FORENSIAWeb3 forensicsOpen workspace

CAPABILITY LEDGER / LIVE BOUNDARIES

Coverage is part of the evidence.

A serious investigation distinguishes a searchable chain from a private system, a complete index from a bounded source, and an analytical lead from proof. This page makes those distinctions visible before a conclusion is written.

Live nowResearch workflowEvidence gap
01

OPERATIONAL TODAY

Real-chain collection, without demo records

EVM account model

7 PUBLIC NETWORKS

Live now

Ethereum, Base, Arbitrum, Optimism, Polygon, BNB Smart Chain, and Avalanche through a reviewed keyed provider per network, with keyless public endpoints used only when that provider refuses or rate-limits.

  • Addresses, contracts, and transactions
  • Newest indexed inbound and outbound transfers plus the earliest inbound native transfer
  • Native, transfer, authorization, and administrative event activity
  • Receipts, bytecode, proxy slots, and verified-source evidence

Declared boundaryA bounded transfer index is not a full historical indexer: the newest pages and the first funding transfer are retrieved, not a lifetime history. Where a provider caps event-log queries the window is clamped and the reduced span is stated. Causation, ownership, intent and criminality are not inferred.

UTXO flow model

BITCOIN MAINNET

Live now

Keyless Mempool/Esplora-compatible evidence collection, configurable for an investigator-controlled indexer.

  • Address state and current UTXOs
  • Transaction inputs, outputs, fees, and confirmation
  • Spent-output links and downstream transaction traversal
  • Whirlpool and Wasabi structural rules, and a bounded peel chain

Declared boundaryThe live address view is deliberately paginated. Naming a CoinJoin implementation describes the transaction structure only, never the participants; shared control is not legal identity.

02

ATTRIBUTION SOURCES

Where a label comes from, and what it is worth

SourceWhat is shownDeclared boundary
OFAC SDN ListLive now

Exact matches for the searched identifier and its counterparties, with the list's publish date and a link to OFAC Sanctions List Search.

Refreshed twice daily; nothing is shown when the local snapshot is older than 36 hours, because a stale list can report a delisted address as sanctioned. Absence from the list is not a clearance, and a counterparty's listing is never transferred to the subject.

ScamSniffer phishing databaseLive now

Exact matches reported by ScamSniffer, with the snapshot date.

A third-party security project's report, not a finding of this tool or a legal determination. The public list carries a seven-day delay, and disputes belong with ScamSniffer.

Curated contract registryLive now

Bridges, privacy pools, DEX routers and major tokens, each labelled with the protocol documentation the address came from.

Chain-scoped: the same address on another network is a different deployment. The registry records what a contract is, never who uses it or why, and an unlabelled counterparty is simply absent from the registry.

Identity and ownership labelsEvidence gap

Nothing. No exchange attribution, cluster label, risk score or identity claim is produced.

Address clustering and wallet fingerprinting are published research, but they make claims about people and stay unbuilt pending a data-protection assessment and human review.

03

PRIVACY-SYSTEM MATRIX

What survives on the public record

SystemPublicly observableDefensible workflowHard stop
Bitcoin / CoinJoinResearch workflow

Inputs, outputs, scripts, values, timing, fees, and later spends.

Detect transaction structure, preserve the full candidate set, and compare pre/post-mix behavior with versioned heuristics.

Never map one input to one equal output without independent evidence.

EVM mixersResearch workflow

Pool deposits, withdrawals, denominations, relayers, fees, timestamps, and downstream transparent activity.

Build an anonymity set and show how each explicit timing, value, or behavior filter changes it.

An anonymity-set reduction is not a deposit-to-withdrawal proof.

MoneroEvidence gap

For current ring-era transactions: block structure, transaction structure, ring members, key images, fees, and cryptographic validity.

Public analysis can document explicitly height-gated ring composition. FCMP++ is a full-chain membership replacement under active development and must become a separate protocol-era model if activated. A voluntarily provided view-only wallet may disclose incoming activity locally; key images are needed for reliable spent state.

Public data does not reveal the actual signer, recipient address, or RingCT amount. There is no public-address wallet lookup equivalent, and ring heuristics must not be applied to a future FCMP++ era.

Zcash transparentResearch workflow

Transparent addresses, values, UTXOs, and shielding or deshielding boundaries.

Analyze the transparent subgraph and preserve where value crosses a shielded-pool boundary.

Do not draw a confirmed edge through a shielded pool.

Zcash shielded / OrchardEvidence gap

Transaction presence, proof-valid state changes, commitments, nullifiers, fees, and limited public metadata.

A voluntarily shared Unified Full Viewing Key can reveal account-authorized detail when processed in an isolated local workflow.

Addresses, amounts, and the internal graph are not publicly visible. Timing alone cannot resolve a shielded transfer.

04

WHEN PUBLIC DATA ENDS

Lawful next-step protocol

01

Move collection closer to the source

Use an investigator-controlled full node or indexer when completeness, query privacy, or reproducibility matters. Record software version, chain tip, and collection time.

02

Request records through proper authority

Exchange records, preservation requests, victim records, and service logs remain separate evidence domains. Store their authority, provenance, and limitations alongside—not inside—on-chain facts.

03

Process consented viewing material locally

Viewing keys or watch-wallet exports should be voluntarily supplied or obtained under applicable authority, processed on an isolated investigator device, and never submitted to the hosted application.

04

Preserve the unresolved result

If the public evidence cannot distinguish candidates, publish the candidate set and contradiction register. “Unresolved within public evidence” is a defensible conclusion.

Never paste a viewing key into this hosted workspace.

A future view-key module must run locally, keep secrets off application servers and telemetry, expose exactly what authority the key grants, and produce a redacted evidence manifest—not the key itself.

05

PRIMARY REFERENCES

Claims should remain inspectable

Capabilities are versioned as implementation changes. Absence of a label is never evidence of safety.Open live workspace