Transaction analysis
Each key transaction is broken down into its inputs and outputs. The software flags mixing transactions and identifies the likely change output, listing the reasons for each verdict.
Sample report
A report built to be checked
This is a complete report produced by the Chain Tracker software from demonstration data. It shows the structure, tables and evidence log the software generates.
Demonstration data. Every address, transaction and amount in this sample is synthetic and does not depict a real case or person.
The sample case
0.60 BTC stolen. Where did it go?
The stolen coins were spent together with the suspect’s own funds, then moved on. The trace follows the stolen amount using the FIFO method.
Traced amount
0.60 BTC
Reached an exchange
0.4999 BTC · 2 hops
Entered a mixer
0.10 BTC
What’s inside
Anatomy of a report
1
2
Address clustering
Addresses likely controlled by the same person are grouped. Every link names the rule used and the transaction that supports it, so each grouping can be checked independently.
3
Fund trace
The traced amount is followed hop by hop until it reaches an exchange, a mixer or an unspent holding. The totals reconcile: what reached each destination plus fees equals the starting amount.
4
Graph of the trail
The whole path on one page: money flows left to right, exchanges are marked in amber, and mixing transactions in red.
5
Methodology, limitations and evidence
Every report explains how each finding was reached, what the methods can’t prove, where each attribution came from, and lists every blockchain record collected with its SHA-256 fingerprint.
New to Bitcoin forensics?
The explainers cover the ideas behind every section of this report.