[{"data":1,"prerenderedAt":1769},["ShallowReactive",2],{"tag-ethereum":3},[4,1065,1376],{"_path":5,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":9,"description":10,"slug":11,"date":12,"lastUpdated":12,"author":13,"readingTime":14,"category":15,"tags":16,"ogImage":21,"featured":7,"body":22,"_type":1059,"_id":1060,"_source":1061,"_file":1062,"_stem":1063,"_extension":1064},"\u002Farticles\u002F27-evm-receipts-logs-execution-traces","articles",false,"","Beyond the transaction hash: receipts, logs, and EVM traces","A transaction hash proves submission, not success. Receipts, event logs, and EVM traces answer whether execution succeeded and what assets moved.","evm-receipts-logs-execution-traces","2026-06-13","Nick Kampe",12,"Methodology",[17,18,19,20],"ethereum","smart-contracts","blockchain-tracing","evidence","\u002Fog\u002Fevm-receipts-logs-execution-traces.png",{"type":23,"children":24,"toc":1038},"root",[25,42,49,118,151,157,217,247,254,306,312,325,400,435,441,486,514,571,577,582,619,647,653,662,674,707,741,767,802,807,813,818,823,828,833,838,843,849,920,926,931,937,943,967,973,982,988,1010,1016,1025],{"type":26,"tag":27,"props":28,"children":29},"element","p",{},[30,33,40],{"type":31,"value":32},"text","A transaction hash is where most investigations start and where too many stop. The hash identifies the envelope: the signed message broadcast to the network, containing the sender, the recipient, the value, and the input data. It does not say whether execution succeeded, which contracts actually ran, or what assets moved. Those facts live in other artifacts: the receipt, the event logs, the call tree, and the execution trace. Each answers a different question and each carries different evidentiary weight. Explorer pages fuse these layers into one screen, which is exactly why lawyers overstate what a hash proves. For the fundamentals of reading a single transaction, ",{"type":26,"tag":34,"props":35,"children":37},"a",{"href":36},"\u002Fresources\u002Fhow-to-read-a-blockchain-transaction",[38],{"type":31,"value":39},"start with the basic guide",{"type":31,"value":41},".",{"type":26,"tag":43,"props":44,"children":46},"h2",{"id":45},"why-the-transaction-hash-proves-submission-not-execution",[47],{"type":31,"value":48},"Why the Transaction Hash Proves Submission, Not Execution",{"type":26,"tag":27,"props":50,"children":51},{},[52,54,61,63,71,73,79,81,87,88,94,95,101,103,109,111,116],{"type":31,"value":53},"The hash is a cryptographic fingerprint of the signed transaction, computed from the transaction data at signing time. Retrieving the transaction object through ",{"type":26,"tag":55,"props":56,"children":58},"code",{"className":57},[],[59],{"type":31,"value":60},"eth_getTransactionByHash",{"type":31,"value":62},", a method in the ",{"type":26,"tag":34,"props":64,"children":68},{"href":65,"rel":66},"https:\u002F\u002Fgithub.com\u002Fethereum\u002Fexecution-apis",[67],"nofollow",[69],{"type":31,"value":70},"execution-apis JSON-RPC collection",{"type":31,"value":72},", returns the envelope: ",{"type":26,"tag":55,"props":74,"children":76},{"className":75},[],[77],{"type":31,"value":78},"from",{"type":31,"value":80},", ",{"type":26,"tag":55,"props":82,"children":84},{"className":83},[],[85],{"type":31,"value":86},"to",{"type":31,"value":80},{"type":26,"tag":55,"props":89,"children":91},{"className":90},[],[92],{"type":31,"value":93},"value",{"type":31,"value":80},{"type":26,"tag":55,"props":96,"children":98},{"className":97},[],[99],{"type":31,"value":100},"input",{"type":31,"value":102}," data, ",{"type":26,"tag":55,"props":104,"children":106},{"className":105},[],[107],{"type":31,"value":108},"nonce",{"type":31,"value":110},", gas parameters, fee fields, block number, and index. The ",{"type":26,"tag":55,"props":112,"children":114},{"className":113},[],[115],{"type":31,"value":78},{"type":31,"value":117}," address is derived from the cryptographic signature, so the envelope establishes which account signed the message, not which person held that account.",{"type":26,"tag":27,"props":119,"children":120},{},[121,123,128,130,135,137,142,144,149],{"type":31,"value":122},"If ",{"type":26,"tag":55,"props":124,"children":126},{"className":125},[],[127],{"type":31,"value":86},{"type":31,"value":129}," is a contract address, the ",{"type":26,"tag":55,"props":131,"children":133},{"className":132},[],[134],{"type":31,"value":100},{"type":31,"value":136}," field is an encoded function call, and the envelope alone does not reveal what that function did, whether it succeeded, or whether any token changed hands. The ",{"type":26,"tag":55,"props":138,"children":140},{"className":139},[],[141],{"type":31,"value":93},{"type":31,"value":143}," field carries only native ETH and only the top-level amount: a 5,000 USDC transfer typically appears with a ",{"type":26,"tag":55,"props":145,"children":147},{"className":146},[],[148],{"type":31,"value":93},{"type":31,"value":150}," of zero. Confirm finality before treating a mined hash as settled: a transaction in a block reorganized out of the canonical chain can disappear from the record.",{"type":26,"tag":43,"props":152,"children":154},{"id":153},"the-receipt-the-networks-verdict-on-success",[155],{"type":31,"value":156},"The Receipt: The Network's Verdict on Success",{"type":26,"tag":27,"props":158,"children":159},{},[160,162,168,170,177,179,185,187,193,194,200,201,207,209,215],{"type":31,"value":161},"Unlike a trace, a receipt is consensus data. Blocks commit a receipts root, and a node that still holds the relevant history can serve the receipt via ",{"type":26,"tag":55,"props":163,"children":165},{"className":164},[],[166],{"type":31,"value":167},"eth_getTransactionReceipt",{"type":31,"value":169},". The ",{"type":26,"tag":34,"props":171,"children":174},{"href":172,"rel":173},"https:\u002F\u002Fgithub.com\u002Fethereum\u002Fexecution-apis\u002Fblob\u002Fmain\u002Fsrc\u002Fschemas\u002Freceipt.yaml",[67],[175],{"type":31,"value":176},"execution-apis receipt schema",{"type":31,"value":178}," requires ",{"type":26,"tag":55,"props":180,"children":182},{"className":181},[],[183],{"type":31,"value":184},"status",{"type":31,"value":186}," (after Byzantium), ",{"type":26,"tag":55,"props":188,"children":190},{"className":189},[],[191],{"type":31,"value":192},"gasUsed",{"type":31,"value":80},{"type":26,"tag":55,"props":195,"children":197},{"className":196},[],[198],{"type":31,"value":199},"cumulativeGasUsed",{"type":31,"value":80},{"type":26,"tag":55,"props":202,"children":204},{"className":203},[],[205],{"type":31,"value":206},"logs",{"type":31,"value":208},", and ",{"type":26,"tag":55,"props":210,"children":212},{"className":211},[],[213],{"type":31,"value":214},"effectiveGasPrice",{"type":31,"value":216},", the amount actually deducted per gas. Some clients prune old receipts and return a \"pruned history unavailable\" error, so confirm the node still holds the block before treating a missing receipt as proof that the transaction never existed.",{"type":26,"tag":27,"props":218,"children":219},{},[220,222,229,231,238,240,245],{"type":31,"value":221},"Status semantics come from ",{"type":26,"tag":34,"props":223,"children":226},{"href":224,"rel":225},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-658",[67],[227],{"type":31,"value":228},"EIP-658",{"type":31,"value":230},", which replaced the receipt's intermediate state root with a status code: 1 for success, 0 for failure. The change activated with the ",{"type":26,"tag":34,"props":232,"children":235},{"href":233,"rel":234},"https:\u002F\u002Fblog.ethereum.org\u002F2017\u002F10\u002F12\u002Fbyzantium-hf-announcement",[67],[236],{"type":31,"value":237},"Byzantium hard fork",{"type":31,"value":239}," at block 4,370,000 on October 16, 2017. Transactions before that fork have no status field, and failure was inferred by comparing ",{"type":26,"tag":55,"props":241,"children":243},{"className":242},[],[244],{"type":31,"value":192},{"type":31,"value":246}," against the gas limit. EIP-658's own motivation explains why that heuristic became unsound: with the REVERT opcode, \"it is no longer possible for users to assume that a transaction failed iff it consumed all gas.\" For pre-Byzantium transactions, the outcome can only be reconstructed by replaying execution.",{"type":26,"tag":248,"props":249,"children":251},"h3",{"id":250},"failed-transactions-still-cost-money",[252],{"type":31,"value":253},"Failed Transactions Still Cost Money",{"type":26,"tag":27,"props":255,"children":256},{},[257,259,266,268,274,276,282,284,289,291,296,298,304],{"type":31,"value":258},"A status of 0 means the top-level call failed and every state change rolled back. The transaction is still recorded, its nonce is consumed, and the sender pays for gas actually used. After Byzantium that is often well below the gas limit: ",{"type":26,"tag":34,"props":260,"children":263},{"href":261,"rel":262},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-140",[67],[264],{"type":31,"value":265},"EIP-140",{"type":31,"value":267}," added REVERT so a contract can \"stop execution and revert state changes, without consuming all provided gas.\" Solidity ",{"type":26,"tag":55,"props":269,"children":271},{"className":270},[],[272],{"type":31,"value":273},"require",{"type":31,"value":275}," and ",{"type":26,"tag":55,"props":277,"children":279},{"className":278},[],[280],{"type":31,"value":281},"revert",{"type":31,"value":283}," use that opcode. Exceptional failures such as out-of-gas still consume remaining gas. ",{"type":26,"tag":55,"props":285,"children":287},{"className":286},[],[288],{"type":31,"value":192},{"type":31,"value":290}," multiplied by ",{"type":26,"tag":55,"props":292,"children":294},{"className":293},[],[295],{"type":31,"value":214},{"type":31,"value":297}," (or ",{"type":26,"tag":55,"props":299,"children":301},{"className":300},[],[302],{"type":31,"value":303},"gasPrice",{"type":31,"value":305}," where that is the legacy price) is the fee figure, usable for damages even when the transfer failed. Success means only that the call did not revert, so no asset conclusion should rest on the status field alone.",{"type":26,"tag":43,"props":307,"children":309},{"id":308},"event-logs-the-contracts-own-testimony",[310],{"type":31,"value":311},"Event Logs: The Contract's Own Testimony",{"type":26,"tag":27,"props":313,"children":314},{},[315,317,323],{"type":31,"value":316},"Logs are stored inside the receipt and emitted by contract code during execution. Each log carries the emitting contract address, up to four indexed topics, and a data payload, and history can be queried with ",{"type":26,"tag":55,"props":318,"children":320},{"className":319},[],[321],{"type":31,"value":322},"eth_getLogs",{"type":31,"value":324},", filtered by address and topic signature. The \"token transfers\" panels on explorers are decodes of these logs, not independent data.",{"type":26,"tag":27,"props":326,"children":327},{},[328,330,337,339,345,347,353,354,360,362,368,370,376,378,383,385,391,393,398],{"type":31,"value":329},"The ",{"type":26,"tag":34,"props":331,"children":334},{"href":332,"rel":333},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-20",[67],[335],{"type":31,"value":336},"ERC-20 standard (EIP-20)",{"type":31,"value":338}," requires a ",{"type":26,"tag":55,"props":340,"children":342},{"className":341},[],[343],{"type":31,"value":344},"Transfer",{"type":31,"value":346}," event on every ",{"type":26,"tag":55,"props":348,"children":350},{"className":349},[],[351],{"type":31,"value":352},"transfer",{"type":31,"value":275},{"type":26,"tag":55,"props":355,"children":357},{"className":356},[],[358],{"type":31,"value":359},"transferFrom",{"type":31,"value":361}," call, including zero-value transfers, and an ",{"type":26,"tag":55,"props":363,"children":365},{"className":364},[],[366],{"type":31,"value":367},"Approval",{"type":31,"value":369}," event on every successful ",{"type":26,"tag":55,"props":371,"children":373},{"className":372},[],[374],{"type":31,"value":375},"approve",{"type":31,"value":377},". A token that creates new tokens SHOULD emit a ",{"type":26,"tag":55,"props":379,"children":381},{"className":380},[],[382],{"type":31,"value":344},{"type":31,"value":384}," with ",{"type":26,"tag":55,"props":386,"children":388},{"className":387},[],[389],{"type":31,"value":390},"_from",{"type":31,"value":392}," set to the zero address. Those conventions are why ",{"type":26,"tag":55,"props":394,"children":396},{"className":395},[],[397],{"type":31,"value":344},{"type":31,"value":399}," logs are the backbone of token-flow reconstruction.",{"type":26,"tag":27,"props":401,"children":402},{},[403,405,410,412,417,419,425,427,433],{"type":31,"value":404},"The protocol does not enforce any of it. Events are emitted by whatever code the contract runs, and the EVM does not check whether an emitted ",{"type":26,"tag":55,"props":406,"children":408},{"className":407},[],[409],{"type":31,"value":344},{"type":31,"value":411}," corresponds to a real balance change. A noncompliant contract can emit a ",{"type":26,"tag":55,"props":413,"children":415},{"className":414},[],[416],{"type":31,"value":344},{"type":31,"value":418}," without moving a token, or move tokens while emitting nothing. EIP-140 notes that reverting an EVM execution means \"all changes, including LOGs, are lost,\" so a failed transaction's receipt carries no logs, and an event from a failed subcall disappears even when the surrounding transaction succeeds. Fee-on-transfer and rebasing tokens can log an amount that differs from the balance delta. Treat logs as admissions by the contract, not ground truth. Corroborate with ",{"type":26,"tag":55,"props":420,"children":422},{"className":421},[],[423],{"type":31,"value":424},"balanceOf",{"type":31,"value":426}," at the relevant block via ",{"type":26,"tag":55,"props":428,"children":430},{"className":429},[],[431],{"type":31,"value":432},"eth_call",{"type":31,"value":434},", check that an allowance was consumed, and confirm the flow against the call tree.",{"type":26,"tag":43,"props":436,"children":438},{"id":437},"the-call-tree-what-actually-executed",[439],{"type":31,"value":440},"The Call Tree: What Actually Executed",{"type":26,"tag":27,"props":442,"children":443},{},[444,446,452,454,461,463,468,469,475,477,484],{"type":31,"value":445},"One envelope can fan out into many internal executions, and the shape of that tree is often the entire case. A contract that calls another executes the callee's code in the callee's context, with the caller as ",{"type":26,"tag":55,"props":447,"children":449},{"className":448},[],[450],{"type":31,"value":451},"msg.sender",{"type":31,"value":453},". Delegatecall, the opcode ",{"type":26,"tag":34,"props":455,"children":458},{"href":456,"rel":457},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-7",[67],[459],{"type":31,"value":460},"added in the Homestead fork (EIP-7)",{"type":31,"value":462},", inverts that: the callee's code runs in the caller's storage context, preserving ",{"type":26,"tag":55,"props":464,"children":466},{"className":465},[],[467],{"type":31,"value":451},{"type":31,"value":275},{"type":26,"tag":55,"props":470,"children":472},{"className":471},[],[473],{"type":31,"value":474},"msg.value",{"type":31,"value":476},". This is the mechanism behind ",{"type":26,"tag":34,"props":478,"children":481},{"href":479,"rel":480},"https:\u002F\u002Fwww.openzeppelin.com\u002Fnews\u002Fproxy-patterns",[67],[482],{"type":31,"value":483},"upgradeable proxies",{"type":31,"value":485},", where a user calls a proxy address and the proxy delegatecalls an implementation contract. The forensic consequence is direct: the address that received the call is not necessarily the address whose code ran, and a plain transaction page will not tell you which is which.",{"type":26,"tag":27,"props":487,"children":488},{},[489,491,496,498,504,506,512],{"type":31,"value":490},"Routers and aggregators add a third layer. A swap transaction shows ",{"type":26,"tag":55,"props":492,"children":494},{"className":493},[],[495],{"type":31,"value":86},{"type":31,"value":497}," equal to a router address; the call tree shows the router calling pair contracts, which move tokens on their own ledgers. ETH that a contract forwards onward appears only in the trace, and ERC-20 movement appears only in the token contract's logs and ledger. Where holdings pass through several protocol contracts inside one transaction, ",{"type":26,"tag":34,"props":499,"children":501},{"href":500},"\u002Fresources\u002Fwhat-lawyers-need-to-know-about-defi",[502],{"type":31,"value":503},"tracing through DeFi mechanics",{"type":31,"value":505}," is where that analysis gets its teeth, while ",{"type":26,"tag":34,"props":507,"children":509},{"href":508},"\u002Fresources\u002Fsmart-contract-disputes",[510],{"type":31,"value":511},"smart contract disputes",{"type":31,"value":513}," covers the contract interpretation and remedies side of the same record.",{"type":26,"tag":27,"props":515,"children":516},{},[517,519,526,528,535,537,544,546,552,554,561,563,569],{"type":31,"value":518},"Retrieval is where standardization ends. Tracing RPCs are client-specific: geth exposes trace methods in its ",{"type":26,"tag":34,"props":520,"children":523},{"href":521,"rel":522},"https:\u002F\u002Fgeth.ethereum.org\u002Fdocs\u002Finteracting-with-geth\u002Frpc\u002Fns-debug",[67],[524],{"type":31,"value":525},"debug namespace",{"type":31,"value":527}," and documents tracing as ",{"type":26,"tag":34,"props":529,"children":532},{"href":530,"rel":531},"https:\u002F\u002Fgeth.ethereum.org\u002Fdocs\u002Fdevelopers\u002Fevm-tracing",[67],[533],{"type":31,"value":534},"re-running transactions locally",{"type":31,"value":536},". ",{"type":26,"tag":34,"props":538,"children":541},{"href":539,"rel":540},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-3155",[67],[542],{"type":31,"value":543},"EIP-3155",{"type":31,"value":545}," proposed a JSON format for EVM traces during state tests; it remains at Last Call and is not a finalized ",{"type":26,"tag":55,"props":547,"children":549},{"className":548},[],[550],{"type":31,"value":551},"debug_traceTransaction",{"type":31,"value":553}," standard. ",{"type":26,"tag":34,"props":555,"children":558},{"href":556,"rel":557},"https:\u002F\u002Feips.ethereum.org\u002FEIPS\u002Feip-1474",[67],[559],{"type":31,"value":560},"EIP-1474",{"type":31,"value":562},", which cataloged JSON-RPC methods, is stagnant; the maintained specification is the ",{"type":26,"tag":34,"props":564,"children":566},{"href":65,"rel":565},[67],[567],{"type":31,"value":568},"execution-apis repository",{"type":31,"value":570},". Because output depends on the client, its version, and the tracer, an expert's methodology documentation matters as much as the trace itself.",{"type":26,"tag":43,"props":572,"children":574},{"id":573},"node-and-archive-requirements-for-reproducible-tracing",[575],{"type":31,"value":576},"Node and Archive Requirements for Reproducible Tracing",{"type":26,"tag":27,"props":578,"children":579},{},[580],{"type":31,"value":581},"Traces are re-execution, not stored data. Reproducing what a transaction did requires the state that existed at that block.",{"type":26,"tag":27,"props":583,"children":584},{},[585,587,594,595,601,603,609,611,617],{"type":31,"value":586},"A full node caches only recent state, on the order of the last 128 blocks, per ",{"type":26,"tag":34,"props":588,"children":591},{"href":589,"rel":590},"https:\u002F\u002Fethereum.org\u002Fdevelopers\u002Fdocs\u002Fnodes-and-clients\u002Farchive-nodes\u002F",[67],[592],{"type":31,"value":593},"ethereum.org's archive-node documentation",{"type":31,"value":275},{"type":26,"tag":34,"props":596,"children":598},{"href":530,"rel":597},[67],[599],{"type":31,"value":600},"geth's tracing notes",{"type":31,"value":602},". Older states can be regenerated from checkpoints, which becomes expensive the further back you go. Geth's default ",{"type":26,"tag":55,"props":604,"children":606},{"className":605},[],[607],{"type":31,"value":608},"reexec",{"type":31,"value":610}," window is 128 blocks; beyond it, a trace fails unless the window is increased or the node is an archive node. An ",{"type":26,"tag":34,"props":612,"children":614},{"href":589,"rel":613},[67],[615],{"type":31,"value":616},"archive node",{"type":31,"value":618}," stores historical states so those queries return immediately, at the cost of multiple terabytes of disk. Confirm archive-state access or provider tracing support before promising a trace of an old transaction, and record the node type, client version, sync mode, tracer, and block height.",{"type":26,"tag":27,"props":620,"children":621},{},[622,624,630,632,638,639,645],{"type":31,"value":623},"Opcode-level traces can run to hundreds of megabytes for a busy transaction, which makes them impractical to attach wholesale; high-level call tracers are compact but capture a different layer. Execution is deterministic given the same client, state, and tracer, but different client versions can produce different output. Our ",{"type":26,"tag":34,"props":625,"children":627},{"href":626},"\u002Fmethodology",[628],{"type":31,"value":629},"methodology",{"type":31,"value":631}," treats reproducibility and documented retrieval as core requirements of blockchain forensic work; for packaging this evidence for court, ConsensusIntel offers ",{"type":26,"tag":34,"props":633,"children":635},{"href":634},"\u002Fservices#blockchain-tracing",[636],{"type":31,"value":637},"blockchain tracing",{"type":31,"value":275},{"type":26,"tag":34,"props":640,"children":642},{"href":641},"\u002Fservices#evidence-review",[643],{"type":31,"value":644},"evidence review",{"type":31,"value":646}," built around artifact-level preservation rather than explorer screenshots.",{"type":26,"tag":43,"props":648,"children":650},{"id":649},"hypothetical-example-one-transaction-four-evidence-layers",[651],{"type":31,"value":652},"Hypothetical Example: One Transaction, Four Evidence Layers",{"type":26,"tag":27,"props":654,"children":655},{},[656],{"type":26,"tag":657,"props":658,"children":659},"strong",{},[660],{"type":31,"value":661},"Hypothetical example: the addresses and amounts below are invented for illustration; no real matter is described.",{"type":26,"tag":27,"props":663,"children":664},{},[665,667,672],{"type":31,"value":666},"A victim account (V) has an outstanding ",{"type":26,"tag":55,"props":668,"children":670},{"className":669},[],[671],{"type":31,"value":375},{"type":31,"value":673}," to an attacker-controlled contract (D) for 5,000 USDC. D was deployed with code that delegatecalls a reusable template (T). V signs a single transaction to D. The explorer shows \"Method: transfer\", \"Status: Success\", and a tokens-transferred panel reading \"USDC 5,000 from V to A\".",{"type":26,"tag":27,"props":675,"children":676},{},[677,679,684,686,691,693,698,700,705],{"type":31,"value":678},"Layer 1, the envelope: ",{"type":26,"tag":55,"props":680,"children":682},{"className":681},[],[683],{"type":31,"value":78},{"type":31,"value":685}," V, ",{"type":26,"tag":55,"props":687,"children":689},{"className":688},[],[690],{"type":31,"value":86},{"type":31,"value":692}," D, ",{"type":26,"tag":55,"props":694,"children":696},{"className":695},[],[697],{"type":31,"value":93},{"type":31,"value":699}," 0, a small ",{"type":26,"tag":55,"props":701,"children":703},{"className":702},[],[704],{"type":31,"value":100},{"type":31,"value":706}," payload. V submitted a message to D; no ETH moved to D; there is no USDC in this artifact.",{"type":26,"tag":27,"props":708,"children":709},{},[710,712,717,719,724,726,731,733,739],{"type":31,"value":711},"Layer 2, the receipt: status 1, ",{"type":26,"tag":55,"props":713,"children":715},{"className":714},[],[716],{"type":31,"value":192},{"type":31,"value":718}," 94,220, and three logs: ",{"type":26,"tag":55,"props":720,"children":722},{"className":721},[],[723],{"type":31,"value":344},{"type":31,"value":725}," from V to D of 5,000 USDC, ",{"type":26,"tag":55,"props":727,"children":729},{"className":728},[],[730],{"type":31,"value":344},{"type":31,"value":732}," from D to A of 5,000 USDC, and ",{"type":26,"tag":55,"props":734,"children":736},{"className":735},[],[737],{"type":31,"value":738},"RewardsClaimed",{"type":31,"value":740}," for V. Execution succeeded, the sender paid for the gas, and the USDC contract recorded two transfers.",{"type":26,"tag":27,"props":742,"children":743},{},[744,746,751,753,758,760,765],{"type":31,"value":745},"Layer 3, logs plus ledger state: ",{"type":26,"tag":55,"props":747,"children":749},{"className":748},[],[750],{"type":31,"value":424},{"type":31,"value":752}," at the final block shows V's USDC fell by 5,000, D's rose and then fell, and A's rose by 5,000. The ledger corroborates the two ",{"type":26,"tag":55,"props":754,"children":756},{"className":755},[],[757],{"type":31,"value":344},{"type":31,"value":759}," logs. ",{"type":26,"tag":55,"props":761,"children":763},{"className":762},[],[764],{"type":31,"value":738},{"type":31,"value":766}," corresponds to no balance change: a fabricated reward event with no asset behind it.",{"type":26,"tag":27,"props":768,"children":769},{},[770,772,777,779,785,787,793,795,800],{"type":31,"value":771},"Layer 4, the call tree: D delegatecalled T, so template code ran in D's storage with ",{"type":26,"tag":55,"props":773,"children":775},{"className":774},[],[776],{"type":31,"value":451},{"type":31,"value":778}," still V. D then called ",{"type":26,"tag":55,"props":780,"children":782},{"className":781},[],[783],{"type":31,"value":784},"USDC.transferFrom",{"type":31,"value":786}," to pull the allowance, ",{"type":26,"tag":55,"props":788,"children":790},{"className":789},[],[791],{"type":31,"value":792},"USDC.transfer",{"type":31,"value":794}," to send on to A, and forwarded 0.02 ETH to A internally. The executing code was T's, running in D's context, and 0.02 ETH reached A inside a transaction whose ",{"type":26,"tag":55,"props":796,"children":798},{"className":797},[],[799],{"type":31,"value":93},{"type":31,"value":801}," field says zero.",{"type":26,"tag":27,"props":803,"children":804},{},[805],{"type":31,"value":806},"A careless report says \"V transferred USDC to A.\" A defensible report stacks the layers: the envelope proves V signed to D; the ledger plus logs prove the USDC flow; the trace proves which code ran and where the ETH landed.",{"type":26,"tag":43,"props":808,"children":810},{"id":809},"a-hierarchy-of-claims-an-expert-can-defend",[811],{"type":31,"value":812},"A Hierarchy of Claims an Expert Can Defend",{"type":26,"tag":27,"props":814,"children":815},{},[816],{"type":31,"value":817},"From the envelope alone: submission, sender account, recipient, payload, fee parameters, and block inclusion.",{"type":26,"tag":27,"props":819,"children":820},{},[821],{"type":31,"value":822},"From the receipt: inclusion, success or failure, execution cost, and the set of logs emitted. Nothing about assets.",{"type":26,"tag":27,"props":824,"children":825},{},[826],{"type":31,"value":827},"From logs plus ledger reads: token flows as recorded by the token contract, always subject to that contract's truthfulness about its own state.",{"type":26,"tag":27,"props":829,"children":830},{},[831],{"type":31,"value":832},"From the call tree: which code executed, in whose storage context, in what order, and where ETH flowed internally.",{"type":26,"tag":27,"props":834,"children":835},{},[836],{"type":31,"value":837},"From state at a block: balances, allowances, and storage as the network recorded them, the ground-truth layer for assets.",{"type":26,"tag":27,"props":839,"children":840},{},[841],{"type":31,"value":842},"Below the line sit claims no artifact supports: who physically held the private key, what the sender intended, and anything that happened off-chain. Label every conclusion with its source layer. A report that lets a receipt's status carry the weight of a token movement, or a log carry the weight of a balance, has overstated the evidence.",{"type":26,"tag":43,"props":844,"children":846},{"id":845},"a-practitioner-checklist-for-preserving-execution-evidence",[847],{"type":31,"value":848},"A Practitioner Checklist for Preserving Execution Evidence",{"type":26,"tag":850,"props":851,"children":852},"ol",{},[853,859,883,888,900,905,910,915],{"type":26,"tag":854,"props":855,"children":856},"li",{},[857],{"type":31,"value":858},"Confirm the transaction is on the canonical chain and check finality before treating the hash as settled.",{"type":26,"tag":854,"props":860,"children":861},{},[862,864,869,870,875,876,881],{"type":31,"value":863},"Capture raw JSON output for ",{"type":26,"tag":55,"props":865,"children":867},{"className":866},[],[868],{"type":31,"value":60},{"type":31,"value":80},{"type":26,"tag":55,"props":871,"children":873},{"className":872},[],[874],{"type":31,"value":167},{"type":31,"value":208},{"type":26,"tag":55,"props":877,"children":879},{"className":878},[],[880],{"type":31,"value":322},{"type":31,"value":882}," at query time; record the timestamp, the node or provider, the client and version, and the exact parameters.",{"type":26,"tag":854,"props":884,"children":885},{},[886],{"type":31,"value":887},"Preserve a hash of every exported file and note whether the data came from a direct node query, a provider API, or an explorer, because those sources differ in provenance.",{"type":26,"tag":854,"props":889,"children":890},{},[891,893,898],{"type":31,"value":892},"Read token balances and relevant storage at the final block with ",{"type":26,"tag":55,"props":894,"children":896},{"className":895},[],[897],{"type":31,"value":432},{"type":31,"value":899},", and check that allowances were consumed.",{"type":26,"tag":854,"props":901,"children":902},{},[903],{"type":31,"value":904},"Obtain a call-level trace with call types and depths, plus a state diff showing pre and post values for the balances at issue.",{"type":26,"tag":854,"props":906,"children":907},{},[908],{"type":31,"value":909},"If the transaction failed, preserve the revert reason from the trace alongside the receipt.",{"type":26,"tag":854,"props":911,"children":912},{},[913],{"type":31,"value":914},"For transactions older than roughly the state-retention window, confirm archive-state access or provider tracing before commissioning a trace, and record the tracer configuration.",{"type":26,"tag":854,"props":916,"children":917},{},[918],{"type":31,"value":919},"Cross-check at least one field against a second independent source. Use explorer screenshots only as supporting exhibits; the raw JSON is the primary record.",{"type":26,"tag":43,"props":921,"children":923},{"id":922},"limitations",[924],{"type":31,"value":925},"Limitations",{"type":26,"tag":27,"props":927,"children":928},{},[929],{"type":31,"value":930},"Traces and logs reconstruct execution, not people. They cannot prove who held a private key, what a party intended, or any off-chain fact. Explorer \"internal transactions\" tabs are client-generated renderings, not consensus data. Reorganizations can orphan a transaction, log queries can be range-limited, and some nodes prune old receipts. On layer-2 rollups, receipts describe sequencer-era execution and the layer-1 commitments are a separate artifact. Everything before October 2017 on Ethereum lacks a receipt status, and the absence of an event proves nothing. How a court weighs these artifacts depends on the forum's evidence rules.",{"type":26,"tag":43,"props":932,"children":934},{"id":933},"frequently-asked-questions",[935],{"type":31,"value":936},"Frequently Asked Questions",{"type":26,"tag":248,"props":938,"children":940},{"id":939},"q-the-explorer-shows-method-transfer-and-status-success-does-that-prove-the-tokens-were-sent",[941],{"type":31,"value":942},"Q: The explorer shows \"Method: transfer\" and \"Status: Success\". Does that prove the tokens were sent?",{"type":26,"tag":27,"props":944,"children":945},{},[946,951,953,958,960,965],{"type":26,"tag":657,"props":947,"children":948},{},[949],{"type":31,"value":950},"A:",{"type":31,"value":952}," No. Status proves only that the transaction did not revert. Token movement is evidenced by the token contract's ",{"type":26,"tag":55,"props":954,"children":956},{"className":955},[],[957],{"type":31,"value":344},{"type":31,"value":959}," logs and by ",{"type":26,"tag":55,"props":961,"children":963},{"className":962},[],[964],{"type":31,"value":424},{"type":31,"value":966}," at the relevant block. The explorer's \"transfer\" label is a decode of the input data and says nothing about whether tokens moved.",{"type":26,"tag":248,"props":968,"children":970},{"id":969},"q-what-is-the-difference-between-a-receipt-and-a-trace",[971],{"type":31,"value":972},"Q: What is the difference between a receipt and a trace?",{"type":26,"tag":27,"props":974,"children":975},{},[976,980],{"type":26,"tag":657,"props":977,"children":978},{},[979],{"type":31,"value":950},{"type":31,"value":981}," A receipt is consensus data: status, gas used, and logs, stored with the block. A trace is a reconstruction: a node re-executes the transaction locally. Receipts exist for every included transaction the node still holds. Traces depend on the client, the tracer, and historical state, which generally means an archive node for old transactions. There is no finalized trace-format standard.",{"type":26,"tag":248,"props":983,"children":985},{"id":984},"q-a-failed-transaction-still-costs-gas-what-can-the-fee-evidence-prove",[986],{"type":31,"value":987},"Q: A failed transaction still costs gas. What can the fee evidence prove?",{"type":26,"tag":27,"props":989,"children":990},{},[991,995,997,1002,1003,1008],{"type":26,"tag":657,"props":992,"children":993},{},[994],{"type":31,"value":950},{"type":31,"value":996}," ",{"type":26,"tag":55,"props":998,"children":1000},{"className":999},[],[1001],{"type":31,"value":192},{"type":31,"value":290},{"type":26,"tag":55,"props":1004,"children":1006},{"className":1005},[],[1007],{"type":31,"value":214},{"type":31,"value":1009}," is the fee the sender paid, which can support damages even when the transfer failed. The receipt also proves the failure: status 0, state changes rolled back, nonce consumed. That pairing can establish that the account was operated, that an attempt occurred, and what it cost.",{"type":26,"tag":248,"props":1011,"children":1013},{"id":1012},"q-how-far-back-can-execution-traces-be-recovered",[1014],{"type":31,"value":1015},"Q: How far back can execution traces be recovered?",{"type":26,"tag":27,"props":1017,"children":1018},{},[1019,1023],{"type":26,"tag":657,"props":1020,"children":1021},{},[1022],{"type":31,"value":950},{"type":31,"value":1024}," Envelope, receipt, and logs are available only if the node still holds that history; some clients prune old receipts. Traces require state as of the target block. Recent transactions can be traced on a full node; old ones generally need an archive node or a tracing provider. Pre-Byzantium transactions (before October 2017) have no receipt status and can only be reconstructed by replay.",{"type":26,"tag":27,"props":1026,"children":1027},{},[1028,1030,1036],{"type":31,"value":1029},"Every matter turns on its own facts, and the weight a court gives these artifacts depends on the jurisdiction, the claims, and how the evidence was collected and preserved. If you are litigating or investigating a matter where EVM execution details matter, ",{"type":26,"tag":34,"props":1031,"children":1033},{"href":1032},"\u002Fcontact",[1034],{"type":31,"value":1035},"contact ConsensusIntel",{"type":31,"value":1037}," to discuss what a forensic analysis can defensibly establish from your specific transactions.",{"title":8,"searchDepth":1039,"depth":1039,"links":1040},2,[1041,1042,1046,1047,1048,1049,1050,1051,1052,1053],{"id":45,"depth":1039,"text":48},{"id":153,"depth":1039,"text":156,"children":1043},[1044],{"id":250,"depth":1045,"text":253},3,{"id":308,"depth":1039,"text":311},{"id":437,"depth":1039,"text":440},{"id":573,"depth":1039,"text":576},{"id":649,"depth":1039,"text":652},{"id":809,"depth":1039,"text":812},{"id":845,"depth":1039,"text":848},{"id":922,"depth":1039,"text":925},{"id":933,"depth":1039,"text":936,"children":1054},[1055,1056,1057,1058],{"id":939,"depth":1045,"text":942},{"id":969,"depth":1045,"text":972},{"id":984,"depth":1045,"text":987},{"id":1012,"depth":1045,"text":1015},"markdown","content:articles:27-evm-receipts-logs-execution-traces.md","content","articles\u002F27-evm-receipts-logs-execution-traces.md","articles\u002F27-evm-receipts-logs-execution-traces","md",{"_path":1066,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":1067,"description":1068,"slug":1069,"date":1070,"lastUpdated":1070,"author":13,"readingTime":1071,"category":1072,"tags":1073,"ogImage":1078,"featured":7,"body":1079,"_type":1059,"_id":1373,"_source":1061,"_file":1374,"_stem":1375,"_extension":1064},"\u002Farticles\u002F17-cryptocurrency-wrong-address-irrecoverability","What happens when cryptocurrency is sent to the wrong address","Learn why a cryptocurrency transfer to the wrong address is usually irreversible, which recovery paths may remain, and how counsel can assess them.","cryptocurrency-wrong-address-irrecoverability","2026-05-16",7,"Education",[1074,1075,1076,18,1077,17],"irreversibility","blockchain-evidence","recovery","bitcoin","\u002Fog\u002Fcryptocurrency-wrong-address-irrecoverability.png",{"type":23,"children":1080,"toc":1360},[1081,1086,1092,1097,1102,1107,1113,1123,1133,1143,1153,1163,1189,1195,1200,1217,1227,1237,1243,1248,1253,1258,1263,1269,1280,1285,1296,1300,1306,1315,1321,1330,1336,1345,1351],{"type":26,"tag":27,"props":1082,"children":1083},{},[1084],{"type":31,"value":1085},"One of the most consequential properties of public blockchain systems is the near-total irreversibility of confirmed transactions. When cryptocurrency is sent to the wrong address: through a typographical error, a scam, a technical mistake, or a moment of confusion, recovery is rarely possible through the same mechanisms that allow bank wire reversals or credit card chargebacks. Understanding why, and what options actually exist, is essential for attorneys handling client matters involving this scenario.",{"type":26,"tag":43,"props":1087,"children":1089},{"id":1088},"why-transfers-cannot-be-reversed",[1090],{"type":31,"value":1091},"Why Transfers Cannot Be Reversed",{"type":26,"tag":27,"props":1093,"children":1094},{},[1095],{"type":31,"value":1096},"Blockchain transactions are irreversible by design. When a transaction is confirmed and included in a block, the record of that transfer is incorporated into an append-only ledger replicated across thousands of nodes worldwide. No single party, not an exchange, not a developer, not any government, has the technical authority to reach into the ledger and undo a confirmed transaction.",{"type":26,"tag":27,"props":1098,"children":1099},{},[1100],{"type":31,"value":1101},"This is not a policy choice that can be reversed by calling customer service. It is an architectural feature. The value of the immutability guarantee, which makes blockchain records trustworthy as evidence, is inseparable from the fact that no one can alter records after the fact, including to correct a mistake.",{"type":26,"tag":27,"props":1103,"children":1104},{},[1105],{"type":31,"value":1106},"The private key controls the funds. Whoever possesses the private key for the destination address can authorize the next transaction from that address. If the destination address is controlled by an unintended third party, recovery requires that party's cooperation. If the destination address has no known controller, a burned or unspendable address, recovery is impossible.",{"type":26,"tag":43,"props":1108,"children":1110},{"id":1109},"scenarios-and-what-each-means",[1111],{"type":31,"value":1112},"Scenarios and What Each Means",{"type":26,"tag":27,"props":1114,"children":1115},{},[1116,1121],{"type":26,"tag":657,"props":1117,"children":1118},{},[1119],{"type":31,"value":1120},"Typo resulting in a valid but unintended address",{"type":31,"value":1122},": If a sender mistypes a wallet address and the resulting address is a valid address that happens to exist on the blockchain, the funds are received by whoever controls that address, or they sit at an address with no known controller. Most addresses generated by random typos will be uncontrolled, no one has the private key, but the funds are still irretrievable because no private key exists to authorize a transaction out.",{"type":26,"tag":27,"props":1124,"children":1125},{},[1126,1131],{"type":26,"tag":657,"props":1127,"children":1128},{},[1129],{"type":31,"value":1130},"Hypothetical example:",{"type":31,"value":1132}," A sender transposes characters while entering an address and sends funds to a valid address with no known controller. Once the transfer is confirmed, the sender cannot authorize a new transaction from that destination without its private key.",{"type":26,"tag":27,"props":1134,"children":1135},{},[1136,1141],{"type":26,"tag":657,"props":1137,"children":1138},{},[1139],{"type":31,"value":1140},"Funds sent to a known exchange address",{"type":31,"value":1142},": If the destination address belongs to a centralized exchange (Coinbase, Kraken, Binance, etc.), the exchange controls the private key. Exchanges generally have processes for recovering mistakenly sent funds into their hot wallet infrastructure, but these processes are discretionary, may require extensive documentation, and often involve fees. Some exchanges refuse to assist at all. There is no legal obligation in most jurisdictions requiring an exchange to return mistakenly sent funds, though restitution and unjust enrichment theories may provide an equitable basis for a claim.",{"type":26,"tag":27,"props":1144,"children":1145},{},[1146,1151],{"type":26,"tag":657,"props":1147,"children":1148},{},[1149],{"type":31,"value":1150},"Funds sent to a smart contract address",{"type":31,"value":1152},": Many cryptocurrency tokens sent to a smart contract that has no function to return or handle them are permanently locked. The classic example is ERC-20 tokens sent to the ERC-20 token contract itself: a common mistake. The contract typically has no function to recover such tokens, and because the contract is code (not a human-controlled wallet), no one can override it. Hundreds of millions of dollars in ERC-20 tokens have been permanently locked this way.",{"type":26,"tag":27,"props":1154,"children":1155},{},[1156,1161],{"type":26,"tag":657,"props":1157,"children":1158},{},[1159],{"type":31,"value":1160},"Funds sent through a scam",{"type":31,"value":1162},": When a victim sends cryptocurrency in response to a phishing email, impersonation scam, or other fraud, the destination address was provided by the scammer, who controls the private key and will immediately move the funds. This is a theft scenario, not a transaction error, and is analyzed differently forensically.",{"type":26,"tag":27,"props":1164,"children":1165},{},[1166,1171,1173,1179,1181,1187],{"type":26,"tag":657,"props":1167,"children":1168},{},[1169],{"type":31,"value":1170},"The \"burned\" address scenario",{"type":31,"value":1172},": Some addresses are known to be unspendable by design. The most common is address ",{"type":26,"tag":55,"props":1174,"children":1176},{"className":1175},[],[1177],{"type":31,"value":1178},"0x000...0000",{"type":31,"value":1180}," (the zero address on Ethereum) or ",{"type":26,"tag":55,"props":1182,"children":1184},{"className":1183},[],[1185],{"type":31,"value":1186},"1BitcoinEaterAddressDoNotSend...",{"type":31,"value":1188}," on Bitcoin. Sending to these addresses permanently destroys the asset: the transaction is confirmed, the funds are received at the address, and no private key exists to move them.",{"type":26,"tag":43,"props":1190,"children":1192},{"id":1191},"legal-options-for-recovery",[1193],{"type":31,"value":1194},"Legal Options for Recovery",{"type":26,"tag":27,"props":1196,"children":1197},{},[1198],{"type":31,"value":1199},"Because blockchain transactions cannot be reversed by the sender, legal recovery requires either cooperation from the recipient or legal process compelling that cooperation.",{"type":26,"tag":27,"props":1201,"children":1202},{},[1203,1208,1210,1216],{"type":26,"tag":657,"props":1204,"children":1205},{},[1206],{"type":31,"value":1207},"Against a known exchange",{"type":31,"value":1209},": If forensic tracing establishes that the funds reached a centralized exchange wallet, and the exchange maintains customer records for that wallet, a legal demand or civil action may compel the exchange to hold and return the funds. The legal theory typically involves unjust enrichment, constructive trust, or restitution. The success of this approach depends on whether the exchange has a segregated customer account for the receiving address or pooled funds in an omnibus wallet. Counsel considering that path may also need to evaluate ",{"type":26,"tag":34,"props":1211,"children":1213},{"href":1212},"\u002Fresources\u002Fsubpoenaing-cryptocurrency-exchange-records",[1214],{"type":31,"value":1215},"subpoenaing cryptocurrency exchange records",{"type":31,"value":41},{"type":26,"tag":27,"props":1218,"children":1219},{},[1220,1225],{"type":26,"tag":657,"props":1221,"children":1222},{},[1223],{"type":31,"value":1224},"Against an identified scammer",{"type":31,"value":1226},": If the recipient is identified through exchange KYC records or other evidence, conventional fraud and theft remedies apply. The blockchain evidence establishing the fund flow is an essential component of the claim.",{"type":26,"tag":27,"props":1228,"children":1229},{},[1230,1235],{"type":26,"tag":657,"props":1231,"children":1232},{},[1233],{"type":31,"value":1234},"Against a party who made the error",{"type":31,"value":1236},": In some disputes, the wrongly addressed transaction was a mistake by a third party, a business partner, an employee, a financial professional, who sent funds to the wrong address. Negligence or breach of fiduciary duty claims against that party may be available regardless of whether the funds themselves are recoverable.",{"type":26,"tag":43,"props":1238,"children":1240},{"id":1239},"what-cannot-be-done",[1241],{"type":31,"value":1242},"What Cannot Be Done",{"type":26,"tag":27,"props":1244,"children":1245},{},[1246],{"type":31,"value":1247},"It is important to be clear with clients about what is not possible:",{"type":26,"tag":27,"props":1249,"children":1250},{},[1251],{"type":31,"value":1252},"No authority can reverse a confirmed blockchain transaction. The FBI, the SEC, and federal courts do not have the technical ability to reverse blockchain transfers. Courts can compel parties to transfer assets from their controlled addresses. They cannot reach into the blockchain and rearrange already-confirmed records.",{"type":26,"tag":27,"props":1254,"children":1255},{},[1256],{"type":31,"value":1257},"Blockchain analytics firms cannot recover funds. They can trace where funds went, identify the controlling party, and assist in locating the funds within the system, but that is investigation, not recovery.",{"type":26,"tag":27,"props":1259,"children":1260},{},[1261],{"type":31,"value":1262},"Exchange customer support cannot typically assist when the receiving address is not an exchange address. If the funds went to a private wallet that neither the sender nor the exchange controls, the exchange has no access to those funds.",{"type":26,"tag":43,"props":1264,"children":1266},{"id":1265},"the-forensic-role",[1267],{"type":31,"value":1268},"The Forensic Role",{"type":26,"tag":27,"props":1270,"children":1271},{},[1272,1274,1278],{"type":31,"value":1273},"A blockchain forensic expert can establish: the exact transaction details (hash, timestamp, amount, source, destination), confirmation that the transaction was final and included in the blockchain, the current state of the destination address (whether funds remain there or were subsequently moved), and, if funds were moved, where they went and whether they can be attributed to an identified party. This type of ",{"type":26,"tag":34,"props":1275,"children":1276},{"href":634},[1277],{"type":31,"value":637},{"type":31,"value":1279}," helps determine whether recovery efforts can focus on an identifiable recipient or institution.",{"type":26,"tag":27,"props":1281,"children":1282},{},[1283],{"type":31,"value":1284},"This establishes the evidentiary record for any legal proceeding. The tracing analysis also determines whether legal process against an exchange or other institution is viable. If the funds reached an exchange wallet and remain there, the case for legal intervention is much stronger than if they moved through multiple wallets to a private address that cannot be attributed to anyone.",{"type":26,"tag":27,"props":1286,"children":1287},{},[1288,1290,1294],{"type":31,"value":1289},"The irreversibility of blockchain transactions is one of the most important practical realities attorneys must communicate to clients early in a matter. Setting accurate expectations while pursuing available legal remedies requires understanding both what the technology makes impossible and what the law may still provide. The ",{"type":26,"tag":34,"props":1291,"children":1292},{"href":626},[1293],{"type":31,"value":629},{"type":31,"value":1295}," for documenting transaction evidence can help counsel assess the available next steps.",{"type":26,"tag":43,"props":1297,"children":1298},{"id":933},[1299],{"type":31,"value":936},{"type":26,"tag":248,"props":1301,"children":1303},{"id":1302},"q-what-information-should-counsel-preserve-before-deciding-whether-recovery-is-realistic",[1304],{"type":31,"value":1305},"Q: What information should counsel preserve before deciding whether recovery is realistic?",{"type":26,"tag":27,"props":1307,"children":1308},{},[1309,1313],{"type":26,"tag":657,"props":1310,"children":1311},{},[1312],{"type":31,"value":950},{"type":31,"value":1314}," Preserve the transaction hash, timestamp, amount, source address, destination address, and records showing how the address was obtained or used. A forensic expert can verify the confirmed transfer, determine whether the funds remain at the destination, and trace later movements. Those facts help show whether an identifiable recipient, exchange, or other institution is a viable target for legal process.",{"type":26,"tag":248,"props":1316,"children":1318},{"id":1317},"q-can-a-court-order-a-confirmed-cryptocurrency-transfer-to-be-reversed",[1319],{"type":31,"value":1320},"Q: Can a court order a confirmed cryptocurrency transfer to be reversed?",{"type":26,"tag":27,"props":1322,"children":1323},{},[1324,1328],{"type":26,"tag":657,"props":1325,"children":1326},{},[1327],{"type":31,"value":950},{"type":31,"value":1329}," No. A court cannot alter an already confirmed blockchain record. It can order a person or entity that controls the destination address to transfer assets, so the available remedy depends on identifying a party with control of the funds.",{"type":26,"tag":248,"props":1331,"children":1333},{"id":1332},"q-when-is-it-worth-seeking-records-or-relief-from-an-exchange",[1334],{"type":31,"value":1335},"Q: When is it worth seeking records or relief from an exchange?",{"type":26,"tag":27,"props":1337,"children":1338},{},[1339,1343],{"type":26,"tag":657,"props":1340,"children":1341},{},[1342],{"type":31,"value":950},{"type":31,"value":1344}," It is worth evaluating when tracing shows that the funds reached an exchange wallet. Exchange records may identify the customer associated with the wallet, but the result can depend on whether the exchange used a segregated customer account or pooled funds in an omnibus wallet. Documentation, fees, and the exchange's willingness to assist may also affect a practical recovery effort.",{"type":26,"tag":248,"props":1346,"children":1348},{"id":1347},"q-how-should-counsel-distinguish-a-wrong-address-error-from-a-cryptocurrency-scam",[1349],{"type":31,"value":1350},"Q: How should counsel distinguish a wrong-address error from a cryptocurrency scam?",{"type":26,"tag":27,"props":1352,"children":1353},{},[1354,1358],{"type":26,"tag":657,"props":1355,"children":1356},{},[1357],{"type":31,"value":950},{"type":31,"value":1359}," A mistaken transfer can place funds at a valid address with no known controller, while a scam transfer is made to an address supplied by a fraudster who controls the private key. The distinction depends on the surrounding evidence, such as phishing or impersonation communications, not on the transaction record alone. If the recipient can be identified through exchange KYC records or other evidence, fraud and theft remedies may be available.",{"title":8,"searchDepth":1039,"depth":1039,"links":1361},[1362,1363,1364,1365,1366,1367],{"id":1088,"depth":1039,"text":1091},{"id":1109,"depth":1039,"text":1112},{"id":1191,"depth":1039,"text":1194},{"id":1239,"depth":1039,"text":1242},{"id":1265,"depth":1039,"text":1268},{"id":933,"depth":1039,"text":936,"children":1368},[1369,1370,1371,1372],{"id":1302,"depth":1045,"text":1305},{"id":1317,"depth":1045,"text":1320},{"id":1332,"depth":1045,"text":1335},{"id":1347,"depth":1045,"text":1350},"content:articles:17-cryptocurrency-wrong-address-irrecoverability.md","articles\u002F17-cryptocurrency-wrong-address-irrecoverability.md","articles\u002F17-cryptocurrency-wrong-address-irrecoverability",{"_path":1377,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":1378,"description":1379,"slug":1380,"date":1070,"lastUpdated":1070,"author":13,"readingTime":1071,"category":1072,"tags":1381,"ogImage":1387,"featured":7,"body":1388,"_type":1059,"_id":1766,"_source":1061,"_file":1767,"_stem":1768,"_extension":1064},"\u002Farticles\u002F13-cross-chain-bridges-asset-tracing","Cross-chain bridges and why they complicate asset tracing","An explanation of how cross-chain bridges interrupt blockchain transaction trails and the forensic methods used to reconnect funds across networks.","cross-chain-bridges-asset-tracing",[1382,1383,1384,1385,17,1386],"cross-chain","bridges","asset-tracing","blockchain-forensics","solana","\u002Fog\u002Fcross-chain-bridges-asset-tracing.png",{"type":23,"children":1389,"toc":1752},[1390,1395,1401,1406,1411,1416,1422,1427,1448,1459,1465,1470,1480,1498,1508,1518,1524,1529,1539,1549,1559,1569,1579,1589,1595,1600,1610,1615,1625,1635,1645,1651,1656,1667,1678,1683,1688,1692,1698,1707,1713,1722,1728,1737,1743],{"type":26,"tag":27,"props":1391,"children":1392},{},[1393],{"type":31,"value":1394},"A decade ago, digital asset tracing meant following a single chain of transactions on a single blockchain. Today, an investigator tracing misappropriated cryptocurrency may find that the funds passed through two or three different blockchain networks before reaching a final destination. Cross-chain bridges are the mechanism that makes this possible, and they are one of the most significant complications in modern blockchain forensic analysis.",{"type":26,"tag":43,"props":1396,"children":1398},{"id":1397},"what-a-bridge-is",[1399],{"type":31,"value":1400},"What a Bridge Is",{"type":26,"tag":27,"props":1402,"children":1403},{},[1404],{"type":31,"value":1405},"A cross-chain bridge is a protocol that allows digital assets to move between two different blockchains. Because blockchains are independent systems with no native awareness of each other, direct transfer between chains is not possible. Bridges solve this by using a lock-and-mint or burn-and-release mechanism.",{"type":26,"tag":27,"props":1407,"children":1408},{},[1409],{"type":31,"value":1410},"In a lock-and-mint bridge: a user deposits assets on Chain A into the bridge's smart contract (locking them), and the bridge mints an equivalent \"wrapped\" token on Chain B representing the locked asset. In a burn-and-release bridge: the user burns or destroys the wrapped token on Chain B, and the bridge releases the original asset on Chain A.",{"type":26,"tag":27,"props":1412,"children":1413},{},[1414],{"type":31,"value":1415},"From a user's perspective, the experience is simple: send ETH on Ethereum, receive the equivalent value on Arbitrum (or Polygon, or Solana, or BNB Chain). From a forensic perspective, the transaction trail fragments at the bridge.",{"type":26,"tag":43,"props":1417,"children":1419},{"id":1418},"why-bridges-break-the-trace",[1420],{"type":31,"value":1421},"Why Bridges Break the Trace",{"type":26,"tag":27,"props":1423,"children":1424},{},[1425],{"type":31,"value":1426},"When funds move through a bridge, the address on the source chain and the address on the destination chain are generally different, not just different in value but completely independent identifiers with no cryptographic relationship to each other.",{"type":26,"tag":27,"props":1428,"children":1429},{},[1430,1432,1438,1440,1446],{"type":31,"value":1431},"On Ethereum, an address looks like ",{"type":26,"tag":55,"props":1433,"children":1435},{"className":1434},[],[1436],{"type":31,"value":1437},"0x4a...e31",{"type":31,"value":1439},". On Solana, addresses look like ",{"type":26,"tag":55,"props":1441,"children":1443},{"className":1442},[],[1444],{"type":31,"value":1445},"BhwN...mR4X",{"type":31,"value":1447},". These are not the same format, the same cryptographic scheme, or the same namespace. A user who sends ETH from their Ethereum address to a Solana bridge to receive SOL on the other side has effectively created two endpoints on two completely different ledger systems.",{"type":26,"tag":27,"props":1449,"children":1450},{},[1451,1453,1458],{"type":31,"value":1452},"Without bridge-specific tooling and knowledge of how the specific bridge protocol records its transactions, the trace appears to terminate at the bridge contract on the source chain. The investigator sees funds enter the bridge and disappear from the source blockchain. Finding where they emerged on the destination chain requires a separate analysis of ",{"type":26,"tag":34,"props":1454,"children":1455},{"href":36},[1456],{"type":31,"value":1457},"how to read a blockchain transaction",{"type":31,"value":41},{"type":26,"tag":43,"props":1460,"children":1462},{"id":1461},"how-forensic-analysts-trace-across-bridges",[1463],{"type":31,"value":1464},"How Forensic Analysts Trace Across Bridges",{"type":26,"tag":27,"props":1466,"children":1467},{},[1468],{"type":31,"value":1469},"Each major bridge has identifiable transaction patterns that allow forensic reconstruction:",{"type":26,"tag":27,"props":1471,"children":1472},{},[1473,1478],{"type":26,"tag":657,"props":1474,"children":1475},{},[1476],{"type":31,"value":1477},"Matching amounts and timing",{"type":31,"value":1479},": For many bridges, the amount deposited on Chain A and the amount received on Chain B will match (minus fees), and the timing is close. If an analyst sees a bridge deposit of exactly 12.4 ETH at 14:23:07 UTC, and finds a 12.4 ETH equivalent receipt on the destination chain at 14:24:52 UTC, the match is highly probable.",{"type":26,"tag":27,"props":1481,"children":1482},{},[1483,1488,1490,1496],{"type":26,"tag":657,"props":1484,"children":1485},{},[1486],{"type":31,"value":1487},"Bridge protocol event logs",{"type":31,"value":1489},": Most bridges emit events (log entries in the smart contract) that record the destination address the user specified. For example, Stargate Finance logs the destination address as part of its ",{"type":26,"tag":55,"props":1491,"children":1493},{"className":1492},[],[1494],{"type":31,"value":1495},"SendMsg",{"type":31,"value":1497}," event. An analyst can query these events to determine where on the destination chain the funds were directed.",{"type":26,"tag":27,"props":1499,"children":1500},{},[1501,1506],{"type":26,"tag":657,"props":1502,"children":1503},{},[1504],{"type":31,"value":1505},"Relayer and validator records",{"type":31,"value":1507},": Some bridges use third-party relayers or validators that maintain their own records of bridge transactions. These may be queryable.",{"type":26,"tag":27,"props":1509,"children":1510},{},[1511,1516],{"type":26,"tag":657,"props":1512,"children":1513},{},[1514],{"type":31,"value":1515},"Wrapped token issuance",{"type":31,"value":1517},": When a bridge mints a wrapped token on the destination chain, the mint transaction is recorded on that chain and includes the receiving address. Tracing the minted tokens' receiving address can pick up the trace on the destination chain.",{"type":26,"tag":43,"props":1519,"children":1521},{"id":1520},"the-major-bridges-in-current-litigation",[1522],{"type":31,"value":1523},"The Major Bridges in Current Litigation",{"type":26,"tag":27,"props":1525,"children":1526},{},[1527],{"type":31,"value":1528},"Several bridges appear frequently in litigation-relevant fund flows:",{"type":26,"tag":27,"props":1530,"children":1531},{},[1532,1537],{"type":26,"tag":657,"props":1533,"children":1534},{},[1535],{"type":31,"value":1536},"Stargate Finance",{"type":31,"value":1538},": One of the highest-volume EVM cross-chain bridges; connects Ethereum, Arbitrum, Optimism, Base, Avalanche, BNB Chain, and others. Transaction events contain destination address data.",{"type":26,"tag":27,"props":1540,"children":1541},{},[1542,1547],{"type":26,"tag":657,"props":1543,"children":1544},{},[1545],{"type":31,"value":1546},"Hop Protocol",{"type":31,"value":1548},": EVM-to-EVM bridge with human-readable event structures.",{"type":26,"tag":27,"props":1550,"children":1551},{},[1552,1557],{"type":26,"tag":657,"props":1553,"children":1554},{},[1555],{"type":31,"value":1556},"Synapse Protocol",{"type":31,"value":1558},": Cross-chain bridge supporting Ethereum, Arbitrum, Optimism, BSC, Avalanche, and others. Known for relatively clean forensic tracing.",{"type":26,"tag":27,"props":1560,"children":1561},{},[1562,1567],{"type":26,"tag":657,"props":1563,"children":1564},{},[1565],{"type":31,"value":1566},"Wormhole",{"type":31,"value":1568},": Cross-chain protocol supporting Ethereum-to-Solana and other heterogeneous bridge pairs. The Solana-Ethereum connection is particularly significant as funds laundered through Solana often use Wormhole.",{"type":26,"tag":27,"props":1570,"children":1571},{},[1572,1577],{"type":26,"tag":657,"props":1573,"children":1574},{},[1575],{"type":31,"value":1576},"Native L2 bridges",{"type":31,"value":1578},": Every major Ethereum Layer 2 (Arbitrum, Optimism, Base, Polygon) has a canonical bridge operated by the network itself. These generally have more structured transaction records and are often easier to trace.",{"type":26,"tag":27,"props":1580,"children":1581},{},[1582,1587],{"type":26,"tag":657,"props":1583,"children":1584},{},[1585],{"type":31,"value":1586},"LayerZero",{"type":31,"value":1588},": A cross-chain messaging protocol rather than a bridge per se, but used by many bridging protocols. Understanding LayerZero's transaction structure is important for tracing funds that use protocols built on it.",{"type":26,"tag":43,"props":1590,"children":1592},{"id":1591},"limitations-introduced-by-bridges",[1593],{"type":31,"value":1594},"Limitations Introduced by Bridges",{"type":26,"tag":27,"props":1596,"children":1597},{},[1598],{"type":31,"value":1599},"Bridge tracing introduces genuine analytical uncertainty that must be disclosed. The specific uncertainty depends on the bridge:",{"type":26,"tag":27,"props":1601,"children":1602},{},[1603,1608],{"type":26,"tag":657,"props":1604,"children":1605},{},[1606],{"type":31,"value":1607},"Timing windows",{"type":31,"value":1609},": Some bridges batch transactions, meaning multiple deposits may be aggregated and delivered to the destination chain in a combined transaction. When batching occurs, precisely matching a specific deposit to a specific receipt requires additional analysis.",{"type":26,"tag":27,"props":1611,"children":1612},{},[1613],{"type":31,"value":1614},"Hypothetical example: A user deposits 12.4 ETH into a bridge, then several unrelated users make deposits of the same amount before a batch reaches the destination chain. Matching the amount and timing alone may not distinguish the user's receipt from the others.",{"type":26,"tag":27,"props":1616,"children":1617},{},[1618,1623],{"type":26,"tag":657,"props":1619,"children":1620},{},[1621],{"type":31,"value":1622},"Privacy bridges",{"type":31,"value":1624},": A small number of bridge protocols include privacy features that intentionally obscure the relationship between source and destination deposits. These function similarly to mixing services and reduce attribution confidence proportionally.",{"type":26,"tag":27,"props":1626,"children":1627},{},[1628,1633],{"type":26,"tag":657,"props":1629,"children":1630},{},[1631],{"type":31,"value":1632},"Protocol changes and chain reorganizations",{"type":31,"value":1634},": Bridges are software that can be upgraded. A bridge that operated differently at a prior point in time may require historical analysis of contract versions.",{"type":26,"tag":27,"props":1636,"children":1637},{},[1638,1643],{"type":26,"tag":657,"props":1639,"children":1640},{},[1641],{"type":31,"value":1642},"Destination chain expertise",{"type":31,"value":1644},": Tracing funds from Ethereum to Solana means the investigator must be competent on both chains. The Solana data model is structurally different from EVM chains. An analyst who handles EVM chains comfortably may not have the tooling or knowledge to continue a trace on Solana.",{"type":26,"tag":43,"props":1646,"children":1648},{"id":1647},"what-this-means-for-your-matter",[1649],{"type":31,"value":1650},"What This Means for Your Matter",{"type":26,"tag":27,"props":1652,"children":1653},{},[1654],{"type":31,"value":1655},"If your client's case involves a party who moved funds across chains, several practical points apply:",{"type":26,"tag":27,"props":1657,"children":1658},{},[1659,1661,1665],{"type":31,"value":1660},"First, the trace is not necessarily lost at the bridge. It is broken and must be reconnected. That reconnection is possible in most cases involving major, well-documented bridges. It requires ",{"type":26,"tag":34,"props":1662,"children":1663},{"href":634},[1664],{"type":31,"value":637},{"type":31,"value":1666}," by a forensic analyst who works across multiple blockchain ecosystems and knows the specific bridge's transaction structure.",{"type":26,"tag":27,"props":1668,"children":1669},{},[1670,1672,1676],{"type":31,"value":1671},"Second, each bridge crossing introduces a documentation requirement in the expert analysis. The chain of custody for the trace must explicitly address what was done on each chain and how the cross-chain connection was established. A report that simply says \"funds moved across a bridge\" without documenting the specific bridge, the matching methodology, and the confidence level for the connection is inadequate. The ",{"type":26,"tag":34,"props":1673,"children":1674},{"href":626},[1675],{"type":31,"value":629},{"type":31,"value":1677}," should make that cross-chain connection reviewable.",{"type":26,"tag":27,"props":1679,"children":1680},{},[1681],{"type":31,"value":1682},"Third, bridge transactions are sometimes used deliberately to complicate tracing. An adversary who moves funds across three bridges through three blockchains before depositing at an exchange is attempting to impose analytical friction. That friction is real but not necessarily decisive. Experienced forensic analysts have established methodologies for tracing across the most common bridge protocols.",{"type":26,"tag":27,"props":1684,"children":1685},{},[1686],{"type":31,"value":1687},"The first question to ask when a trace appears to terminate at a bridge contract is not \"can we follow this?\" but \"which bridge is this, and what does its transaction record show about where the funds went?\"",{"type":26,"tag":43,"props":1689,"children":1690},{"id":933},[1691],{"type":31,"value":936},{"type":26,"tag":248,"props":1693,"children":1695},{"id":1694},"q-what-should-i-ask-the-expert-to-show-before-relying-on-a-bridge-crossing-in-the-case",[1696],{"type":31,"value":1697},"Q: What should I ask the expert to show before relying on a bridge crossing in the case?",{"type":26,"tag":27,"props":1699,"children":1700},{},[1701,1705],{"type":26,"tag":657,"props":1702,"children":1703},{},[1704],{"type":31,"value":950},{"type":31,"value":1706}," Ask the expert to identify the bridge protocol, the transactions on both chains, the method used to connect them, and the confidence level for that connection. The report should also explain what the bridge record shows about the destination address. A statement that funds crossed a bridge, without that supporting analysis, does not show how the conclusion was reached.",{"type":26,"tag":248,"props":1708,"children":1710},{"id":1709},"q-is-a-matching-amount-and-a-close-timestamp-enough-to-prove-where-the-funds-emerged",[1711],{"type":31,"value":1712},"Q: Is a matching amount and a close timestamp enough to prove where the funds emerged?",{"type":26,"tag":27,"props":1714,"children":1715},{},[1716,1720],{"type":26,"tag":657,"props":1717,"children":1718},{},[1719],{"type":31,"value":950},{"type":31,"value":1721}," Matching amounts and timing can make a cross-chain match highly probable, particularly when fees account for a small difference. They are not always conclusive because a bridge may batch multiple deposits into one destination transaction. The analysis should address the bridge's transaction pattern and any additional evidence that links the source deposit to the receipt.",{"type":26,"tag":248,"props":1723,"children":1725},{"id":1724},"q-what-are-the-main-grounds-to-question-a-bridge-tracing-opinion",[1726],{"type":31,"value":1727},"Q: What are the main grounds to question a bridge-tracing opinion?",{"type":26,"tag":27,"props":1729,"children":1730},{},[1731,1735],{"type":26,"tag":657,"props":1732,"children":1733},{},[1734],{"type":31,"value":950},{"type":31,"value":1736}," Counsel can examine whether the opinion accounts for batching, privacy features, and the version of the bridge protocol operating at the relevant time. A chain reorganization or a prior contract version can require historical analysis rather than reliance on current behavior. Counsel can also examine whether the analyst has the tools and expertise to trace the destination chain, especially where the trace moves between an EVM chain and Solana.",{"type":26,"tag":248,"props":1738,"children":1740},{"id":1739},"q-what-should-counsel-do-first-when-the-transaction-trail-appears-to-end-at-a-bridge-contract",[1741],{"type":31,"value":1742},"Q: What should counsel do first when the transaction trail appears to end at a bridge contract?",{"type":26,"tag":27,"props":1744,"children":1745},{},[1746,1750],{"type":26,"tag":657,"props":1747,"children":1748},{},[1749],{"type":31,"value":950},{"type":31,"value":1751}," Identify the bridge and obtain the transaction records and event logs associated with the source-chain deposit. Those records may identify the destination address, and the destination chain can then be analyzed for the related receipt or wrapped-token issuance. The apparent endpoint may therefore be a point for reconnecting the trace, rather than evidence that the assets cannot be followed.",{"title":8,"searchDepth":1039,"depth":1039,"links":1753},[1754,1755,1756,1757,1758,1759,1760],{"id":1397,"depth":1039,"text":1400},{"id":1418,"depth":1039,"text":1421},{"id":1461,"depth":1039,"text":1464},{"id":1520,"depth":1039,"text":1523},{"id":1591,"depth":1039,"text":1594},{"id":1647,"depth":1039,"text":1650},{"id":933,"depth":1039,"text":936,"children":1761},[1762,1763,1764,1765],{"id":1694,"depth":1045,"text":1697},{"id":1709,"depth":1045,"text":1712},{"id":1724,"depth":1045,"text":1727},{"id":1739,"depth":1045,"text":1742},"content:articles:13-cross-chain-bridges-asset-tracing.md","articles\u002F13-cross-chain-bridges-asset-tracing.md","articles\u002F13-cross-chain-bridges-asset-tracing",1790145013677]