Blockchain investigation terms, defined honestly.
41 terms used across investigation and crypto compliance. Each one includes what it does not mean, because in this field the misreadings cause more damage than the gaps.
Blockchain investigation terms, defined
Blockchain investigation uses precise vocabulary that is easy to misread: exposure, clustering, attribution, hops, peel chains and intervention points each mean something specific. Each term below is defined in plain language, with a worked example and an explicit note on what the term does not mean.
What do blockchain investigation terms actually mean?
Blockchain investigation uses precise vocabulary that is easy to misread. Clustering groups addresses by inference, not observation. Exposure measures transactional proximity, not guilt. Attribution links an address to an entity with a stated confidence that decays over time. A risk score is a prompt for review, never a determination.
Address
A destination on a blockchain that can hold and send value, derived from a public key. Addresses are pseudonymous strings, not accounts in a bank sense, and a single person or service may control millions of them.
What it does not mean: An address is not a person. Attributing one to an individual requires evidence from outside the chain, and inference alone never establishes identity.
Transaction hash
The unique identifier of a confirmed transaction, produced by hashing its contents. Usually written as a long hexadecimal string, it is the single most useful piece of information you can give an investigator.
What it does not mean: A hash proves a transaction happened and what it contained. It says nothing about who authorised it or why.
Block
A batch of transactions confirmed together and appended to the chain. Blocks carry a timestamp and a reference to the previous block, which is what makes the history ordered and tamper-evident.
What it does not mean: Block timestamps are set by the producer within tolerance rules, so they are approximate rather than exact wall-clock times.
Confirmation
The number of blocks added after the one containing a transaction. More confirmations mean a reorganisation that reverses the transaction becomes progressively less plausible.
What it does not mean: Confirmations describe settlement certainty, not reversibility. A settled transaction cannot be undone by anyone, including the network developers.
UTXO
Unspent Transaction Output. On Bitcoin-style chains, value is held as discrete unspent outputs rather than a running balance, and spending consumes whole outputs while returning any difference as change.
What it does not mean: The UTXO model is why change addresses exist, and why naive reading of an output as "the recipient" is frequently wrong.
Change address
An address that receives the remainder when a UTXO larger than the payment is spent. Wallets usually generate a fresh one for each transaction, so change often looks like an unrelated new destination.
What it does not mean: Mistaking change for a payment is one of the most common tracing errors, and it is the reason ordinary wallet activity can resemble a laundering pattern.
Gas
The fee paid to have a transaction included and executed on chains such as Ethereum, priced in the native asset and varying with network demand.
What it does not mean: No legitimate recovery service ever needs you to send gas so they can "release" your funds. That request is the defining pattern of advance-fee fraud.
Private key
The secret value that authorises spending from an address. Whoever holds it controls the funds, completely and irreversibly.
What it does not mean: A private key is never recorded on the blockchain and cannot be derived from transaction analysis. No investigation recovers one.
Seed phrase
A sequence of words, usually twelve or twenty-four, from which a wallet derives all its private keys. It is a complete backup of the wallet.
What it does not mean: There is no legitimate reason for any investigator, exchange or support agent to ask for it. Sharing it transfers everything, immediately and irreversibly.
Clustering
Grouping addresses believed to be controlled by the same entity, using heuristics such as common-input ownership, where inputs spent together are presumed to share a controller.
What it does not mean: Clustering is probabilistic inference, not observation. CoinJoin, payment batching and shared custody all defeat it, and a cluster is a hypothesis carrying a confidence level.
Attribution
Associating an address or cluster with a named real-world entity such as an exchange, a service or a known actor, drawn from public disclosures, interaction patterns and prior casework.
What it does not mean: Attribution ages. Service address sets change, and a label correct eighteen months ago may be wrong today. A platform that never revisits labels accumulates error silently.
Exposure
The degree to which an address has transacted with a category of counterparty. Direct exposure means transacting with that counterparty itself; indirect exposure means value reached it through intermediaries.
What it does not mean: Exposure is not guilt. Receiving funds that touched an illicit service several hops back may indicate nothing about the recipient, and hop distance is what determines materiality.
Hop
One transfer step between addresses. Tracing counts hops from a starting point outward, and analytical confidence decays with each additional hop as the set of possible explanations widens.
What it does not mean: There is no fixed number of hops at which a trace stops being valid. Confidence degrades continuously and a competent report states where.
Peel chain
A laundering pattern where a large balance moves through a long sequence of transactions, each peeling off a small amount to a cash-out destination while the remainder forwards to a new change address.
What it does not mean: Peel chains look conclusive and frequently are not. Ordinary wallet change behaviour produces a very similar shape, and distinguishing the two requires more than the pattern alone.
Intervention point
A place in a fund flow where a party exists who could actually act - typically a regulated exchange with a compliance function that can freeze an account.
What it does not mean: Identifying one does not mean anything will happen. Whether a service acts depends on its policies, its jurisdiction and whether a lawful request reaches it in time.
Chain of custody
The documented handling history of evidence, showing who accessed it, when, and what changed. It is what allows an exhibit to be relied on in a proceeding.
What it does not mean: On-chain data is public, but an analysis of it is a work product. Without custody records the analysis is contestable regardless of whether it is correct.
Dusting
Sending tiny amounts to many addresses, either to deanonymise holders by observing how the dust is later consolidated, or to pollute analysis with meaningless connections.
What it does not mean: Received dust does not imply any relationship with the sender. Treating it as exposure is a well-known way to produce false positives.
Taint analysis
Modelling how illicit value propagates through subsequent transactions, using rules such as first-in-first-out or proportional distribution to decide which outputs inherit it.
What it does not mean: Different taint models give materially different answers on the same data. Any figure derived from taint is only meaningful alongside the model that produced it.
Mixer
A service that pools funds from many users and redistributes them to break the on-chain link between source and destination.
What it does not mean: A mixer is usually where a trace ends. Analysis can establish that funds entered one and how much, but not reliably which outputs correspond to which deposit.
Bridge
Infrastructure moving value between blockchains, typically by locking an asset on one chain and issuing a representation on another.
What it does not mean: Cross-chain tracing succeeds only when a destination transaction can be matched to a source by amount, timing and route. Where none of those hold, the honest report is that the trail ends.
CoinJoin
A collaborative transaction in which many participants combine inputs and outputs, breaking the common-input heuristic that clustering relies on.
What it does not mean: CoinJoin participation is not evidence of wrongdoing. It is a privacy technique with entirely legitimate uses, and treating it as inherently suspicious produces bad analysis.
VASP
Virtual Asset Service Provider. The regulatory term for businesses that exchange, transfer, hold or issue virtual assets on behalf of others, including exchanges and custodial wallets.
What it does not mean: VASP status determines which obligations apply, including the Travel Rule. It is a regulatory classification, not a quality or trustworthiness signal.
Centralised exchange
A custodial trading platform that holds customer assets, operates order books and generally performs identity verification. In stolen-funds cases it is the party most able to act.
What it does not mean: An exchange can freeze an account it controls, but rarely does so on a victim’s word alone. It acts on documented reports and lawful requests, which is why filing a police report comes first.
Smart contract
Code deployed to a blockchain that executes automatically when its conditions are met, used for tokens, exchanges, lending and bridges.
What it does not mean: Code executing as written is not the same as behaving as intended. Most large exploits are contracts working exactly as coded, in ways nobody anticipated.
Token approval
A permission granting a smart contract the right to move tokens from your wallet. Many approvals are unlimited in amount and unlimited in time.
What it does not mean: An approval granted once persists until revoked. A drain executed months later exploits a permission the victim granted and forgot, and the transfer itself is entirely valid on-chain.
KYT
Know Your Transaction. Continuous screening of blockchain transactions for money-laundering and sanctions risk, scoring counterparty exposure and flagging activity for review.
What it does not mean: Where KYC verifies who a customer is, KYT monitors what their transactions do. Neither substitutes for the other, and a KYT alert is a prompt to review rather than a finding.
KYB
Know Your Business. Verification of a corporate counterparty rather than an individual: ownership structure, regulatory status and the on-chain exposure behind the relationship.
What it does not mean: A clean corporate registration says nothing about on-chain behaviour. Both halves are required, and either alone is misleading.
Travel Rule
The requirement that VASPs transmit originator and beneficiary information alongside transfers above a threshold, extending long-standing wire-transfer rules to virtual assets.
What it does not mean: Implementation, thresholds and timing differ by jurisdiction, and compliance depends on the counterparty VASP being reachable and willing to exchange data.
Sanctions screening
Checking whether an address is controlled by a sanctioned party or exposed to one through intermediate transactions, against lists such as those published by OFAC.
What it does not mean: Screening produces exposure findings, not legal determinations. Whether exposure creates an obligation is a question for counsel and the applicable regime.
Risk score
A numerical indicator combining exposure to categorised counterparties, weighted by hop distance and value, used to prioritise review.
What it does not mean: A score is an indicator, not a determination. Treating one as an answer rather than a prompt is the most common way risk scoring is misused, and it produces decisions that cannot be defended.
AML
Anti-Money Laundering. The framework of controls, monitoring and reporting obligations designed to detect and deter the movement of criminal proceeds through financial systems.
What it does not mean: AML obligations attach to regulated entities. An individual victim has reporting options but not AML duties, and no AML framework guarantees recovery of stolen funds.
Pig butchering
A long-running investment fraud in which the victim is cultivated over weeks through social or dating contact, shown fabricated returns on a fake platform, and encouraged to deposit progressively more.
What it does not mean: The platform showing a growing balance is a front end with no assets behind it. Withdrawal requests trigger fee demands rather than payments.
Approval drainer
An attack that induces a victim to sign a token approval, then uses that permission to transfer assets out, often long after the signature was given.
What it does not mean: The draining transaction is valid and irreversible. Tracing addresses where funds went, not whether the transfer can be undone - it cannot.
SIM swap
Taking control of a victim’s phone number by convincing or bribing a carrier to reassign it, then using SMS-based recovery to seize accounts including exchange accounts.
What it does not mean: The loss usually begins off-chain at the carrier. That makes carrier records and the police report central evidence, not merely supporting material.
Advance-fee fraud
Demanding an upfront payment to release a larger sum that does not exist. In this category it appears as a tax, bond, gas fee or compliance charge required before "recovered" funds can be returned.
What it does not mean: This is the mechanism behind essentially every recovery scam. No legitimate party charges a fee to return your own money, whatever the fee is called.
Recovery scam
Fraud that targets people who have already lost money, offering to retrieve it. Victim lists circulate and are sold, so approaches often arrive unsolicited.
What it does not mean: The second loss is frequently larger than the first. Four red flags each identify one on their own: a promise of recovery, a request for your seed phrase, an upfront release fee, or contact you did not initiate.
Rug pull
A project that attracts deposits or token purchases and then removes liquidity or abandons the project, leaving holders with an asset that cannot be sold.
What it does not mean: Distinguishing a rug pull from ordinary project failure requires evidence of intent, which on-chain data alone rarely establishes.
Case assessment
The initial triage of a reported loss, establishing what happened, what evidence exists, and whether blockchain analysis can realistically contribute anything useful.
What it does not mean: A genuine assessment can conclude that nothing useful can be done. A process that never reaches that conclusion is a sales funnel, not triage.
Investigative report
A structured document setting out the traced path, the services identified, the methodology applied, the confidence behind each finding, and the limitations of the analysis.
What it does not mean: A report documents what the chain shows. It does not prove who controlled an address, and one that claims to should not be relied on.
Confidence level
An explicit statement of how strongly the evidence supports a finding, separating observed fact from supported inference from speculation.
What it does not mean: Analysis without stated confidence is an assertion. In a proceeding, an unqualified claim is easier to attack than a qualified one.
Preservation
Capturing evidence before it disappears: transaction hashes, addresses, screenshots, message threads, website addresses and account records.
What it does not mean: Scam infrastructure is taken down quickly and chat histories are deleted by the operator. Evidence not captured in the first hours is frequently unrecoverable.