On-Chain Forensics:

Building an Evidence-Based Investigation

This is where the Knowledge Library moves from education into serious research.

The objective isn't simply to find something suspicious.

The objective is to construct an auditable chain of evidence.

1. Define the Question

Bad investigation:

"Is this project a scam?"

Better investigation:

"Did wallets associated with the project transfer a significant amount of tokens to previously funded addresses before a coordinated sell-off?"

Specific questions produce better investigations.

2. Establish Known Entities

Begin with addresses that are independently identifiable:

• Official treasury

• Deployer

• Liquidity wallet

• Public team wallets

• Exchange wallets

• Known contracts

Record the source that establishes each relationship.

3. Map the Transaction Graph

Think of the blockchain as a network.

Wallet → Wallet → Wallet → Exchange → Market

You're looking for relationships and flows.

Useful dimensions include:

• Funding source

• Transaction timing

• Token amount

• Destination

• Repeated behaviour

• Contract interactions

• Exchange deposits

4. Identify Anomalies

Look for behaviour that differs from the expected pattern.

Examples:

• Large transfers shortly before announcements

• Sudden wallet creation and funding

• Coordinated purchases

• Multiple wallets receiving identical allocations

• Large transfers immediately before selling

• Liquidity withdrawals

• Previously inactive wallets becoming active simultaneously

An anomaly is not automatically misconduct.

It is a signal requiring further investigation.

5. Build an Evidence Chain

Every significant conclusion should have supporting evidence.

Claim

↓

Transaction

↓

Wallet

↓

Timestamp

↓

Blockchain record

↓

Independent corroboration

The stronger the chain, the stronger the investigation.

6. Corroborate Off-Chain Evidence

On-chain evidence should be compared with:

• Official announcements

• Archived webpages

• Project documentation

• Regulatory filings

• Court documents

• Reputable journalism

• Public statements

• Blockchain explorer records

A blockchain transaction can prove that something happened.

It doesn't necessarily prove why it happened.

That distinction matters.

7. Separate Observation From Interpretation

Observation:

Wallet A transferred 500,000 tokens to Wallet B at 14:32 UTC.

Interpretation:

Wallet B may be associated with Wallet A.

Conclusion:

Insufficient evidence to establish common ownership.

This is how serious investigations should be written.

8. Preserve the Evidence

Record:

• Transaction hashes

• Wallet addresses

• Block numbers

• Timestamps

• Screenshots

• Source URLs

• Archived copies where appropriate

Blockchain data can be revisited, but websites and social posts can disappear.

Rebel Standard

No accusation without evidence. No conclusion without corroboration.