Glossary of blockchain investigation terms
Short, practical definitions of the terms I use when tracing funds. Each entry links to the essays where the technique shows up.
This glossary is a work in progress. More terms and detail will be added over time.
Peel chain
A peel chain is a sequence of transactions where part of a UTXO's value is repeatedly peeled off while the remaining value continues to a new output. The resulting chain is common in ordinary Bitcoin transactions, so the pattern alone, unlike what some of my colleagues claim, is not evidence of laundering.
Chain-hopping
Moving funds across different blockchains, usually through bridges or swap services, to complicate tracing and exploit gaps between tools and datasets.
Cross-chain bridge
A protocol that moves or represents value across blockchains, using mechanisms such as locking and minting, or burning and releasing assets. For investigators, it is a hand-off point where the trace has to be reconstructed across a different chain.
Coin mixer
A service or protocol designed to obscure the relationship between cryptocurrency inputs and outputs, typically by pooling or otherwise coordinating funds from multiple users. CoinJoin is a related transaction technique in which multiple users combine inputs and outputs in a single Bitcoin transaction.
Nested service
A business that operates through an account at a larger exchange or other VASP, causing its transactions to appear under addresses controlled by the host service.
Address clustering
Grouping addresses likely controlled by the same entity, using heuristics such as common-input ownership and change-address detection. These heuristics are probabilistic and can produce false positives.
Drainer
Malicious software or smart-contract infrastructure, often distributed as a service, that tricks victims into authorizing actions that allow an attacker to transfer assets from their wallet.
Address poisoning
A scam where an attacker sends a small or zero-value transfer from an address designed to resemble one the victim has previously used, hoping the victim copies the poisoned address from their transaction history in a future payment.
Know your transaction (KYT)
Monitoring and screening blockchain transactions for risk indicators such as exposure to sanctioned addresses or entities, darknet markets, scams or stolen funds. KYT systems are used to assess transactions before, during or after funds move.
Freeze request
A request asking an exchange, custodian or stablecoin issuer to restrict or freeze funds believed to be stolen or otherwise subject to legal action. The request may be supported by law-enforcement documentation, a court order or other evidence, depending on the jurisdiction and provider.
Source of funds
An analysis of where the funds involved in a transaction or account originated. In blockchain investigations, it can involve tracing incoming transactions to identify the entities, activities or events that generated the funds.
Travel Rule
A FATF standard requiring virtual asset service providers to collect and transmit identifying information about the originator and beneficiary of qualifying virtual asset transfers. Its legal implementation varies by jurisdiction.