Attribution

The process of determining who controls an address or cluster and, where different, who ultimately benefits from it (beneficial ownership). Attribution may identify a broad entity category, such as an exchange, mixer or scam, or a specific person or organisation. It combines on-chain findings with off-chain evidence, including KYC records, test deposits, addresses published by services, labelled-entity databases, open-source intelligence, sanctions lists and data recovered from seized devices.

Control and beneficial ownership are distinct and should be stated separately. Labels from blockchain analytics providers are themselves attribution claims, often based on proprietary methods and with varying levels of transparency and reliability. They should be treated as leads to verify rather than conclusive evidence, and the provider and supporting evidence should be documented where possible. Every attribution has an author, whether an analytics provider, the service itself, a public authority, an open source or the investigator, and should be recorded with that author, its date and the evidence it rests on. An attribution adopted from a third party remains that party's claim until independently corroborated; repeating it in a report does not make it the investigator's finding.