What device and login records may assist cryptocurrency attribution?¶

Provider access records can identify the route and session associated with account activity. One IP address, device name or subscriber does not by itself identify the user.

Providers record overlapping signals¶

Useful fields include time, IP-related data, endpoint and operating system, browser or application, session ID, authentication, failed logins, recovery, registration and alerts. Initiation and approval may occur on different endpoints, while notifications can appear elsewhere.

Seek convergence¶

Preserve original identifiers rather than friendly names. Account for shared, reassigned or obscured addresses and endpoints retained after transfer or replacement. Compare provider data with device artefacts, communications, location and behaviour.

Report what the record associates with the event and identify the human user only where the wider evidence supports it.