Blockchain Forensic Analysis for a Specific On-Chain Question

What I do

Blockchain forensic analysis is the right fit when your question is narrower than a full investigation. An attorney may need one transfer confirmed before a deposition. A compliance team may need to know where a customer's withdrawal ended up. An investigator may need the matching transaction on the far side of a bridge. I scope the question, answer it, and document the answer so someone else can repeat it.

These are the questions I take on:

Wallet reconciliation

Does this wallet's history add up?I account for every coin in and out over the period, by asset, from the opening balance to the ending balance. If a reported or disclosed balance doesn't match the chain, the schedule shows where the gap opens.

Fund-flow mapping

Where did these funds go, or where did they come from?I follow them forward or backward from a known address or transaction, through splits, consolidations, and swaps, until they reach an exchange or stop. You get a flow chart and the transaction table behind it.

Cross-chain and bridge matching

Which transaction on the destination chain is ours?A bridge or swap leaves two separate records on two chains, and nothing on either chain links them for you. I match both sides by amount, timing, and the bridge's own references, and show both transactions in the exhibit.

Exchange endpoint identification

Which exchange received the funds?I identify the deposit addresses and transactions, state the basis for each attribution, and list what to request from the exchange. For counsel, that becomes a subpoena target list. For an investigator, it supports a records request.

Review of another expert's tracing

Does the other side's trace hold up?I rebuild the steps their conclusions depend on and check the hashes, the reconciliations, the tracing method, the cross-chain matches, and the source of each attribution. The standard is the one in Federal Rule of Evidence 702: sufficient facts, reliable methods, reliably applied. My criteria are public in what attorneys should look for in a crypto forensic report.

What the work product looks like

An analysis leads with the answer in a few plain sentences, then shows the work. Every key figure has a block explorer capture behind it, like this redacted Etherscan page from a real matter.

Along with the written answer, you get:

• A transaction table with the hash, block time, sending and receiving address, asset, and amount for every transfer the answer relies on.
• Charts where a flow is easier to see than to read.
• Block explorer captures for the figures that carry the most weight.
• A scope statement listing the addresses, chains, assets, and time window covered, with a data cut-off by date or block height.
• A methods note naming the tools: Breadcrumbs for fund-flow mapping, public block explorers such as Etherscan, and analysis tools I've built myself.

Chains I work on

• Bitcoin
• Ethereum and EVM chains
• USDT on Tron
• USDT on Ethereum
• Solana
• BNB Chain
• XRP
• Cardano

For stablecoin questions on Tron, how investigators trace USDT on Tron walks through the workflow. For the full sequence of a larger case, see the stages of a crypto forensic investigation.

What I need from you

• The question, in one sentence. "Where did the funds sent from this address on this date end up?" is a question I can scope. "Look into this wallet" isn't one yet.
• Starting points: addresses, transaction hashes, or an exchange export.
• The chains, assets, and time window you care about, if you know them.
• The other expert's report and exhibits, if you want a review.
• How the answer will be used: an internal file, a subpoena, a regulator, or a court. That decides the format.

What I don't do

• No identity from chain data alone. The chain shows addresses. Names come from exchange records or other documents, and I cite the source.
• No black-box risk scores. Every conclusion is checked against the public ledger.
• No conclusions about intent. I can show what a wallet did. Why its owner did it is outside what the chain records.
• No stretching past the evidence. If a trail ends at a mixer, a privacy coin, or an off-exchange trade, the analysis says where it stopped.
• No recovery promises, and no private-key or password cracking.

How an engagement works

1. Free 30-minute case review

   You state the question and what you have. I tell you whether the chain data can answer it.

2. Written scope and hour estimate

   The question as I'll answer it, the addresses and chains in scope, the data cut-off, and an estimate of hours, before any billable work.

3. Analysis

   Tracing, reconciliation, or matching, with each step checked on a public block explorer.

4. Written answer

   The answer first, then the tables, charts, and captures behind it.

5. Follow-up if you need it

   I answer questions about the findings. If the answer has to go before a court, the analysis can become a signed expert report and testimony. See expert witness services.

Fees are hourly and never contingent on the outcome.

Book a Free 30-Minute Case Review

Frequently asked questions

Zack Coffing

Founder of Wallet Witness. Independent blockchain forensic investigator, in crypto since 2017, with 20+ cases investigated and $10M+ traced. Wallet Witness is a one-person practice, so I do every analysis myself. Full background.