Blockchain as evidence: what does an on-chain transaction prove — and what does it not prove?

Abstract

Public blockchains provide distributed, independently verifiable and tamper-resistant records, making them valuable sources of evidence. Yet an on-chain record does not, by itself, answer questions of identity, intention, beneficial ownership or contractual context. A transaction can establish that a state transition was accepted by the network according to its protocol; linking an address to a person requires additional evidence. This article distinguishes directly observable facts from inferences, discusses signatures, timestamps, confirmations, smart contracts, bridges and off-chain data, and proposes a forensic method for presenting blockchain evidence without turning pseudonymity into false certainty.

Keywords: blockchain; digital evidence; on-chain transaction; wallet; attribution; blockchain forensics.

1. Blockchain’s strength lies in the record — not in every inference drawn from it

NIST describes blockchain as a distributed ledger in which transactions are shared and protected by consensus and cryptographic mechanisms.[1] For evidence, this offers an important advantage: historical records can often be independently reproduced by different nodes and tools.

But two layers must be separated:

on-chain fact: what can be reproduced directly from the network’s state and history;

off-chain attribution: the link between an on-chain datum and a person, company, contract, device or external event.

The first layer can be exceptionally strong. The second frequently depends on hypotheses and external corroboration.

2. What a public transaction can usually establish

Depending on the network, an examiner may verify:

• transaction identifier/hash;

• block inclusion;

• relative order and confirmation/finality state;

• source and destination addresses or accounts;

• transferred assets and values;

• fees;

• input data;

• smart-contract calls;

• emitted events;

• state changes;

• execution status;

• block time according to the protocol;

• contract code and implementation where available;

• links to prior and subsequent transactions.

These facts may be viewed through an explorer, library or full node. For critical conclusions, however, a forensic workflow should be reproducible and should not depend solely on a third-party web interface.

3. A valid signature demonstrates key control — within a defined context

On many networks, a valid transaction includes cryptographic authorization tied to a private key. That supports an important technical conclusion: a person or system capable of producing the required signature authorized the transaction according to the protocol rules.

It does not automatically identify the natural person who operated the key.

The key may reside in a software wallet, hardware wallet, custodial exchange, MPC system, institutional vault, multisig contract or compromised device.

Thus “address A produced a valid authorization” and “person X knowingly performed the operation” are different propositions.

4. An address is not civil identity

Public blockchains are generally pseudonymous rather than necessarily anonymous. Addresses can be followed over time but normally do not contain a civil name.

Attribution may come from exchange/KYC data, public disclosures, seized devices, seed phrases, login records, withdrawal records, contracts, messages, analytics tags or transaction heuristics.

The blockchain-forensics literature documents address clustering and tagging while also highlighting uncertainty, limited ground truth and privacy-enhancing techniques.[2][3]

A forensic report should therefore label attribution as direct, corroborated or heuristic.

5. A block timestamp is not an absolute forensic clock

Block time is useful for chronology, but it should not automatically be treated as a timestamp with the same precision and semantics as a synchronized application log.

Protocols use different time rules. Depending on the network, a producer proposes timestamps within protocol constraints. Correlation with off-chain evidence should consider time zones, block intervals, finality, clock accuracy of external systems, and the difference between transaction broadcast, inclusion and confirmation.

6. Smart contracts: the visible transaction may only be the beginning

On programmable networks, the economic result may depend on internal calls, emitted events and state changes.

A transaction can execute a DEX swap, call an aggregator, deposit into a bridge, mint a wrapped asset, trigger a flash loan or interact with an upgradeable proxy.

Looking only at from, to and value can therefore be misleading. The examiner may need to analyze calldata, logs, state, implementation versions and protocol semantics.

For upgradeable contracts, the same address can execute different code at different historical blocks. A forensic examination must determine which implementation was active at the relevant time.

7. Bridges and multiple networks complicate linear narratives

Modern blockchain forensics increasingly involves cross-chain flows. Research from 2025 and 2026 proposes methods to correlate events between EVM networks and integrate Layer 1, Layer 2 and bridge activity.[4][5][6]

A statement such as “the asset left wallet A” may therefore describe only the first step. The path may involve lock/mint, burn/release, wrapped assets, swaps, relayers, DEXs and L2 settlement.

Each step should be explained technically rather than represented as a generic arrow on a graph.

8. Blockchain preserves the record, not its legal meaning

A blockchain may establish that a token moved. It does not by itself decide whether there was contractual authorization, defective consent, key compromise, fraud, legal ownership, valid representation of an off-chain asset or breach of a custody duty.

Those questions depend on documents, conduct and legal analysis beyond the protocol layer.

This boundary is particularly important for experts: the report should explain technology and verifiable technical facts without replacing the court’s legal analysis.

9. How to preserve on-chain evidence properly

Blockchain persistence does not eliminate the need for forensic documentation.

A reproducible examination should record:

• network and chain ID;

• block number and hash;

• transaction hash;

• relevant contract addresses;

• token contract and decimals;

• acquisition/query method;

• software/library and version;

• node or endpoint used;

• collection time;

• raw data;

• transformations;

• hashes of exported files;

• screenshots only as illustrations, not as the sole source.

Where off-chain records are involved, ordinary chain-of-custody principles still apply. ISO/IEC 27037 provides a useful framework.[7]

10. Explorers are useful — but should not become black boxes

Block explorers are excellent research tools. Important conclusions should nevertheless be reproducible from underlying data.

Relevant questions include whether a contract was decoded correctly, whether entity labels are proprietary, whether token units were converted correctly, whether historical fiat values came from an external price source, and whether the provider’s methodology is documented.

The examiner should separate blockchain data from analytical enrichment.

11. A useful hierarchy of assertions

Level 1 — direct observation

“Transaction X was included in block Y and transferred Z units of token T.”

Level 2 — protocol interpretation

“The call executed a swap function and emitted events A and B.”

Level 3 — corroborated attribution

“The address was linked to an identified exchange account by independent records.”

Level 4 — heuristic attribution

“The address cluster is consistent with common control under heuristic X, subject to stated limitations.”

This separation improves transparency.

12. Current regulatory context

International virtual-asset frameworks increasingly emphasize licensing or registration of VASPs, customer due diligence, recordkeeping and the Travel Rule. FATF implementation updates provide a cross-jurisdiction reference point for these off-chain records, which can become important attribution evidence when correlated with blockchain data.[8][9]

Internationally, FATF published 2026 updates covering virtual assets, stablecoins, unhosted wallets and DeFi.[10][11]

These rules do not change blockchain cryptography, but they increase the relevance of custodian records, governance and off-chain data that can be correlated with public ledgers.

13. Conclusion

An on-chain transaction can provide exceptionally verifiable evidence of what happened on the network. Its limits appear when address is converted into person, signature into intent or transfer into legal conclusion.

Good blockchain forensics works precisely at that boundary. It preserves the rigor of the cryptographic record, documents each inference and declares uncertainty where the technology does not provide a direct answer.

A useful rule is: the blockchain may be immutable; the interpretation is not. Method, attribution and context must therefore be as auditable as the transaction itself.

13A. Reproducibility of blockchain analysis

Ledger immutability does not eliminate the need for a chain of custody for the analytical process. Node source, parsing scripts, clustering rules, external tags, APIs, software versions, and query parameters should be documented so that another expert can understand and scrutinize how raw ledger data became an evidentiary conclusion. ISO/IEC 27042 is a useful reference for this requirement.

References

1. NIST. Yaga, D. et al. 

   Blockchain Technology Overview — NISTIR 8202

   . https://doi.org/10.6028/NIST.IR.8202

2. Atlam, H.F.; Ekuri, N.; Azad, M.A.; Lallie, H.S.

   Blockchain Forensics: A Systematic Literature Review…

   . Electronics, 2024. https://doi.org/10.3390/electronics13173568

3. Nicholls, J. et al. 

   The next phase of identifying illicit activity in Bitcoin

   . 2024. https://doi.org/10.1002/nem.2259

4. Yan, T.; Huang, C.; Tessone, C.

   Tracing Cross-Chain Transactions Between EVM-Based Blockchains

   . Ledger, 2025. https://doi.org/10.5195/ledger.2025.433

5. Tippe, P.; Deckers, C.

   Unmixing the mix

   . 2025. https://doi.org/10.1016/j.fsidi.2025.301876

6. A Full-Node Blockchain Forensic Framework for Cross-Layer Virtual Asset Tracking

   . 2026. https://www.mdpi.com/2079-9292/15/17/3849

7. ISO/IEC.

   ISO/IEC 27037:2012

   . https://www.iso.org/standard/44381.html

8. FATF. Seventh Targeted Update on Implementation of the FATF Standards on Virtual Assets/VASPs. 2026. https://www.fatf-gafi.org/en/publications/Fatfrecommendations/targeted-updated-virtualassets-vasps-2026.html

9. FATF. Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers. https://www.fatf-gafi.org/content/dam/fatf-gafi/guidance/Updated-Guidance-VA-VASP.pdf

10. FATF.

    Seventh Targeted Update on Virtual Assets/VASPs

    . 2026. https://www.fatf-gafi.org/en/publications/Fatfrecommendations/targeted-updated-virtualassets-vasps-2026.html

11. FATF.

    Targeted Report on Stablecoins and Unhosted Wallets

    . 2026. https://www.fatf-gafi.org/en/publications/Virtualassets/targeted-report-stablecoins-unhosted-wallets.html

• ISO/IEC.

  ISO/IEC 27042:2015 — Guidelines for the analysis and interpretation of digital evidence

  . https://www.iso.org/standard/44406.html

Editorial note: interpretation must be specific to the network, block, contracts and architecture actually involved.