,"children":4277},{},[4278],{"type":31,"value":4279},"This transparency is not a bug or an oversight. It is a design choice. Public verifiability is how participants in the network confirm that transactions are legitimate without having to trust a central authority. The tradeoff is that the record of every transaction is permanently and publicly available.",{"type":26,"tag":39,"props":4281,"children":4283},{"id":4282},"what-is-actually-visible-on-chain",[4284],{"type":31,"value":4285},"What Is Actually Visible On-Chain",{"type":26,"tag":27,"props":4287,"children":4288},{},[4289],{"type":31,"value":4290},"When an analyst examines a blockchain address, the information available includes the complete transaction history: every inbound transfer, every outbound transfer, the current and historical balance, and the specific amounts and timestamps of each movement. For Ethereum and related chains, additional information is available, including interactions with smart contracts, token transfers, and internal transaction traces.",{"type":26,"tag":27,"props":4292,"children":4293},{},[4294],{"type":31,"value":4295},"What is not directly visible is the identity of the person who controls the address. A Bitcoin address is a string of characters derived from a cryptographic public key. The blockchain records that a given address sent or received a given amount at a given time. It does not record a name, a social security number, or an IP address. Identity must be established through means outside the blockchain itself.",{"type":26,"tag":27,"props":4297,"children":4298},{},[4299],{"type":31,"value":4300},"This is the gap that blockchain forensic analysis works to bridge, using a combination of techniques applied to the on-chain data together with off-chain evidence gathered through discovery, device examination, and exchange records.",{"type":26,"tag":39,"props":4302,"children":4304},{"id":4303},"address-clustering-heuristics",[4305],{"type":31,"value":4306},"Address Clustering Heuristics",{"type":26,"tag":27,"props":4308,"children":4309},{},[4310],{"type":31,"value":4311},"One of the foundational techniques in blockchain analysis is address clustering. Most cryptocurrency wallets, particularly Bitcoin wallets, generate a new address for each transaction as a privacy measure. A person's holdings might be spread across dozens or hundreds of addresses, none of which is obviously connected to the others simply by looking at any single address.",{"type":26,"tag":27,"props":4313,"children":4314},{},[4315],{"type":31,"value":4316},"However, the way transactions are constructed on-chain creates linkages. When a transaction has multiple input addresses, for example when a user's wallet combines funds from several prior received payments to make a single outgoing payment, those input addresses can be inferred to belong to the same controlling entity. This is called the common input ownership heuristic, and it is one of the most powerful tools available to analysts.",{"type":26,"tag":27,"props":4318,"children":4319},{},[4320],{"type":31,"value":4321},"Change address analysis is another clustering technique. When a Bitcoin transaction sends a specific amount to a recipient, the remaining funds must go somewhere. They typically return to an address controlled by the sender. Recognizing which address in a transaction is the change address and which is the intended recipient allows analysts to extend the cluster of addresses associated with a given wallet.",{"type":26,"tag":27,"props":4323,"children":4324},{},[4325],{"type":31,"value":4326},"These heuristics are probabilistic, not certain. They are strong enough that commercial forensic tools used by law enforcement and professional investigators have been validated against ground truth in thousands of cases. But they are heuristics, and they can produce false positives in specific circumstances. An expert who presents clustering analysis should be able to articulate the basis for their conclusions and acknowledge the limitations.",{"type":26,"tag":39,"props":4328,"children":4330},{"id":4329},"exchange-attribution",[4331],{"type":31,"value":4332},"Exchange Attribution",{"type":26,"tag":27,"props":4334,"children":4335},{},[4336],{"type":31,"value":4337},"Many users, particularly those who acquired cryptocurrency through mainstream channels, at some point moved funds through a regulated exchange. Exchanges like Coinbase, Kraken, Binance, and others maintain large numbers of deposit addresses: addresses that belong to the exchange but are assigned to specific user accounts for receiving funds.",{"type":26,"tag":27,"props":4339,"children":4340},{},[4341],{"type":31,"value":4342},"Over time, forensic analysts and blockchain intelligence firms have catalogued enormous numbers of these exchange deposit addresses. When a transaction involves a known exchange address, the analyst can identify which exchange received or sent the funds, even without access to the exchange's internal records. That attribution then becomes a starting point for a subpoena: the exchange can be compelled to produce the account associated with that deposit address, along with the KYC documentation that identifies the account holder.",{"type":26,"tag":27,"props":4344,"children":4345},{},[4346],{"type":31,"value":4347},"The combination of blockchain attribution and exchange subpoena is how most cryptocurrency investigations that ultimately succeed in connecting an address to a person actually work. The blockchain tells you which exchange received the funds; the exchange tells you who the account belongs to.",{"type":26,"tag":39,"props":4349,"children":4351},{"id":4350},"chain-hopping-and-cross-chain-bridges",[4352],{"type":31,"value":4353},"Chain-Hopping and Cross-Chain Bridges",{"type":26,"tag":27,"props":4355,"children":4356},{},[4357],{"type":31,"value":4358},"Users who want to move funds across different blockchain networks use bridges, which are protocols that lock assets on one chain and release equivalent assets on another. Someone might move funds from Ethereum to a different blockchain, or convert between token types, in ways that create breaks in the on-chain trail.",{"type":26,"tag":27,"props":4360,"children":4361},{},[4362],{"type":31,"value":4363},"Chain-hopping, meaning the practice of moving funds across multiple blockchains in sequence, is used both for legitimate purposes (accessing services on a specific chain) and as an attempt to complicate tracing. The technique does add investigative complexity, but it does not make tracing impossible. Bridges and cross-chain transactions leave records on both chains they connect. The analyst's task is to follow the logical flow of value across the break points, using the bridge transaction records as the connecting evidence.",{"type":26,"tag":27,"props":4365,"children":4366},{},[4367,4369,4374],{"type":31,"value":4368},"For DeFi activity and smart contract interactions specifically, see ",{"type":26,"tag":56,"props":4370,"children":4371},{"href":3072},[4372],{"type":31,"value":4373},"What Lawyers Need to Know About DeFi",{"type":31,"value":4375},", which covers these mechanics in more depth.",{"type":26,"tag":39,"props":4377,"children":4379},{"id":4378},"mixing-services",[4380],{"type":31,"value":4381},"Mixing Services",{"type":26,"tag":27,"props":4383,"children":4384},{},[4385],{"type":31,"value":4386},"Mixing services (also called tumblers or coinjoin implementations, depending on the specific technique) attempt to break the link between sending and receiving addresses by pooling funds from multiple users and redistributing them in ways that obscure the original source. A user sends cryptocurrency to a mixing service and receives back an equivalent amount, minus a fee, in a way that is intended to prevent an observer from connecting the input and output.",{"type":26,"tag":27,"props":4388,"children":4389},{},[4390],{"type":31,"value":4391},"Mixing does complicate analysis. A well-implemented mixing transaction makes it harder to follow the specific path of a party's funds. However, several things remain true. The fact that funds passed through a mixing service is visible on the blockchain. Mixing services interact with the broader ecosystem in ways that sometimes reveal their operating addresses. And mixing services, like exchanges, are potential targets for legal process. The use of a mixing service is itself evidence that a court may find relevant to questions of intent.",{"type":26,"tag":39,"props":4393,"children":4395},{"id":4394},"the-critical-limitation-address-vs-person",[4396],{"type":31,"value":4397},"The Critical Limitation: Address vs. Person",{"type":26,"tag":27,"props":4399,"children":4400},{},[4401],{"type":31,"value":4402},"The most important limitation in blockchain forensics, and the one most frequently misunderstood, is that the blockchain establishes facts about addresses, not about people.",{"type":26,"tag":27,"props":4404,"children":4405},{},[4406],{"type":31,"value":4407},"An analyst can demonstrate, with a high degree of confidence, that address A received funds from address B, that address A subsequently sent those funds to an exchange deposit address attributable to Coinbase, and that this all occurred on a specific date. That is what the blockchain proves. It does not, by itself, prove that a particular individual controlled address A.",{"type":26,"tag":27,"props":4409,"children":4410},{},[4411],{"type":31,"value":4412},"Attribution of an address to a person requires additional evidence. That evidence typically comes from exchange records that show the account associated with an address was registered to a specific person with verified identity documents. It may also come from device forensics that demonstrate wallet software was installed on a device belonging to the subject, from seed phrase or private key material found in the subject's possession, or from the subject's own statements, such as a prior disclosure listing the address.",{"type":26,"tag":27,"props":4414,"children":4415},{},[4416],{"type":31,"value":4417},"A forensic report that conflates these two layers, presenting blockchain evidence as if it directly proves who controlled a wallet, will face legitimate challenge. Sound expert testimony distinguishes clearly between the blockchain-derived facts and the attribution evidence, and acknowledges what remains uncertain. This approach is more credible, not less, because it reflects the actual state of the evidence.",{"type":26,"tag":27,"props":4419,"children":4420},{},[4421],{"type":31,"value":4422},"Hypothetical example: An exchange record identifies the account holder associated with an address. The address then sends funds to another address and later back to the same exchange. The blockchain can show that sequence of transfers, while the exchange record supplies the evidence connecting the first address to the account holder.",{"type":26,"tag":39,"props":4424,"children":4426},{"id":4425},"what-analysts-can-and-cannot-conclude",[4427],{"type":31,"value":4428},"What Analysts Can and Cannot Conclude",{"type":26,"tag":27,"props":4430,"children":4431},{},[4432],{"type":31,"value":4433},"To summarize the practical scope of blockchain forensic analysis:",{"type":26,"tag":27,"props":4435,"children":4436},{},[4437],{"type":31,"value":4438},"Analysts can typically establish: the complete transaction history of a given address, the amounts and timing of all transfers, which exchanges received or sent funds based on address attribution databases, whether funds were routed through mixing services or privacy tools, the clustering of related addresses likely controlled by the same entity, and the path of funds across multiple hops.",{"type":26,"tag":27,"props":4440,"children":4441},{},[4442],{"type":31,"value":4443},"Analysts cannot typically establish without additional evidence: the identity of the person controlling an address, whether a specific person was the one who initiated a specific transaction at a specific moment, or the contents of private communications about transactions.",{"type":26,"tag":27,"props":4445,"children":4446},{},[4447],{"type":31,"value":4448},"The strength of a given tracing analysis depends heavily on the starting information available. If the investigation begins with a confirmed wallet address associated with the subject, through an exchange record or a prior disclosure, the analysis can be comprehensive. If the investigation must begin from scratch with no confirmed address, the path to attribution is longer.",{"type":26,"tag":39,"props":4450,"children":4452},{"id":4451},"chain-of-custody-for-on-chain-evidence",[4453],{"type":31,"value":4454},"Chain of Custody for On-Chain Evidence",{"type":26,"tag":27,"props":4456,"children":4457},{},[4458],{"type":31,"value":4459},"Blockchain evidence has an inherent advantage over many other forms of digital evidence: the record itself is stored on a distributed network and cannot be altered after the fact. The transaction history of an address on 2018 is the same transaction history visible today.",{"type":26,"tag":27,"props":4461,"children":4462},{},[4463,4465,4470,4472,4477],{"type":31,"value":4464},"Preserving a proper record of how the evidence was collected matters for admissibility purposes. The methodology used to collect and analyze the data, the tools employed, the queries run, and the results obtained should all be documented in a way that allows an opposing expert or a court to evaluate the work. Hash verification of collected data, timestamped exports from blockchain explorers, and reproducible analysis methodology are all best practices that support admissibility. ",{"type":26,"tag":56,"props":4466,"children":4467},{"href":3211},[4468],{"type":31,"value":4469},"Evidence review services",{"type":31,"value":4471}," can help counsel assess whether that documentation supports the analysis. See ",{"type":26,"tag":56,"props":4473,"children":4474},{"href":3643},[4475],{"type":31,"value":4476},"Blockchain Evidence Admissibility",{"type":31,"value":4478}," for a full discussion of the evidentiary framework.",{"type":26,"tag":39,"props":4480,"children":4482},{"id":4481},"bringing-it-together",[4483],{"type":31,"value":4484},"Bringing It Together",{"type":26,"tag":27,"props":4486,"children":4487},{},[4488],{"type":31,"value":4489},"Blockchain forensics is a legitimate investigative discipline with a well-developed methodology. It is most powerful when combined with traditional discovery: exchange subpoenas, device forensics, and financial records that provide the off-chain evidence needed to complete the attribution picture.",{"type":26,"tag":27,"props":4491,"children":4492},{},[4493],{"type":31,"value":4494},"The goal of a forensic engagement is not to produce a definitive conclusion without sufficient evidence, but to produce a rigorous and defensible analysis of what the available evidence actually shows. Courts and opposing counsel will both scrutinize the work. The analysis that holds up is the analysis that is methodologically sound, clearly documented, and honest about what it cannot establish.",{"type":26,"tag":27,"props":4496,"children":4497},{},[4498,4500,4505,4507,4513],{"type":31,"value":4499},"For a detailed look at ",{"type":26,"tag":56,"props":4501,"children":4502},{"href":499},[4503],{"type":31,"value":4504},"ConsensusIntel's methodology",{"type":31,"value":4506},", including how analyses are structured and documented for use in litigation, visit the methodology page. For an overview of the types of matters we handle, see ",{"type":26,"tag":56,"props":4508,"children":4510},{"href":4509},"\u002Fcase-types",[4511],{"type":31,"value":4512},"Case Types",{"type":31,"value":381},{"type":26,"tag":4515,"props":4516,"children":4517},"hr",{},[],{"type":26,"tag":39,"props":4519,"children":4520},{"id":689},[4521],{"type":31,"value":692},{"type":26,"tag":115,"props":4523,"children":4525},{"id":4524},"q-is-bitcoin-actually-anonymous",[4526],{"type":31,"value":4527},"Q: Is Bitcoin actually anonymous?",{"type":26,"tag":27,"props":4529,"children":4530},{},[4531,4535],{"type":26,"tag":590,"props":4532,"children":4533},{},[4534],{"type":31,"value":706},{"type":31,"value":4536}," Bitcoin is pseudonymous, not anonymous. Transactions are permanently recorded on a public ledger, and while wallet addresses do not automatically reveal identities, the combination of blockchain analysis and off-chain evidence frequently allows analysts to connect addresses to specific individuals. The degree of privacy a user has depends largely on how carefully they structured their transactions.",{"type":26,"tag":115,"props":4538,"children":4540},{"id":4539},"q-are-some-cryptocurrencies-impossible-to-trace",[4541],{"type":31,"value":4542},"Q: Are some cryptocurrencies impossible to trace?",{"type":26,"tag":27,"props":4544,"children":4545},{},[4546,4550],{"type":26,"tag":590,"props":4547,"children":4548},{},[4549],{"type":31,"value":706},{"type":31,"value":4551}," Privacy-focused cryptocurrencies, such as Monero, use cryptographic techniques designed to obscure transaction amounts, sender identities, and recipient identities. Tracing these transactions is substantially more difficult than tracing Bitcoin or Ethereum. users of privacy coins typically acquire and dispose of them through exchanges that maintain records, and those transition points are traceable. The on-chain portion is harder; the surrounding activity often is not.",{"type":26,"tag":115,"props":4553,"children":4555},{"id":4554},"q-how-reliable-are-address-clustering-techniques",[4556],{"type":31,"value":4557},"Q: How reliable are address clustering techniques?",{"type":26,"tag":27,"props":4559,"children":4560},{},[4561,4565],{"type":26,"tag":590,"props":4562,"children":4563},{},[4564],{"type":31,"value":706},{"type":31,"value":4566}," The common input ownership heuristic and related clustering methods have been validated extensively. Commercial blockchain forensic tools used by law enforcement agencies, and subject to Daubert challenges in federal court, have generally withstood scrutiny. The reliability of a specific clustering conclusion depends on the quality of the underlying data and the analyst's judgment. A qualified expert will be able to explain the basis for their conclusions and identify where uncertainty exists.",{"type":26,"tag":115,"props":4568,"children":4570},{"id":4569},"q-what-should-an-attorney-provide-when-multiple-exchanges-may-be-involved",[4571],{"type":31,"value":4572},"Q: What should an attorney provide when multiple exchanges may be involved?",{"type":26,"tag":27,"props":4574,"children":4575},{},[4576,4580],{"type":26,"tag":590,"props":4577,"children":4578},{},[4579],{"type":31,"value":706},{"type":31,"value":4581}," Using multiple exchanges makes the picture more complex but does not make tracing impossible. Blockchain analysis can identify which exchange received funds from a given address, even across multiple exchanges. Each exchange can then be subpoenaed separately. The full picture may require combining records from several sources, but the methodology is the same.",{"type":26,"tag":27,"props":4583,"children":4584},{},[4585],{"type":31,"value":4586},"Bring any known wallet addresses or exchange account information associated with the subject, any exchange statements or disclosures already in hand, relevant financial records that might show cryptocurrency purchases or conversions, and a clear description of the timeline and the key questions the analysis needs to answer. The more starting information available, the more efficiently the analysis can proceed.",{"type":26,"tag":115,"props":4588,"children":4590},{"id":4589},"q-how-far-back-can-blockchain-transactions-be-traced",[4591],{"type":31,"value":4592},"Q: How far back can blockchain transactions be traced?",{"type":26,"tag":27,"props":4594,"children":4595},{},[4596,4600],{"type":26,"tag":590,"props":4597,"children":4598},{},[4599],{"type":31,"value":706},{"type":31,"value":4601}," Bitcoin's blockchain contains every transaction since the genesis block in January 2009. Ethereum's blockchain has been continuous since July 2015. Blockchain forensics can examine transactions from any point in that history, provided a known starting address exists. There is no practical statute of limitations on the on-chain record itself, though older exchange records may be subject to the exchange's data retention policies.",{"type":26,"tag":4515,"props":4603,"children":4604},{},[],{"type":26,"tag":27,"props":4606,"children":4607},{},[4608,4610,4614],{"type":31,"value":4609},"If your matter involves cryptocurrency transactions you need to understand, evaluate, or challenge, ",{"type":26,"tag":56,"props":4611,"children":4612},{"href":776},[4613],{"type":31,"value":779},{"type":31,"value":4615}," for a consultation on what forensic analysis can realistically establish given your facts.",{"title":8,"searchDepth":783,"depth":783,"links":4617},[4618,4619,4620,4621,4622,4623,4624,4625,4626,4627,4628],{"id":4261,"depth":783,"text":4264},{"id":4282,"depth":783,"text":4285},{"id":4303,"depth":783,"text":4306},{"id":4329,"depth":783,"text":4332},{"id":4350,"depth":783,"text":4353},{"id":4378,"depth":783,"text":4381},{"id":4394,"depth":783,"text":4397},{"id":4425,"depth":783,"text":4428},{"id":4451,"depth":783,"text":4454},{"id":4481,"depth":783,"text":4484},{"id":689,"depth":783,"text":692,"children":4629},[4630,4631,4632,4633,4634],{"id":4524,"depth":789,"text":4527},{"id":4539,"depth":789,"text":4542},{"id":4554,"depth":789,"text":4557},{"id":4569,"depth":789,"text":4572},{"id":4589,"depth":789,"text":4592},"content:articles:02-can-blockchain-transactions-be-traced.md","articles\u002F02-can-blockchain-transactions-be-traced.md","articles\u002F02-can-blockchain-transactions-be-traced",{"_path":4639,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":4640,"description":4641,"slug":4642,"date":4643,"lastUpdated":4643,"author":13,"readingTime":2601,"category":4247,"tags":4644,"ogImage":4648,"featured":7,"body":4649,"_type":807,"_id":5057,"_source":809,"_file":5058,"_stem":5059,"_extension":812},"\u002Farticles\u002F01-cryptocurrency-hidden-divorce-missouri","How cryptocurrency is hidden during divorce in Missouri","A guide for Missouri family law attorneys on identifying concealed cryptocurrency in divorce through discovery, exchange records, and blockchain tracing.","cryptocurrency-hidden-divorce-missouri","2026-04-07",[4645,4646,4647,19],"divorce","hidden-assets","missouri","\u002Fog\u002Fcryptocurrency-hidden-divorce-missouri.png",{"type":23,"children":4650,"toc":5035},[4651,4656,4662,4667,4672,4677,4683,4689,4694,4699,4705,4710,4715,4720,4726,4731,4736,4742,4747,4752,4758,4763,4768,4774,4779,4784,4790,4795,4800,4805,4810,4822,4828,4833,4838,4843,4848,4853,4859,4864,4869,4881,4887,4900,4905,4910,4928,4931,4935,4941,4950,4956,4965,4971,4980,4986,4995,5001,5010,5021,5024],{"type":26,"tag":27,"props":4652,"children":4653},{},[4654],{"type":31,"value":4655},"Cryptocurrency has become one of the more difficult asset categories to address in divorce proceedings. Unlike a bank account or a brokerage portfolio, cryptocurrency holdings can be held entirely outside the traditional financial system, transferred globally in minutes, and structured in ways that make them difficult to locate through conventional discovery methods. For Missouri family law practitioners, understanding how digital assets are concealed, and what tools exist to find them, is increasingly a practical necessity.",{"type":26,"tag":39,"props":4657,"children":4659},{"id":4658},"why-cryptocurrency-attracts-concealment",[4660],{"type":31,"value":4661},"Why Cryptocurrency Attracts Concealment",{"type":26,"tag":27,"props":4663,"children":4664},{},[4665],{"type":31,"value":4666},"The properties that make cryptocurrency attractive to ordinary users, primarily the ability to transact without relying on a bank, are the same properties that make it attractive to a spouse attempting to hide assets. A cryptocurrency wallet is not a bank account. There is no statements-on-request process, no responding institution that will confirm a balance, and no requirement that the holder's identity be attached to the wallet itself.",{"type":26,"tag":27,"props":4668,"children":4669},{},[4670],{"type":31,"value":4671},"Bitcoin and most other cryptocurrencies operate on public blockchains, meaning the transaction history is permanently visible to anyone who looks. The blockchain records every transfer of every coin. But visibility on the blockchain does not automatically reveal who controls a given wallet address. The address appears as a string of letters and numbers. Without additional context, that string does not announce a name.",{"type":26,"tag":27,"props":4673,"children":4674},{},[4675],{"type":31,"value":4676},"A party determined to conceal cryptocurrency holdings can exploit this gap between what the blockchain shows and what an investigator can attribute to a specific person. The blockchain is transparent; identity attribution requires work.",{"type":26,"tag":39,"props":4678,"children":4680},{"id":4679},"common-concealment-patterns",[4681],{"type":31,"value":4682},"Common Concealment Patterns",{"type":26,"tag":115,"props":4684,"children":4686},{"id":4685},"undisclosed-wallets-and-self-custody",[4687],{"type":31,"value":4688},"Undisclosed Wallets and Self-Custody",{"type":26,"tag":27,"props":4690,"children":4691},{},[4692],{"type":31,"value":4693},"The simplest concealment technique is omission. A party required to disclose all assets on a financial disclosure form simply does not list cryptocurrency holdings. If those holdings are held in a self-custody wallet, meaning the party controls the private key directly rather than keeping funds on an exchange, there is no financial institution to subpoena that will reveal the balance.",{"type":26,"tag":27,"props":4695,"children":4696},{},[4697],{"type":31,"value":4698},"Self-custody wallets can be software wallets installed on a phone or computer, hardware wallets (physical devices that look similar to a USB drive), or even paper wallets, which are printed records of the key material needed to access funds. A hardware wallet can hold millions of dollars in cryptocurrency and fits in a pocket. It does not appear on any bank record.",{"type":26,"tag":115,"props":4700,"children":4702},{"id":4701},"peer-to-peer-transfers-before-the-disclosure-date",[4703],{"type":31,"value":4704},"Peer-to-Peer Transfers Before the Disclosure Date",{"type":26,"tag":27,"props":4706,"children":4707},{},[4708],{"type":31,"value":4709},"A party may transfer cryptocurrency to a trusted third party, such as a friend, family member, or business associate, before or shortly after separation, with an informal understanding that the funds will be returned after the divorce is finalized. On paper, the wallet is emptied. On the blockchain, the transfer is permanent and visible, but the receiving address must still be connected to a specific person.",{"type":26,"tag":27,"props":4711,"children":4712},{},[4713],{"type":31,"value":4714},"Peer-to-peer transfers are common enough in the cryptocurrency ecosystem that they do not raise suspicion on their face. What matters for forensic purposes is the timing, the counterparty's relationship to the transferring spouse, and whether the transferred amount corresponds to a known or suspected holding.",{"type":26,"tag":27,"props":4716,"children":4717},{},[4718],{"type":31,"value":4719},"Hypothetical example: A spouse transfers cryptocurrency from a disclosed wallet to an address controlled by a family member shortly before the disclosure date. The transfer remains visible on the blockchain, while evidence about the relationship and the receiving address can help assess whether the transfer warrants further discovery.",{"type":26,"tag":115,"props":4721,"children":4723},{"id":4722},"undervaluing-holdings",[4724],{"type":31,"value":4725},"Undervaluing Holdings",{"type":26,"tag":27,"props":4727,"children":4728},{},[4729],{"type":31,"value":4730},"Parties sometimes acknowledge holding cryptocurrency but misrepresent its value. This can happen through selective disclosure, such as listing only holdings on one exchange while omitting wallets elsewhere, or through timing, such as valuing holdings at a point in time when prices were depressed.",{"type":26,"tag":27,"props":4732,"children":4733},{},[4734],{"type":31,"value":4735},"Cryptocurrency markets are volatile. Prices can move within a single week. A party who captures a low price point, or who selects the date of valuation strategically, may disclose a technically accurate number that bears little relationship to the actual economic value the other spouse would expect to share.",{"type":26,"tag":115,"props":4737,"children":4739},{"id":4738},"business-accounts-and-entity-structures",[4740],{"type":31,"value":4741},"Business Accounts and Entity Structures",{"type":26,"tag":27,"props":4743,"children":4744},{},[4745],{"type":31,"value":4746},"A party who owns or controls a business may route cryptocurrency activity through business accounts, particularly if the business operates in a technology-adjacent space where cryptocurrency payments or holdings are plausible. When cryptocurrency is held in a business name, it may be treated differently in the disclosure process, or simply overlooked in discovery directed at personal assets.",{"type":26,"tag":27,"props":4748,"children":4749},{},[4750],{"type":31,"value":4751},"Entity structures can complicate attribution substantially. A party who holds cryptocurrency through a series of limited liability companies, particularly companies formed in jurisdictions with minimal disclosure requirements, creates layers between the individual and the underlying asset that require careful tracing to unravel.",{"type":26,"tag":115,"props":4753,"children":4755},{"id":4754},"nfts-and-illiquid-digital-assets",[4756],{"type":31,"value":4757},"NFTs and Illiquid Digital Assets",{"type":26,"tag":27,"props":4759,"children":4760},{},[4761],{"type":31,"value":4762},"Non-fungible tokens (NFTs) are digital assets recorded on a blockchain that represent ownership of a unique item, often a piece of digital art, a collectible, or a membership interest in a community. NFT valuations are highly subjective and can be difficult to verify without market data.",{"type":26,"tag":27,"props":4764,"children":4765},{},[4766],{"type":31,"value":4767},"A party holding NFTs may assign them a nominal or deflated value on a financial disclosure, particularly if those NFTs were not acquired through a formal exchange with established pricing. The actual value on secondary markets may be higher. In some cases, NFTs have been transferred to third-party wallets before disclosure in the same way fungible cryptocurrency is moved.",{"type":26,"tag":115,"props":4769,"children":4771},{"id":4770},"mixing-services-and-privacy-coins",[4772],{"type":31,"value":4773},"Mixing Services and Privacy Coins",{"type":26,"tag":27,"props":4775,"children":4776},{},[4777],{"type":31,"value":4778},"More technically sophisticated parties may attempt to obscure the trail of their cryptocurrency through mixing services, which pool transactions from multiple users to make it difficult to trace the path of individual funds, or through privacy-focused cryptocurrencies that are designed from the ground up to hide transaction details.",{"type":26,"tag":27,"props":4780,"children":4781},{},[4782],{"type":31,"value":4783},"These techniques are meaningful but not absolute. Mixing services leave their own on-chain traces. Movements into and out of private transaction systems often involve identifiable exchange transactions. And the use of obfuscation tools can itself be evidence of intent, which is relevant to a court's analysis of credibility and disclosure obligations.",{"type":26,"tag":39,"props":4785,"children":4787},{"id":4786},"missouri-discovery-law-and-what-attorneys-can-compel",[4788],{"type":31,"value":4789},"Missouri Discovery Law and What Attorneys Can Compel",{"type":26,"tag":27,"props":4791,"children":4792},{},[4793],{"type":31,"value":4794},"Missouri courts apply the same broad discovery principles to cryptocurrency that they apply to other assets. Under Missouri Rules of Civil Procedure, parties in a dissolution proceeding are required to disclose all marital property, and the court has authority to compel complete and accurate financial disclosures.",{"type":26,"tag":27,"props":4796,"children":4797},{},[4798],{"type":31,"value":4799},"Interrogatories can require a party to identify all cryptocurrency wallets, exchanges, and accounts they hold or have held during the marriage, including any accounts from which funds were transferred in the period leading up to dissolution. Requests for production can require the production of account statements, transaction histories, private key documentation, and records of exchange registrations.",{"type":26,"tag":27,"props":4801,"children":4802},{},[4803],{"type":31,"value":4804},"Courts can and do subpoena cryptocurrency exchanges. Major exchanges operating in the United States, including Coinbase, Kraken, Gemini, and others, are subject to civil subpoenas and maintain account records, transaction histories, KYC (Know Your Customer) documentation, and linked bank account information. A well-crafted subpoena to a domestic exchange can produce substantial evidence about a party's cryptocurrency activity.",{"type":26,"tag":27,"props":4806,"children":4807},{},[4808],{"type":31,"value":4809},"Where the party used a foreign exchange or a non-KYC platform, the subpoena route becomes more complicated. Some exchanges are incorporated in offshore jurisdictions specifically to limit their exposure to civil process. In those circumstances, blockchain analysis becomes the primary investigative tool rather than a supplement to documentary discovery.",{"type":26,"tag":27,"props":4811,"children":4812},{},[4813,4815,4821],{"type":31,"value":4814},"For detailed guidance on how to structure exchange subpoenas, see ",{"type":26,"tag":56,"props":4816,"children":4818},{"href":4817},"\u002Fresources\u002Fsubpoenaing-cryptocurrency-exchange-records",[4819],{"type":31,"value":4820},"Subpoenaing Cryptocurrency Exchange Records",{"type":31,"value":381},{"type":26,"tag":39,"props":4823,"children":4825},{"id":4824},"how-blockchain-tracing-works-in-a-divorce-context",[4826],{"type":31,"value":4827},"How Blockchain Tracing Works in a Divorce Context",{"type":26,"tag":27,"props":4829,"children":4830},{},[4831],{"type":31,"value":4832},"Blockchain tracing is the process of following the movement of cryptocurrency on the public ledger from known addresses to unknown ones, and building a picture of where funds originated, where they went, and in what amounts. Because every transaction on a public blockchain is permanently recorded, the historical record cannot be altered. The blockchain is, in this sense, an immutable audit trail.",{"type":26,"tag":27,"props":4834,"children":4835},{},[4836],{"type":31,"value":4837},"A forensic blockchain analyst will typically begin from a known starting point: an address that can be confirmed as belonging to a party, often identified through exchange records, a device examination, or a disclosure the party made. From there, the analyst traces outgoing transactions, looking for patterns that suggest where funds were moved.",{"type":26,"tag":27,"props":4839,"children":4840},{},[4841],{"type":31,"value":4842},"Address clustering is one of the foundational techniques in blockchain forensics. It exploits the observation that many cryptocurrency transactions involve multiple input addresses controlled by the same wallet. When multiple addresses consistently appear together as inputs in the same transactions, they can be inferred to belong to the same controller. This allows analysts to expand the picture of a party's holdings beyond the addresses they disclosed.",{"type":26,"tag":27,"props":4844,"children":4845},{},[4846],{"type":31,"value":4847},"Exchange attribution involves identifying transactions that moved funds to or from known exchange deposit addresses. Major exchanges are associated with large numbers of deposit addresses that have been catalogued through years of research. When a transaction flows into one of those addresses, it is possible to identify which exchange received the funds, even if the specific account is not yet known.",{"type":26,"tag":27,"props":4849,"children":4850},{},[4851],{"type":31,"value":4852},"The combination of these techniques means that, for cryptocurrency moved through the mainstream ecosystem, the historical record is often more complete than a party might expect. The blockchain does not forget. Funds that were moved three years before a divorce filing can still be traced if the starting point is established.",{"type":26,"tag":39,"props":4854,"children":4856},{"id":4855},"limitations-of-attribution",[4857],{"type":31,"value":4858},"Limitations of Attribution",{"type":26,"tag":27,"props":4860,"children":4861},{},[4862],{"type":31,"value":4863},"Blockchain tracing produces evidence about address activity, not directly about person identity. An analyst can demonstrate that a certain wallet address received funds from an exchange account, or that funds moved from address A to address B in a specific transaction. The analyst cannot state with certainty, based solely on the blockchain record, that a particular person controls a particular address.",{"type":26,"tag":27,"props":4865,"children":4866},{},[4867],{"type":31,"value":4868},"Attribution, meaning the connection of a wallet address to a specific individual, relies on additional evidence: exchange records that link an address to an account, device forensics that show wallet software was installed and used on a specific device, metadata from wallet backups or seed phrase storage, or the party's own statements. Blockchain tracing is strongest when it is combined with traditional discovery rather than substituted for it.",{"type":26,"tag":27,"props":4870,"children":4871},{},[4872,4874,4879],{"type":31,"value":4873},"This limitation is important for trial preparation. A report that establishes a detailed transaction history is valuable; a report that overstates what that history proves about ownership will face challenge. Credible expert testimony distinguishes clearly between what the blockchain demonstrates and what the attribution evidence establishes. See ",{"type":26,"tag":56,"props":4875,"children":4876},{"href":184},[4877],{"type":31,"value":4878},"Understanding Wallet Ownership Evidence",{"type":31,"value":4880}," for a full treatment of how ownership is established in litigation.",{"type":26,"tag":39,"props":4882,"children":4884},{"id":4883},"what-consensusintel-can-provide",[4885],{"type":31,"value":4886},"What ConsensusIntel Can Provide",{"type":26,"tag":27,"props":4888,"children":4889},{},[4890,4892,4898],{"type":31,"value":4891},"For Missouri family law attorneys dealing with suspected cryptocurrency concealment, ",{"type":26,"tag":56,"props":4893,"children":4895},{"href":4894},"\u002Fabout",[4896],{"type":31,"value":4897},"ConsensusIntel",{"type":31,"value":4899}," offers forensic analysis that is designed to support the litigation process from start to finish.",{"type":26,"tag":27,"props":4901,"children":4902},{},[4903],{"type":31,"value":4904},"That work typically includes: identifying exchange accounts and wallet addresses from available evidence and transaction histories, tracing the movement of funds through public blockchain records, preparing a written forensic report that documents findings and methodology in a form suitable for use in discovery and at hearing, and providing expert testimony that explains technical findings to a judge or mediator in plain terms.",{"type":26,"tag":27,"props":4906,"children":4907},{},[4908],{"type":31,"value":4909},"Early engagement matters. Cryptocurrency transactions are permanent, but the ability to take advantage of the available evidence depends on acting before critical information is subpoenaed, destroyed, or moved beyond jurisdictional reach. Exchange records are retained for limited periods. Devices get replaced. The longer a suspected concealment goes uninvestigated, the narrower the practical options become.",{"type":26,"tag":27,"props":4911,"children":4912},{},[4913,4915,4919,4921,4926],{"type":31,"value":4914},"The analysis produced by ConsensusIntel does not guarantee a particular outcome or a particular asset recovery. What it provides is a technically rigorous picture of the available evidence, presented in a form that supports competent advocacy. See ",{"type":26,"tag":56,"props":4916,"children":4917},{"href":270},[4918],{"type":31,"value":1904},{"type":31,"value":4920}," for more detail on what engagements look like in practice, or review ",{"type":26,"tag":56,"props":4922,"children":4923},{"href":4509},[4924],{"type":31,"value":4925},"the case types we handle",{"type":31,"value":4927}," to assess whether your matter fits the scope of our work.",{"type":26,"tag":4515,"props":4929,"children":4930},{},[],{"type":26,"tag":39,"props":4932,"children":4933},{"id":689},[4934],{"type":31,"value":692},{"type":26,"tag":115,"props":4936,"children":4938},{"id":4937},"q-can-cryptocurrency-really-be-hidden-from-a-divorce-court",[4939],{"type":31,"value":4940},"Q: Can cryptocurrency really be hidden from a divorce court?",{"type":26,"tag":27,"props":4942,"children":4943},{},[4944,4948],{"type":26,"tag":590,"props":4945,"children":4946},{},[4947],{"type":31,"value":706},{"type":31,"value":4949}," Concealment is possible, and it happens. But the blockchain maintains a permanent record of every transaction, and forensic analysis can often follow the trail of funds even when a party does not disclose their holdings voluntarily. The difficulty of concealment depends on how sophisticated the party is and which tools they used. Most cryptocurrency activity passes through exchanges that maintain records and are subject to domestic subpoena.",{"type":26,"tag":115,"props":4951,"children":4953},{"id":4952},"q-what-if-my-clients-spouse-held-crypto-on-a-foreign-exchange",[4954],{"type":31,"value":4955},"Q: What if my client's spouse held crypto on a foreign exchange?",{"type":26,"tag":27,"props":4957,"children":4958},{},[4959,4963],{"type":26,"tag":590,"props":4960,"children":4961},{},[4962],{"type":31,"value":706},{"type":31,"value":4964}," Foreign exchanges vary in their responsiveness to civil process. Some are structured to minimize their exposure to U.S. legal process, and others cooperate through mutual legal assistance frameworks or voluntarily. When exchange records are unavailable, blockchain analysis on the public ledger becomes the primary investigative tool. A forensic analyst can often identify the exchange used even without the exchange's records by analyzing transaction patterns.",{"type":26,"tag":115,"props":4966,"children":4968},{"id":4967},"q-how-does-missouri-treat-cryptocurrency-as-marital-property",[4969],{"type":31,"value":4970},"Q: How does Missouri treat cryptocurrency as marital property?",{"type":26,"tag":27,"props":4972,"children":4973},{},[4974,4978],{"type":26,"tag":590,"props":4975,"children":4976},{},[4977],{"type":31,"value":706},{"type":31,"value":4979}," Missouri courts treat cryptocurrency acquired during the marriage the same way they treat other marital property: it is subject to equitable distribution. The challenges are valuation and disclosure. Courts have discretion to draw adverse inferences when a party fails to comply with disclosure obligations, and have authority to impose sanctions for discovery misconduct.",{"type":26,"tag":115,"props":4981,"children":4983},{"id":4982},"q-what-evidence-does-a-party-actually-need-to-disclose",[4984],{"type":31,"value":4985},"Q: What evidence does a party actually need to disclose?",{"type":26,"tag":27,"props":4987,"children":4988},{},[4989,4993],{"type":26,"tag":590,"props":4990,"children":4991},{},[4992],{"type":31,"value":706},{"type":31,"value":4994}," Missouri financial disclosure rules require parties to identify all assets, including digital assets. That includes the existence of wallets, the approximate value of holdings, and any transactions that transferred value out of those wallets during the relevant period. An attorney should draft discovery requests that specifically address cryptocurrency to avoid the argument that standard financial disclosure requests did not reach digital assets.",{"type":26,"tag":115,"props":4996,"children":4998},{"id":4997},"q-how-long-does-blockchain-forensic-analysis-take-and-is-it-admissible-in-a-missouri-family-law-proceeding",[4999],{"type":31,"value":5000},"Q: How long does blockchain forensic analysis take, and is it admissible in a Missouri family law proceeding?",{"type":26,"tag":27,"props":5002,"children":5003},{},[5004,5008],{"type":26,"tag":590,"props":5005,"children":5006},{},[5007],{"type":31,"value":706},{"type":31,"value":5009}," The timeline depends on the complexity of the holdings and the amount of available starting information. A case involving one or two exchange accounts and straightforward transaction history may be analyzed in a matter of days. Cases involving multiple chains, DeFi activity, or deliberate obfuscation require more time. Early engagement allows the analysis to be completed on a schedule that supports your litigation timeline.",{"type":26,"tag":27,"props":5011,"children":5012},{},[5013,5015,5019],{"type":31,"value":5014},"Blockchain records, combined with proper authentication and expert testimony, have been admitted in civil proceedings. The admissibility of expert testimony in Missouri is governed by standards that require the expert's methodology to be reliable and the opinion to be helpful to the trier of fact. A well-documented forensic report prepared by a qualified analyst will typically satisfy those requirements. See ",{"type":26,"tag":56,"props":5016,"children":5017},{"href":3643},[5018],{"type":31,"value":4476},{"type":31,"value":5020}," for a detailed treatment of the evidentiary issues.",{"type":26,"tag":4515,"props":5022,"children":5023},{},[],{"type":26,"tag":27,"props":5025,"children":5026},{},[5027,5029,5033],{"type":31,"value":5028},"If you are handling a Missouri dissolution matter where cryptocurrency concealment is suspected, contact ",{"type":26,"tag":56,"props":5030,"children":5031},{"href":776},[5032],{"type":31,"value":4897},{"type":31,"value":5034}," to discuss what a forensic engagement would look like for your specific facts.",{"title":8,"searchDepth":783,"depth":783,"links":5036},[5037,5038,5046,5047,5048,5049,5050],{"id":4658,"depth":783,"text":4661},{"id":4679,"depth":783,"text":4682,"children":5039},[5040,5041,5042,5043,5044,5045],{"id":4685,"depth":789,"text":4688},{"id":4701,"depth":789,"text":4704},{"id":4722,"depth":789,"text":4725},{"id":4738,"depth":789,"text":4741},{"id":4754,"depth":789,"text":4757},{"id":4770,"depth":789,"text":4773},{"id":4786,"depth":783,"text":4789},{"id":4824,"depth":783,"text":4827},{"id":4855,"depth":783,"text":4858},{"id":4883,"depth":783,"text":4886},{"id":689,"depth":783,"text":692,"children":5051},[5052,5053,5054,5055,5056],{"id":4937,"depth":789,"text":4940},{"id":4952,"depth":789,"text":4955},{"id":4967,"depth":789,"text":4970},{"id":4982,"depth":789,"text":4985},{"id":4997,"depth":789,"text":5000},"content:articles:01-cryptocurrency-hidden-divorce-missouri.md","articles\u002F01-cryptocurrency-hidden-divorce-missouri.md","articles\u002F01-cryptocurrency-hidden-divorce-missouri",1790145013676]