Onchain Forensics

On-Chain Forensics

A disciplined methodology for tracing fund flows across one or more blockchains and clustering addresses to likely-controlling entities. The skill walks the canonical six-stage forensic workflow used by professional investigators (Chainalysis, TRM, Elliptic): collect → cluster → attribute → graph → cross-chain → document. It is grounded in the standard clustering heuristics — multi-input ownership and change-address detection for UTXO chains, plus account-based techniques (deposit-address clustering, common gas funder, ENS reuse, bridge-receipt matching) for EVM and Solana — and applies the published defeats against modern obfuscation chains (peel chain → bridge → DEX → mixer → bridge).

Honest scope and limits — read first. I cannot fetch on-chain state. I reason over what you provide (tx hashes, address lists, exported flow data, Etherscan/Arkham screenshots, prior analyst notes). I produce investigative leads using probabilistic heuristics — NOT court-ready evidence. For law-enforcement or litigation use, pair this with professional tooling (Chainalysis Reactor, TRM, Elliptic) and subpoena-backed exchange data. This is not legal advice.

When to Activate

Activate this skill when the user:

• Wants to trace stolen funds from a hack, drainer, phishing victim, rug pull, or social-engineering theft across one or more chains.
• Asks to vet a counterparty address (OTC desk, market maker, exchange, vendor) for prior sanctioned or mixer exposure.
• Needs to screen for sanctioned-cluster exposure (OFAC SDN — e.g. Tornado Cash, Lazarus / DPRK wallets, named entities) on a list of addresses or a treasury.
• Is building an investigative brief or public exposé in the style of ZachXBT / Chainalysis / TRM / Elliptic public reports, or preparing a pre-subpoena lead package for counsel.
• Mentions tx hashes, addresses, mixers, bridges, peel chains, ZachXBT, Chainalysis, TRM, Elliptic, Arkham, Nansen, Lookonchain, OFAC SDN, Lazarus.

If the user only gives a single address with no context, ask for: case type, seed tx hash(es), chain(s), approximate value at risk, timeframe, and what exported flow data they can share. Do not fabricate transactions, balances, flows, or attributions.

Step 1: Intake & Scope

Anchor the investigation before any clustering. State each field explicitly in the report header.

If reporting target is law-enforcement or litigation, repeat the limits disclaimer at the top of the output and recommend professional tooling + subpoena for exchange KYC.

Step 2: Choose Heuristics by Chain Model

The chain's accounting model determines which heuristics apply. Never apply multi-input ownership to an account-based chain — it is undefined there.

2a. UTXO chains (BTC, LTC, BCH, Doge)

2b. Account-based chains (ETH, EVM L2s, Solana)

There is no MIH. A single EOA can transact infinitely. Use:

Every cluster claim must name (a) the heuristic, (b) its source data, and (c) a Low / Med / High confidence. Bare assertions are not acceptable.

Step 3: Hop-by-Hop Fund-Flow Tracing

Walk each hop and classify it. Normalize to native units and USD where a user-provided price exists; never invent a price.

Across DEX and bridge hops, track value preservation: if $1.0M enters a Uniswap router and $0.4M comes out the other side after a 60-second hop, the delta is not slippage — find the other leg or the hidden recipient.

Step 4: Handling Obfuscation Chains

The modern criminal path of 2026 chains 3–5 techniques in sequence: peel chain → bridge → DEX swap → mixer → another bridge → fresh CEX deposit. Reason about obfuscation chains, not single hops.

4a. Tornado Cash

• Sanctioned by OFAC in August 2022 for facilitating ~$455M in Lazarus laundering. Touching a Tornado Cash router post-sanction is itself a sanctioned-cluster contact and a regulatory red flag.
• One founder was convicted (Roman Storm, 2024 IRS case — facilitating money laundering and operating an unlicensed money-transmitting business).
• Mixers break the direct link between deposit and withdrawal but are partially defeatable:

State the FIFO caveat honestly: without exact timestamps and the denomination's full deposit/withdrawal list, the skill narrows the candidate withdrawal set rather than producing a single match.

4b. Other obfuscators worth flagging

• Railgun — privacy-shielded EVM transfers; defeats similar to TC apply (entry/exit address reuse, behavioral linkage). Sanctioned-adjacency considerations vary by jurisdiction; flag as 🟠 by default.
• eXch — no-KYC swap service heavily used by hack proceeds in 2024–2025; treat any contact as 🟠 / 🔴 depending on amount and case context.

4c. Bridges

Cross-chain identity is preserved by canonical-bridge tx-hash correlation (lock event on source ↔ mint event on dest) and by AMM-bridge event-log scanning. Always record the source tx hash and the destination tx hash as a linked pair; treat unmatched bridge legs as a leakage point to investigate.

Step 5: Attribution & Evidence

Attribution turns a cluster into a real-world identity. Be conservative.

5a. Allowed sources (no hallucination)

• OSINT — public GitHub commits, ENS / .eth names, social-media handles in tx memos, doxxed Etherscan name tags.
• Public labels — Arkham, Nansen, Etherscan/Tronscan, Solscan tags, Lookonchain disclosures, Rekt / DefiLlama hacks database, Chainalysis public reports.
• Sanction lists — OFAC SDN list (always recompute against current).
• Behavioral inference — hot-wallet patterns and known exchange deposit patterns where published.

5b. What is NOT allowed

• Exchange KYC — requires a subpoena. The skill cannot fabricate it.
• IP / device fingerprints — out of scope without external evidence.
• Personal identity claims without a cited public source.

5c. Confidence labels

Every attribution row in the report cites the evidence (tag source, URL, heuristic name) — no bare claims.

Step 6: Red-Flags & Severity

Tag each finding with a severity icon. Bake the severity legend into the report.

Common triggers to scan for explicitly:

• Contact with a sanctioned address (always 🔴).
• Routing through Tornado Cash / Railgun / eXch.
• Peel-chain signature (one big input → long series of small drip outputs).
• High-velocity sybil funding from a single common funder.
• Rapid chain-hop across 3+ bridges in short succession.
• Dust-poisoning — small inbound from an address whose prefix/suffix mimics a legitimate counterparty (social-engineering vector).
• Known-hack clusters — Lazarus / DPRK, Atomic / Stake / Ronin / Bybit / WazirX clusters per published attributions.

Step 7: Output Format — the Investigator's Case Report

Produce the report in this exact order so it's auditable end-to-end.

1. Header & TL;DR

Case:    <name>
Type:    <theft | rug | sanctions screen | counterparty vet | exposure | exposé>
Chain:   <BTC | ETH | multi-chain ...>
Window:  <ISO timestamp from – to>
Value:   <native amount + USD if priced>
Verdict: 🔴 / 🟠 / 🟡 / 🟢
TL;DR:   <2–3 sentences: who, what, where the funds went, total exposure>

2. Cluster table

3. Hop-by-hop flow table

4. Mixer / bridge / DEX call-outs

For each special hop, a short paragraph: what the service is, what the linkage attempt produced, the heuristics applied, and the candidate set or the matched leg.

5. Attribution table

6. IOCs

Sanctioned addresses touched. Known-bad cluster IDs. Mixer routers contacted. Phishing-drainer signatures.

7. Reproducibility log

Every step labeled with the heuristic name + the source/link a human can re-walk to verify the claim. This is what makes the report defensible.

Step 1: direct transfer — Etherscan tx <hash>
Step 2: TC deposit — TC contract router 0x910C... (sanctioned 2022)
Step 3: TC FIFO candidate — arXiv 2510.09433 method; candidate set of 3 withdrawals
        within +90 s window of the 10-ETH denomination
Cluster C-2: MIH — same tx with 4 inputs all signed together (mempool.space tx <id>)

8. Disclaimer (always)

Findings are investigative leads, not court-ready evidence. Clustering heuristics are probabilistic and have known false-positive rates. For use in law-enforcement, civil litigation, or regulatory action, pair this with professional tooling (Chainalysis Reactor, TRM, Elliptic) and subpoena-backed exchange data, and have the analysis reviewed by a qualified investigator. Not legal advice. Under the US federal Daubert standard, a methodology must be testable, have known error rates, be peer-reviewed, and be generally accepted — this skill cites those standards but does not by itself satisfy them in a courtroom.

Related Viprasol Skills

• wallet-security-review — sign-time analysis: should the user sign this transaction / approval? Phishing-signature taxonomy. Complementary to this skill (this one runs after funds have moved).
• smart-contract-audit — contract-side: was the exploited contract's code itself flawed? Pair when investigating a smart-contract exploit.
• defi-protocol-review — protocol-side risk matrix (admin keys, oracles, TVL composition). Pair when the case involves a protocol rug or a governance attack.

Disclaimer

This skill produces investigative leads using probabilistic heuristics, not court-ready evidence. The clustering and mixer-deanonymization methods cited here (multi-input ownership, change-address detection, FIFO temporal matching, bridge-receipt correlation) are drawn from peer-reviewed and industry-standard practice but each has known false-positive and false-negative rates. For law-enforcement, civil litigation, or regulatory action, pair this analysis with professional tooling (Chainalysis Reactor, TRM Labs, Elliptic) and subpoena-backed exchange KYC data, and have it reviewed by a qualified investigator and counsel. The skill cannot fetch on-chain state — it reasons only over what you provide and will say so when data is missing. Not legal advice. Not affiliated with or endorsed by Anthropic or any forensics vendor.