What evidence may connect a wallet to a person?¶

A wallet may be connected to a person through provider records, device evidence, communications, possession of key material and demonstrated control.

Avoid the dangerous assumption¶

The dangerous assumption is that one address found near a person’s name or device proves personal ownership of the wallet.

A custodial provider may link deposit or withdrawal activity to a verified customer account.

A device may contain wallet software, transaction history, seed phrases, private keys, saved addresses or notifications.

Communications may show the person requesting payment to an address, discussing balances, sending transaction hashes or instructing transfers.

Possession of a hardware wallet, backup phrase or private key can support potential technical control.

A controlled test transaction or cryptographic signature may sometimes demonstrate current control, but specialist and legal considerations apply.

No single category should be overstated.

A wallet may be shared, transferred, compromised or restored on several devices.

A person can also possess an address without controlling it, for example where it was copied from a victim, merchant or exchange.

Establish timing carefully.

Evidence of control today does not automatically prove control during an earlier transaction.

Compare wallet activity with the person’s devices, accounts, communications, locations and financial behaviour.

Identify whether they benefited from the assets, directed their movement or merely acted as an intermediary under another person’s control.

When reporting, distinguish linkage, technical control, historical control, ownership and benefit.

State the evidential basis for each conclusion.

Operational takeaway¶

Attribute a wallet to a person through converging provider, device, key, communication and control evidence, with timing and alternative explanations addressed explicitly.