What Data a Blockchain Analyst Needs for an Initial Incident Assessment

A public blockchain provides many facts, but it doesn't sign them with ready-made conclusions. To get started, an entry point is usually enough: tx hash, network, asset, amount, and a short timeline. A good analysis begins exactly at this boundary.

The main thing to know right away: A good investigation must be reproducible: every significant conclusion has a tx hash, an attribution source, and a clear explanation of how that conclusion was reached.

What is visible in the blockchain

To get started, an entry point is usually enough: tx hash, network, asset, amount, and a short timeline. For a practical review, it's important not to stop at a general description of the problem: you need to tie it to specific transactions, time, network, and available sources.

To get started, an entry point is usually enough: tx hash, network, asset, amount, and a short timeline. At the same time, any entity name — exchange, bridge, mixer, swap service — must be tied to an attribution source. The blockchain itself does not store signatures with owners' names.

How to break down the task step by step

1. Start with a specific starting point: a tx hash or a verified address.
2. Clarify the network, asset, amount, and time interval.
3. Build a sequence of operations and note transitions between networks, DEXs, bridges, and centralized services.
4. Separate on-chain fact from external attribution: a label like "exchange" or "swap service" must have a source.
5. Formulate the conclusion so that another specialist can re-verify the route.

What source data is needed

For an initial review, prepare the data in a single message or file — this reduces the risk of losing an important detail:

• tx hash
• addresses
• network and asset
• time interval
• short context: what exactly needs to be established

Where mistakes are most common

• Don't assume an address is automatically tied to a specific individual.
• Don't present a probabilistic link or heuristic as a proven fact.
• Don't substitute an investigation with a single AML risk score.

Important: an analytical link must have a confidence level. Where the data only supports a hypothesis, this must be stated explicitly.

When a full review is needed

If the answer will be used not just "for yourself" but for a lawyer, a company, an exchange, or further action, it's better to document the route with a table, a graph, and attribution sources. This makes the result clear and verifiable.

Frequently asked questions

Can a conclusion be made from a single screenshot?

Usually not. A screenshot is useful as context, but significant conclusions are better confirmed with source on-chain data and verifiable sources.

Is wallet access needed?

For analyzing public transactions, usually not. A seed phrase and private keys are not needed.

What is the result of an investigation?

Depending on the task — a route, a transaction table, a graph, service attribution, conclusions, and clearly stated limitations.

In short

To get started, an entry point is usually enough: tx hash, network, asset, amount, and a short timeline. A useful result is not just a picture, but a verifiable chain of facts with clear sources and limitations.