CAPABILITY LEDGER / LIVE BOUNDARIES
Coverage is part of the evidence.
A serious investigation distinguishes a searchable chain from a private system, a complete index from a bounded source, and an analytical lead from proof. This page makes those distinctions visible before a conclusion is written.
OPERATIONAL TODAY
Real-chain collection, without demo records
EVM account model
7 PUBLIC NETWORKS
Ethereum, Base, Arbitrum, Optimism, Polygon, BNB Smart Chain, and Avalanche through a reviewed keyed provider per network, with keyless public endpoints used only when that provider refuses or rate-limits.
- Addresses, contracts, and transactions
- Newest indexed inbound and outbound transfers plus the earliest inbound native transfer
- Native, transfer, authorization, and administrative event activity
- Receipts, bytecode, proxy slots, and verified-source evidence
Declared boundaryA bounded transfer index is not a full historical indexer: the newest pages and the first funding transfer are retrieved, not a lifetime history. Where a provider caps event-log queries the window is clamped and the reduced span is stated. Causation, ownership, intent and criminality are not inferred.
UTXO flow model
BITCOIN MAINNET
Keyless Mempool/Esplora-compatible evidence collection, configurable for an investigator-controlled indexer.
- Address state and current UTXOs
- Transaction inputs, outputs, fees, and confirmation
- Spent-output links and downstream transaction traversal
- Whirlpool and Wasabi structural rules, and a bounded peel chain
Declared boundaryThe live address view is deliberately paginated. Naming a CoinJoin implementation describes the transaction structure only, never the participants; shared control is not legal identity.
ATTRIBUTION SOURCES
Where a label comes from, and what it is worth
Exact matches for the searched identifier and its counterparties, with the list's publish date and a link to OFAC Sanctions List Search.
Refreshed twice daily; nothing is shown when the local snapshot is older than 36 hours, because a stale list can report a delisted address as sanctioned. Absence from the list is not a clearance, and a counterparty's listing is never transferred to the subject.
Exact matches reported by ScamSniffer, with the snapshot date.
A third-party security project's report, not a finding of this tool or a legal determination. The public list carries a seven-day delay, and disputes belong with ScamSniffer.
Bridges, privacy pools, DEX routers and major tokens, each labelled with the protocol documentation the address came from.
Chain-scoped: the same address on another network is a different deployment. The registry records what a contract is, never who uses it or why, and an unlabelled counterparty is simply absent from the registry.
Nothing. No exchange attribution, cluster label, risk score or identity claim is produced.
Address clustering and wallet fingerprinting are published research, but they make claims about people and stay unbuilt pending a data-protection assessment and human review.
PRIVACY-SYSTEM MATRIX
What survives on the public record
Inputs, outputs, scripts, values, timing, fees, and later spends.
Detect transaction structure, preserve the full candidate set, and compare pre/post-mix behavior with versioned heuristics.
Never map one input to one equal output without independent evidence.
Pool deposits, withdrawals, denominations, relayers, fees, timestamps, and downstream transparent activity.
Build an anonymity set and show how each explicit timing, value, or behavior filter changes it.
An anonymity-set reduction is not a deposit-to-withdrawal proof.
For current ring-era transactions: block structure, transaction structure, ring members, key images, fees, and cryptographic validity.
Public analysis can document explicitly height-gated ring composition. FCMP++ is a full-chain membership replacement under active development and must become a separate protocol-era model if activated. A voluntarily provided view-only wallet may disclose incoming activity locally; key images are needed for reliable spent state.
Public data does not reveal the actual signer, recipient address, or RingCT amount. There is no public-address wallet lookup equivalent, and ring heuristics must not be applied to a future FCMP++ era.
Transparent addresses, values, UTXOs, and shielding or deshielding boundaries.
Analyze the transparent subgraph and preserve where value crosses a shielded-pool boundary.
Do not draw a confirmed edge through a shielded pool.
Transaction presence, proof-valid state changes, commitments, nullifiers, fees, and limited public metadata.
A voluntarily shared Unified Full Viewing Key can reveal account-authorized detail when processed in an isolated local workflow.
Addresses, amounts, and the internal graph are not publicly visible. Timing alone cannot resolve a shielded transfer.
WHEN PUBLIC DATA ENDS
Lawful next-step protocol
Move collection closer to the source
Use an investigator-controlled full node or indexer when completeness, query privacy, or reproducibility matters. Record software version, chain tip, and collection time.
Request records through proper authority
Exchange records, preservation requests, victim records, and service logs remain separate evidence domains. Store their authority, provenance, and limitations alongside—not inside—on-chain facts.
Process consented viewing material locally
Viewing keys or watch-wallet exports should be voluntarily supplied or obtained under applicable authority, processed on an isolated investigator device, and never submitted to the hosted application.
Preserve the unresolved result
If the public evidence cannot distinguish candidates, publish the candidate set and contradiction register. “Unresolved within public evidence” is a defensible conclusion.
A future view-key module must run locally, keep secrets off application servers and telemetry, expose exactly what authority the key grants, and produce a redacted evidence manifest—not the key itself.
PRIMARY REFERENCES
Claims should remain inspectable
Operational use depends on jurisdiction, authority, source terms, minimization duties, and publication risk. This product documents technical boundaries; it is not legal advice and does not authorize access, surveillance, attribution, or disclosure.