SAMPLE REPORT — DEMO DATA. Every address, transaction and amount in this report is synthetic and does not depict a real case. Evidence hashes are illustrative.
Cryptocurrency Tracing Report
Illustrative theft trace (demo data)
Case DEMO-0001 · Examiner: Chain Tracker sample · Prepared 2026-11-13
1. Scope and data source
Blockchain: Bitcoin mainnet. Data was retrieved from the Esplora API at https://mempool.space/api. Each response was preserved unaltered and identified by its SHA-256 hash (Appendix A). Integrity check at report time: 8 stored responses re-hashed, 0 problem(s).
2. Methodology
- Transaction analysis: inputs and outputs were examined and heuristic tests applied for CoinJoin fingerprints and change-output detection.
- Address clustering: addresses were grouped using the common-input-ownership heuristic (all inputs of a non-CoinJoin transaction are assumed to share an owner), optionally extended by change-output detection. Each grouping cites the transaction that supports it.
- Wallet exploration: balances, history and counterparties were compiled from public blockchain data for the listed addresses (or addresses derived from an extended public key using a gap-limit scan).
- Taint analysis: funds were followed forward from the source outputs using the stated allocation method. Tracing stopped at unspent outputs, attributed service endpoints, CoinJoins, the hop limit, or amounts below the threshold.
3. Findings
Theft transaction — inputs, outputs and change
TX · recorded 2026-11-12T15:00:00.000Z
2222222222222222222222222222222222222222222222222222222222222222 — Simple payment with change · block 101 · fee 10000 sats
| Input | Value (BTC) |
|---|
bc1qthiefA1 | 0.60000000 |
bc1qthiefA2 | 0.40000000 |
| # | Output | Value (BTC) |
|---|
| 0 | bc1qpayX1 | 0.50000000 |
| 1 | bc1qthiefA3 likely change (low) | 0.49990000 |
- output #1: +1 only non-round amount (other outputs are round payments)
Examiner notes: The 0.5 BTC output is a round amount; the 0.4999 BTC output is the likely change returning to the suspect.
Suspect address cluster
CLUSTER · recorded 2026-11-12T15:00:00.000Z
Seed bc1qthiefA1 · 2 addresses · 1 spending transactions examined
| Address | Linked via | Rule | Supporting transaction |
|---|
bc1qthiefA2 | bc1qthiefA1 | CIOH | 2222222222222222222222222222222222222222222222222222222222222222 |
Examiner notes: Two addresses spent together in one transaction; treated as one controller.
Suspect wallet activity
WALLET · recorded 2026-11-12T15:00:00.000Z
Total received 1.09990000 BTC · sent 1.09990000 BTC · balance 0.00000000 BTC · first seen 2023-11-15T14:53:20.000Z · last seen 2023-11-15T15:13:20.000Z
| Address | Type | Txs | Received (BTC) | Balance (BTC) |
|---|
bc1qthiefA1 | P2WPKH (native SegWit) | 2 | 0.60000000 | 0.00000000 |
bc1qthiefA3 | P2WPKH (native SegWit) | 2 | 0.49990000 | 0.00000000 |
Top counterparties
| Address | Sent to (BTC) | Received from (BTC) | Txs |
|---|
bc1qvictim | 0.00000000 | 1.00000000 | 1 |
bc1qpayX1 | 0.50000000 | 0.00000000 | 1 |
bc1qchg1 | 0.39970000 | 0.00000000 | 1 |
bc1qmix1 | 0.10000000 | 0.00000000 | 1 |
bc1qmix2 | 0.10000000 | 0.00000000 | 1 |
bc1qmix3 | 0.10000000 | 0.00000000 | 1 |
bc1qmix4 | 0.10000000 | 0.00000000 | 1 |
bc1qchg2 | 0.09990000 | 0.00000000 | 1 |
bc1qchg3 | 0.04990000 | 0.00000000 | 1 |
bc1qchg4 | 0.01990000 | 0.00000000 | 1 |
FIFO trace of the stolen 0.60 BTC
TAINT · recorded 2026-11-12T15:00:00.000Z
Method: FIFO · source 0.60000000 BTC from 1 output(s) · 3 transactions traced
Where the tainted funds ended up
| Destination | Tainted (BTC) |
|---|
| endpoint: exchange | 0.49990000 |
| entered mixer | 0.10000000 |
Funds entered a CoinJoin (JoinMarket-style / generic CoinJoin). Tracing stops here; outputs cannot be linked to inputs with confidence. (4444444444444444444444444444444444444444444444444444444444444444, 0.10000000 BTC)
FIFO assigns input sats to outputs in the order they appear in the transaction. Wallet software, not the user, usually chooses that order.
Traced outputs
| Hop | Outpoint | Address | Tainted (BTC) | % of output | Status |
|---|
| 0 | 11111111111111111111…:0 | bc1qthiefA1 | 0.60000000 | 100.0% | spent → traced |
| 1 | 22222222222222222222…:0 | bc1qpayX1 | 0.50000000 | 100.0% | spent → traced |
| 1 | 22222222222222222222…:1 | bc1qthiefA3 | 0.10000000 | 20.0% | entered mixer (444444444444…) |
| 2 | 33333333333333333333…:0 | bc1qexchangeE1 ExampleEx deposit | 0.49990000 | 100.0% | endpoint: exchange — ExampleEx deposit |
Examiner notes: 0.4999 BTC reached a labeled exchange deposit (subpoena target). 0.10 BTC entered a CoinJoin and was not followed further.
4. Attribution sources
| Address | Label | Category | Source |
|---|
bc1qexchangeE1 | ExampleEx deposit | exchange | Illustrative label (demo) |
5. Limitations
- Clustering and change detection are heuristics, not proof. Payjoin, shared custody, collaborative transactions and deliberate change-avoidance can produce false positives.
- Attribution (labels) is only as reliable as its stated source; unlabeled addresses are not necessarily unaffiliated.
- CoinJoin detection relies on known structural fingerprints; novel or small mixing transactions may not be recognised, and some ordinary batch payments may resemble them.
- The taint allocation method materially changes the amounts attributed to each destination. Results under other methods may differ.
- Off-chain movements (internal exchange ledgers, Lightning Network, custodial transfers) are not visible on the blockchain and cannot be traced here.
Appendix A — Evidence log
| # | Collected (UTC) | Request | SHA-256 | Bytes |
|---|
| 1 | 2026-11-12T15:00:12.000Z | https://mempool.space/api/tx/1111111111111111111111111111111111111111111111111111111111111111 | 76ee24c064e969280a671cd1d1a542a6ad9e4397e7a3e34963063d168eaa6fe8 | 900 |
| 2 | 2026-11-12T15:01:12.000Z | https://mempool.space/api/tx/1111111111111111111111111111111111111111111111111111111111111111/outspends | d63fc99df767042820f24e905e84bed54013238475f1870c0e81311aacc59d5f | 1037 |
| 3 | 2026-11-12T15:02:12.000Z | https://mempool.space/api/tx/2222222222222222222222222222222222222222222222222222222222222222 | 3b57851f8eeaf79b8d18078f071594d4a8924599adec19befc0ae27b547469ab | 1174 |
| 4 | 2026-11-12T15:03:12.000Z | https://mempool.space/api/tx/2222222222222222222222222222222222222222222222222222222222222222/outspends | b8f246c11218966d99539126515074a4701480af5a2289fd6d8a3abf93888647 | 1311 |
| 5 | 2026-11-12T15:04:12.000Z | https://mempool.space/api/tx/3333333333333333333333333333333333333333333333333333333333333333 | 6097167e5fb56b623539acd721f9bcb6ac785a8d17e59692cbc05c091189199d | 1448 |
| 6 | 2026-11-12T15:05:12.000Z | https://mempool.space/api/tx/4444444444444444444444444444444444444444444444444444444444444444 | d8983e6712bf61fd486692c8387f00a02432ba1b8d7efa3a234d940a5fac399b | 1585 |
| 7 | 2026-11-12T15:06:12.000Z | https://mempool.space/api/address/bc1qthiefA1 | ce3a3fa87d02394f3b2da56bb620948c0eb851cbe324188ec701a640d426522a | 1722 |
| 8 | 2026-11-12T15:07:12.000Z | https://mempool.space/api/address/bc1qthiefA1/txs | eeabb214ee42122a2484283e50ed72b5e8ed35fd53005281c6f6a60089b14539 | 1859 |