FORENSIAWeb3 forensicsOpen workspace

Following funds, one hop at a time

A method for tracing that stays honest about what each step establishes.

5 min read · Following value

Tracing is a sequence of small claims: this output was spent in that transaction, this account sent that amount to that one. Each hop is a recorded fact. The story connecting many hops is an interpretation, and it should be labelled as one.

#A working method

  • Fix the starting transaction and the asset. Do not switch assets mid-trace without recording the swap.
  • At each hop, note the amount, the time and the transaction identifier.
  • When funds split, follow each branch separately and keep track of what remains unfollowed.
  • When funds merge with other deposits, say so. From that point the same coins can no longer be picked out by amount alone.
  • Stop and record the reason when you reach a service, a bridge, or a pool you cannot see through.

Two transfers close together in time, with similar amounts, are a lead. They are not proof that the same funds moved. The stronger the claim, the more of the path has to be recorded rather than assumed.