Guess Who? (On-chain)
He had a profile picture. That was the whole case.
An X account. One avatar, an NFT, the kind people wear like a face. Hair, eyes, skin, a colored background. Find the person behind it.
No wallet from the handle. The username mapped to nothing: no DeBank, no linked profile, no thread anywhere online that tied it to an address. Just a picture someone had chosen to be.
Let me show you why that’s enough, in plain terms.
For this kind of web3 collectable, every NFT is a recipe. A set of traits written into metadata: hair this color, eyes that color, skin this tone, those glasses, that background. The picture is the output. The metadata is the source seed. So if I could read the picture as a list of traits, I could turn a face back into a query. A bit like playing Guess Who.
Simple. Except for one thing.
The avatar wasn’t from a collection I could name. It was as if I couldn’t even start the game of Guess Who, because I didn’t know which version of the board my opponent was playing on. And it could just as easily have been a derivative. There are services that, for a fee, modify your NFT: the Bored Ape Yacht Club, for example, has a spin-off that “zombifies” yours, spitting out an unofficial variant that carries the same metadata as the original. And this can go several steps deep, a knockoff of a knockoff, and so on. So the picture could look like something famous, but actually come from somewhere obscure.
That was the wall. No handle-to-wallet. No nameable collection. The point where most people write “anonymous, no entry point” and close the file.
So I stopped trying to trace him. And I asked a different question.
Not “where is his wallet?” but “who is standing next to him?”
That was the crack in the wall.
Because nobody collects alone. An NFT community may intersect with other NFT communities: the same people hold overlapping sets. He’d scrubbed himself clean, but if I could find even one other wallet from his interactions, or from the accounts replying to his posts, I could find people holding the same kinds of collections he did, even behind a completely different profile picture.
So I rolled up my sleeves. Pure elbow grease.
I went through the accounts interacting with him (the replies, the mutuals, the people in his orbit), hunting for any fingerprint that led to a real address. I pulled a handful of wallets out of the noise, across multiple chains. Then I took each one to OpenSea (EVMs) or Magic Eden (Solana) to read its collections, and to open block explorers to see every NFT it had ever touched, even the ones held for a single day, even inside a narrow window.
Bingo.
In one neighbor’s history sat an NFT built like the one I was chasing. Same structure, same skeleton. That handed me the collection.
Now I had the real thing. I could finally play Guess Who with the suspect. So I filtered it by my target’s metadata, the exact traits from his avatar, and there he was. His specific NFT. One token, out of the whole set.
But a token still isn’t a person.
This one had changed hands. Bought, sold, passed down a chain of owners. So I laid its transfer history against his activity on X: the timing of each sale, the time and context of his posts, who held it when. One address in that chain lined up with the man behind the avatar. Not a guess. A match between the blockchain and the social network’s timeline.
That became the anchor. From there, everything downstream came loose.
He erased every line from his name to his wallet. The handle led nowhere. The collection had no name.
He just forgot that you collect in a crowd, and the crowd holds the same things you do.
Also published on LinkedIn.