How we reach a conclusion.

Approach

Every report separates two kinds of statement. Measurements are facts read from the blockchain: balances, dates, transfers, who funded whom. They are exact and anyone can check them. Judgments are conclusions drawn from those facts, such as whether two wallets belong to the same person or which exchange a deposit address belongs to. They are probabilistic, and we present them that way.

Measurements are produced by fixed, versioned code, so the same input gives the same output. Software assists with collecting evidence and drafting. A named analyst reviews every finding, looks for innocent explanations, and is responsible for the conclusion.

What we establish

Inventory and proof of control

A report starts from the wallets and accounts the client declares. We then look for wallets the declared ones point to: addresses that receive repeated transfers from the subject's wallets and send nothing back, addresses the subject funded shortly after creating them, and addresses that share a hardware wallet's derivation with a declared one. Each is reported with the reason it was included, so it can be confirmed or challenged.

Control is evidenced by the holder signing a short message with the wallet, or by making a small transfer we nominate. No keys, seed phrases or logins are ever shared with us. Where control cannot be evidenced - the keys are lost, the holder has died, or the wallet is disputed - the report says so and treats the wallet accordingly.

Linking wallets to one person

Two addresses are treated as the same person's only when the evidence supports it. No single signal is treated as proof. We look for combinations of:

• Proof of control for both, which settles the question.
• Direct funding. One wallet's first funds came from the other, directly or through a short chain.
• Matched transfers. Amounts that leave one wallet and arrive in the other, allowing for network fees and bridge charges, repeatedly.
• Shared exchange accounts. Both wallets withdraw from or deposit to the same exchange deposit address, which exchanges assign to one customer.
• The client's own account of events, recorded as such and not as a finding.

Wallets funded directly from an exchange hot wallet are never linked on that basis alone, because thousands of unrelated people share the same hot wallet.

Reconciliation

Exchange statements are matched to the blockchain row by row: by transaction reference where the exchange provides one, otherwise by asset, amount and a narrow time window. Each row ends in one of three states: matched, matched with a note, or unmatched. Unmatched rows are listed individually with what we think happened. Trading inside an exchange leaves no on-chain record and is taken from the statement, which the report says clearly.

Classification

Every on-chain transaction is placed in a category from a fixed list. Most are straightforward. The hard cases are transfers between the subject's own wallets, which tax software often treats as disposals; movements across bridges, where the same value leaves one network and arrives on another; and deposits into staking and lending protocols, where an asset is exchanged for a receipt token that represents it. We identify each of these and describe the facts. Where the tax or accounting treatment is a matter of professional judgment, we say so and leave the judgment to the client's adviser.

Valuation

Assets are valued at the date or moment that matters, using market prices from named sources, converted to pounds or euros at the central bank reference rate for the day. Positions inside staking and lending protocols are valued on the underlying asset. Where an asset has no reliable market - a token with little or no trading - the report says so rather than inventing a figure. Whether a valuation is accepted for probate, tax, accounts or a court is for the professional relying on it.

Tracing

Funds are followed from a starting transaction hop by hop. Where funds are swapped, the value continues in the new asset. Where they cross a bridge, the outgoing leg is matched to the incoming leg on the other network by amount and time. Where they are split, each branch is followed until it reaches an endpoint or falls below a threshold agreed with the client. Where they pass through a mixer or a network outside scope, the trail stops and the report says so.

An endpoint is a deposit address at an identifiable exchange, a service contract, or a wallet still holding the funds. Which exchange an address belongs to is taken from public labels and from the address's own behaviour, and is graded by confidence. Whose account it is cannot be seen from the chain; that requires the exchange's cooperation or a court order, which is for the client's solicitor.

Status of each finding

Every transaction carries two things: what it is, and how far the facts needed to rely on it have been established. The status is one of verified (supported by on-chain evidence and, where relevant, supplied documents), classified (the activity is confidently identified), client confirmation required (ownership, purpose or relationship needs the client), professional judgment required (facts established; treatment belongs to the accountant or solicitor), unresolved, or ignored (unsolicited or economically irrelevant, excluded from headline totals). A report's cover states its own state, from chain-only draft to final, and its completeness section lists what is still missing.

Confidence

Judgments are graded high, medium or low. Attribution of a wallet to a named person or company is only ever stated as the client's belief, as evidenced by proof of control, or as an inference with the evidence for it. Ownership cannot be proven from chain data alone.

Data sources

• Public blockchain data for the networks in scope, obtained through enterprise-grade indexing providers: transactions, transfers, balances at a block, contract events and prices at the time of each event.
• Address labels for exchanges, bridges, staking and lending protocols and other known contracts, from provider datasets and public label sets, supplemented by our own research.
• Published sanctions lists and known mixer contracts for the exposure check.
• Foreign exchange rates from the Bank of England and the European Central Bank.
• Documents supplied by the client, such as exchange statements. These are relied on as supplied and identified as such.

We use public data and the documents you give us. No tracking scripts, no device fingerprinting, no keys and no logins.

What we cannot see

• Activity inside a centralised exchange. It appears only on the exchange's statements.
• Whose account a deposit address at an exchange belongs to.
• A wallet nobody has declared and nothing points to.
• Funds after they enter a mixer, a privacy network, or a chain outside the agreed scope.
• Anything about the identity of a wallet's owner beyond what proof of control and behaviour imply.

Each report restates the limits that matter for its conclusion. Our sanctions exposure check is a hygiene check. It is not an anti-money-laundering risk rating and does not replace a regulated firm's screening provider.

Review and corrections

Every report includes a method appendix and data files listing each wallet, each transaction and each statement row with its category, match status and reasons, so your own team can check the work. If a finding is shown to be wrong we correct the report, state what changed and reissue it.

Independence

We are paid by the person who has to rely on the report, or by the professional acting for them, and the report says what the evidence says regardless. We take no referral fees, hold no position in the assets involved and sell nothing to the subject of a report afterwards. Who commissioned a report, and what it covered, is confidential.