How should cryptocurrency evidence be worded?¶

Cryptocurrency evidence should be worded by separating the blockchain record, wallet address, provider account, device and person.

Avoid this assumption: That saying an address “belongs to” a suspect is justified because it appears in a transaction or on a device. Start with what the blockchain records.

Identify the network, asset, transaction hash, sending and receiving addresses, amount, fee, block and confirmation status.

State that value was recorded as moving between addresses.

Do not say that one person sent money to another unless additional evidence supports the identity and control of both sides.

Where an exchange links an address to a customer account, describe that provider attribution and the relevant time period.

Where a device contains wallet software, key material or transaction history, explain what that evidence shows about possible or demonstrated control.

Use terms such as linked to, attributed to, associated with or controlled by according to the strength of the evidence.

Avoid treating tracing-tool labels or address clusters as confirmed identity without corroboration.

Distinguish current control from historical control.

A person who can access a wallet today may not have controlled every earlier transaction. Shared wallets, imported seed phrases and custodial services can further complicate that conclusion.

Also distinguish movement, ownership, benefit and criminal knowledge.

When uncertainty remains, state it directly.

When reporting, identify what is observed on-chain, what comes from provider records and what is analytical inference.

Operational takeaway¶

Word cryptocurrency evidence as recorded movement between addresses and explain separately the provider, device, key and contextual evidence supporting any person-level attribution.