Worked example · on-chain evidence

Tracing in practice

July 2026·EU · CH · UK

BlockchainEvidenceTrainingWorked example

Tracing in practice · a worked example, then the chain itself

Reading the chain set out the two literacies: the ledger, and the law that attaches identity to it. This dossier does the work in front of you — one transaction traced end-to-end at this practice's evidence standard, one attribution handled the way an attribution has to be handled, and then a rotating set of real transactions for you to run yourself. Everything below is free to check, and nothing below asks to be taken on trust — that is the point.

Part 1 — The method, stated plainly

Four rules govern every on-chain fact this practice relies on. They are not ornament; each one exists because its absence is a known failure mode.

Cite so a stranger can re-derive it. The minimum citation is: transaction hash + chain and network + block height + block timestamp (UTC) + amounts in native units. Anyone holding that citation can reproduce the fact from any node or explorer, indefinitely, without trusting us.
Two independent explorers, always. You never read the blockchain; you read an explorer's rendering of it. Renderings have operators, indexing faults and lag. Two independently-operated explorers agreeing is the minimum; two frontends sharing one data provider are one source wearing two interfaces.
Fiat is an annotation, not a fact. The ledger records native units. A fiat figure is true only at a date and a source — write it as one.
Facts and attributions never share a sentence. A ledger fact (this transaction exists, at this height, in this amount) is reproducible by anyone. An attribution (this address belongs to someone) is a claim by a third party, cited to its source, carried at its own confidence. The moment the second borrows the certainty of the first, the report is wrong — whatever else it gets right.

So what — the method is not academic caution. It is what makes the work usable: the other side, the tribunal and the supervisor can each check every factual sentence without asking us anything.

Part 2 — Worked example A: a ledger fact, end to end

The task: establish, to citation standard, the transaction in which 10,000 BTC was paid for two pizzas on 22 May 2010 — the most famous transaction on the chain, and a working lesson in reading inputs.

Step 1 — fix the question. What is being established is a ledger fact: that a specific transfer of 10,000 BTC is part of the Bitcoin ledger. No attribution is needed; nobody's identity is in issue.

Step 2 — look it up, twice. The transaction hash is:

a1075db55d416d3ca199f55b6084e2115b9345e16c5cf302fc80e9d5fbf5d48d

Pasting it into mempool.space and Blockchair — independently-operated explorers — returns the same record. If they disagreed, the drill is to stop, not to pick the convenient one.

Step 3 — read the structure before the numbers. The record shows 131 inputs and one output. The inputs tell you how the payer held the funds: not as "a balance of 10,000 BTC" but as 131 separate unspent outputs — mining rewards and small receipts — consumed together. The single output of 10,000 BTC tells you the inputs happened to sum to the payment: no change output was needed. (Most transactions have one; this one is the useful counter-example.)

Step 4 — write the citation. As it would appear in a report:

Transaction a1075db5…d48d, Bitcoin mainnet, block 57,043, block timestamp 2010-05-22 18:16:31 UTC, 131 inputs, single output of 10,000 BTC. Read on mempool.space and corroborated on Blockchair, 7 July 2026.

Note what the citation does not say: it does not call it "a $41 purchase" or "a $700 million transaction". Both figures are true — at May 2010 and at later prices respectively — which is exactly why neither belongs in the factual layer. If the fiat value matters, it appears as an annotation: approximately USD 41 at the prevailing May 2010 rate (source, date).

For live matters, the printable on-chain citation record captures exactly these fields, one page per fact.

Step 5 — state what it proves, and stop. The citation proves this transfer, between these addresses, in this amount, at this block, is part of the ledger. It does not name the payer or the payee. History happens to know both from off-chain sources — the forum post, the men themselves — which illustrates the boundary: everything identifying about this famous transaction came from outside the chain.

So what — five steps, two free websites, no account, and the result survives cross-examination. That is the standard, and it costs an afternoon to learn.

Part 3 — Worked example B: an attribution, handled properly

The task: report on the address that drained the Ronin bridge of 173,600 ETH on 23 March 2022 — which requires saying whose address it is. This is where most work in this field goes wrong, so watch the seams.

The ledger layer. Transaction 0xc28fad5e8d5e0ce6a2eaf67b6687be5d58113e16be590824d6cfa1a94467d0b7, Ethereum mainnet, block 14,442,835, block timestamp 2022-03-23 13:29:09 UTC, sent from address 0x098B716B8Aaf21512996dC57EB0615e2383E2f96 to the Ronin bridge contract — corroborated on Etherscan and Blockscout. One reading trap sits in plain view: the transaction's value field shows 0 ETH. The theft moved as an internal transfer executed by the bridge contract in response to the forged withdrawal instruction; a reader who checks only the value field misses the entire event. So far, every sentence is reproducible by anyone.

The attribution layer. Who controls 0x098B…2f96? The ledger cannot say — but an official document can be cited. On 14 April 2022, OFAC added the address to the SDN list, attributing it to the Lazarus Group under the North Korea sanctions program. The properly-phrased report sentence is:

OFAC designated address 0x098B…2f96 on 14 April 2022, attributing it to the Lazarus Group (DPRK).

The claim asserted is the designation's existence — a public-record fact — not the practice's own conclusion about who holds the keys. The strength of the attribution is the document's: a sanctions listing sits at the top of the hierarchy, above any commercial analytics label, because it is a primary source with legal consequences for error.

The date layer. A designation is a fact about a list at a date. Tornado Cash's contracts were designated in August 2022 and delisted in March 2025 after the Fifth Circuit held the designation exceeded OFAC's authority — the standing proof that labels go stale. Before repeating any sanctions status, re-run the OFAC search on the day of reliance, and cite that day.

So what — the finished report has three visibly separate layers: facts anyone can re-derive, an attribution cited to the official document that made it, and a date on everything that can change. A reader can accept the facts while rejecting the attribution. If your drafting makes that impossible, the layers have bled — and the draft goes back.

Part 4 — Now the chain itself

Below are three exercises from a pool of real transactions and addresses — the genesis block, the first-ever payment, DOJ seizures, sanctioned bridges, token traps. Each gives you an identifier to paste, two independent explorers to paste it into, and questions to answer before you reveal the model answers. The set rotates daily.

Every fact in the pool was corroborated on two independently-operated explorers before publication, and every attribution rests on an official document that is linked. Which is to say: the exercises hold themselves to the standard they teach.

Dotted-underlined terms carry hover definitions; the full list lives in the glossary.

Loading today’s practice set…

New set daily · 24 exercises in the pool · every fact checked on two independent explorers.

Working on a matter this touches?

Start a conversation