Terminology index

Digital Asset Claims investigation glossary

62 terms used across tracing, wallet and entity analysis, open-source research, infrastructure work and evidence reporting. Each definition links to the page that holds the full explanation, so a term carries one meaning across the site.

A

Address: The public identifier that receives and sends value on a blockchain. An address is not a person and not an account holder; it is a destination that may be controlled by an individual, a business, an exchange or an automated contract.
Attribution: The reasoned association of an address or account with a controlling party. Attribution is graded rather than asserted: it rests on observable evidence, and where corroboration is incomplete the file records the gap instead of naming a party.

B

Block: A batch of transactions committed to a chain at a specific height and time. Blocks give an investigation its timeline, because every transaction inherits the ordering and timestamp of the block that contains it.
Block explorer: A public interface for reading chain data. Explorers are useful for spot checks, but a screenshot from one is not a reconstruction: it shows a single hop with no provenance, no context and no record of how it was obtained.
Bridge: A mechanism that moves value between two chains by locking or burning on one side and releasing or minting on the other. A trace treats both sides as one connected event rather than two unrelated transactions.

C

Chain of custody: The documented record of who held a piece of evidence, when, and what was done to it. Without an intact chain, a technically correct finding still loses weight, because its handling cannot be shown.
Change address: An address that receives the remainder of a spend in a UTXO transaction. Identifying change correctly is central to clustering, because a misread change output attaches unrelated activity to the wrong party.
Clustering: Grouping addresses that behaviour suggests share a controller. Clustering produces a hypothesis with a confidence level attached, not a proof of ownership, and every heuristic used is named in the file.
Coin control: Deliberate selection of which inputs a wallet spends. Careful coin control weakens common clustering heuristics, and its presence is itself a behavioural signal worth recording.
CoinJoin: A collaborative transaction that combines inputs from several parties so outputs cannot be matched to inputs with certainty. A trace records entry and exit around the event rather than claiming a link straight through it.
Confidence grading: The scale applied to every finding, from independently verified through to insufficient evidence. Grading is what separates an observation from a claim, and it is applied consistently across every report.
Contract interaction: A transaction that calls code rather than simply transferring value. Decoding the call turns an opaque hexadecimal payload into a recorded action such as a swap, an approval or a deposit.
Corroboration: Confirmation of an observation by an independent source that does not derive from the first. Two copies of the same underlying record are one source, not two, and are treated as such.
Counterparty: The other side of a transaction or relationship. A counterparty may be a person, a business, an exchange, a service or an automated contract, and the distinction changes what the evidence can support.
Cross-chain activity: Value that moves between distinct ledgers through bridges, wrapped assets or centralised services. Following it requires reconciling different data models, timestamps and finality rules.
Custodial wallet: A wallet where keys are held by a service rather than the user. Custodial addresses often aggregate many customers, so activity there reflects the service's operations rather than one account holder.

D

Dead end: The point where observable data stops supporting further movement, for example at a custodial deposit address. A dead end is documented as a boundary of the evidence rather than bridged by assumption.
Deposit address: An address a service issues to one customer for incoming funds. Value arriving there leaves the public record and continues inside the service's own books, which are not observable from the chain.
Derivation path: The structured route used to generate addresses from one seed. Shared derivation structure can support a control hypothesis when it is visible, but it is rarely observable from chain data alone.
Dusting: Sending tiny amounts to many addresses to provoke spending behaviour that reveals linkage. Dust received by an address says nothing about its controller and is excluded from clustering unless it is spent.

E

Entity: A controlling party behind one or more addresses, accounts or pieces of infrastructure. Entities are constructed from evidence during an investigation, not read directly off a ledger.
Evidence graph: The structured model that holds observations, sources and the typed relationships between them. It keeps every finding attached to the material it came from, so a conclusion can be traced back to its basis.
Exchange: A venue that converts between assets. Exchange-controlled addresses behave differently from personal wallets, with heavy aggregation, batching and internal transfers that must not be read as user activity.
Exhibit: A numbered item of source material referenced by a report. Exhibits let a reader check a statement against the record rather than accept a summary of it.

F

Finality: The point at which a transaction is treated as irreversible on its chain. Different networks reach it differently, which matters when comparing timestamps across chains in one timeline.
Fingerprinting: Characterising a server, site or client by its observable technical traits. Matching fingerprints suggests shared setup or tooling; it does not by itself establish shared ownership.

G

Gas: The fee paid to execute a transaction. Fee funding patterns, especially who supplied gas to a fresh address, are frequently informative about control.

H

Hash: A fixed-length fingerprint of data. Transaction hashes identify events precisely, and file hashes let a later reader confirm that preserved material has not changed.
Heuristic: A rule of thumb that suggests a relationship without proving it, such as common-input ownership. Every heuristic applied in a file is named, along with the conditions under which it can fail.
Hop: A single transfer step between two addresses. Traces are measured in hops, and confidence usually declines as hop count grows unless independent corroboration is found along the way.
Hosting provider: The company operating the servers behind a site or service. Provider records place infrastructure in a jurisdiction, which shapes what a lawful request can later reach.

I

Internal transaction: Value movement triggered inside a contract execution rather than by a direct transfer. Ignoring internal transactions leaves visible gaps in an otherwise continuous flow.
IP intelligence: Analysis of addressing, routing and network ownership around an operation. It describes where systems live and how they connect, not who sat at a keyboard.

J

Jurisdiction: The legal territory in which a party, service or server sits. Jurisdiction determines which lawful routes are open to a client and their advisers once evidence is assembled.

L

Layering: Moving value through many intermediate steps to obscure its path. Layering lengthens a trace and raises the standard of corroboration needed at each stage.
Ledger: The shared record of transactions maintained by a network. Reconstruction reads the ledger directly rather than relying on a third party's summary of it.

M

Mempool: The pool of broadcast but unconfirmed transactions. Mempool observations are time-sensitive and are only usable when they were captured and preserved as they occurred.
Mixer: A service that pools and redistributes value to break the link between source and destination. A trace documents deposits into and withdrawals from a mixer without asserting a match unless independent evidence supports it.
Multi-signature wallet: A wallet requiring several keys to authorise a spend. Multi-signature structures indicate shared or institutional control and reshape what a single-controller hypothesis can claim.

N

Nonce: The sequence counter for transactions from an account. Nonce ordering fixes the true order of activity even where timestamps are coarse or ambiguous.

O

On-chain data pipeline: The controlled route by which raw chain data is collected, normalised and stored for analysis. A recorded pipeline is what makes a trace repeatable by someone else later.
Open-source intelligence: Research using lawfully accessible public material: registries, archives, published records and public web content. It never involves private accounts, credentials or intrusive access.

P

Peel chain: A pattern where a large balance moves along a chain of transactions, shedding small amounts at each step. Recognising the pattern keeps the main flow in view instead of chasing every small branch.
Preservation: Capturing source material in a fixed, hashed form at the time it is observed. Public material changes and disappears, so preservation is what allows a finding to survive its source.
Provenance: The recorded origin of a piece of evidence: where it came from, when it was captured, and by what method. Without provenance, an observation is an assertion.

R

Reconstruction: The documented rebuilding of an asset's observable path from primary data. It replaces isolated screenshots with a continuous, sourced sequence of events.
Registry record: A filing held by an official register, such as a company or domain register. Registry material is strong evidence of what was declared, which is not the same as what is true.
Rejection register: The internal record of material considered and then excluded, with the reason for exclusion. Recording what was rejected is what keeps a file honest about the shape of its evidence.
Reverse DNS: Resolution from an address back to a hostname. It offers a quick view of naming conventions across a network range and can indicate shared administration.

S

Sanctioned address: An address named on a published sanctions listing. Contact with a listed address is recorded factually, with the listing cited; the report does not extrapolate legal consequences from it.
Scope letter: The written statement of what an engagement will and will not examine, agreed before work starts. It fixes the boundary that the final report is measured against.
Sealed archive: The fixed, access-controlled set of source material underlying a delivered report. Sealing means the material behind a finding can be produced later exactly as it was captured.
Self-custody: Holding one's own keys rather than relying on a service. Self-custodied addresses reflect a single controller's behaviour more directly than custodial ones do.
Smart contract: Code deployed to a chain that executes when called. Contracts can move value on conditions their users never read, so decoding their behaviour is part of any serious trace.
Source triangulation: Testing an observation against several genuinely independent sources. Triangulation is how an item moves up the confidence scale; a single source, however convincing, cannot do it alone.

T

Timeline: The ordered sequence of events reconstructed for a case, with each entry tied to a source. A timeline is often the single most useful artefact for a reader who is not technical.
Token standard: The interface a token implements, which determines how transfers appear in chain data. Reading a transfer correctly requires knowing which standard produced it.
Transaction hash: The unique identifier of a transaction. Citing hashes rather than descriptions is what lets a reader verify each step of a trace independently.

U

UTXO: An unspent transaction output, the accounting unit of chains such as Bitcoin. UTXO handling drives most clustering heuristics on those networks.

W

Wallet: The software or hardware that manages keys and, in practice, a set of related addresses. Investigations speak about wallets carefully, because the boundary of a wallet is inferred rather than published.
WHOIS record: Registration data associated with a domain. Modern records are usually redacted, so their value lies in dates, registrar choice and historical snapshots more than in named holders.
Wrapped asset: A token representing an asset from another chain. Reconstruction links the wrap and the unwrap so that one logical flow of value stays continuous across both representations.