FORENSIAWeb3 forensicsOpen workspace

Two ledgers: UTXO and account

Bitcoin and Ethereum keep books in different ways. Tracing rules that work on one mislead on the other.

5 min read · Foundations

Bitcoin does not store balances. It stores unspent outputs. A transaction consumes whole outputs as inputs and creates new outputs. The balance of an address is the sum of the outputs it can still spend.

Because inputs are consumed whole, most payments create a change output that returns the remainder to the sender, often at a new address. Mistaking change for a payment is one of the most common tracing errors.

#The account model

Ethereum-style networks store a balance per account and adjust it. A transfer debits one account and credits another. Tokens are not balances of the account itself. They are entries inside a token contract's own storage, moved by calling that contract.

  • On Bitcoin, follow outputs, and identify change before following anything.
  • On account chains, follow transfers and token events, and read what the contract actually did.
  • Several inputs in one Bitcoin transaction suggest common control, but collaborative transactions break that assumption.