On-Chain Analytics and Transaction Tracing
This domain tests method: building a defensible transaction graph, applying heuristics transparently, and separating observation from inference.
Tracing workflow
- Freeze the scope: victim address, asset, time window, and the question you are answering.
- Capture every hop with txid, block height, UTC timestamp, asset, amount, fee, and input/output addresses.
- Classify each hop: payment, change, consolidation, exchange deposit, bridge, mixer, or contract interaction.
- Apply taint or allocation rules (proportional, FIFO) explicitly; taint is an analyst construct, not an on-chain fact.
- Corroborate service identifications with labels, KYC records, or deposit-address patterns.
Reading Ethereum data
Native transfers change the value field; ERC-20 transfers appear as Transfer event logs and may be executed by a third-party contract. Internal transactions are traces, not top-level transactions. Failing to capture these misses most token flows.
Worked example
10 BTC leaves a victim address to wallet A. A sends 5 BTC to a labelled exchange deposit and 4.9 BTC to wallet B; the 0.1 BTC difference is the fee. B later sends 2 BTC to a DEX contract. Reasoning: the 4.9 BTC output is likely change because it is a new address of the same script type and the 5 BTC is a round payment; but B could be a recipient, so check whether B's later inputs co-spend with A. If B pays a DEX, the swap output is the next traceable asset.
Traps
- Ignoring fees when reconciling totals.
- Assuming change without checking script type or later spending.
- Missing internal transactions and token logs.
- Failing to record block height, which makes reorg analysis impossible.