Guglielmo Anfossianfossi.systemsBook a call

Transfer

An on-chain movement of value between addresses or accounts. In the account model, the transaction's native-asset value is explicitly recorded, while internal transfers of native assets executed by smart contracts are reconstructed through transaction execution traces. Token transfers are commonly represented by contract-emitted events, but these events are not always a reliable record of balance changes: malicious contracts can emit misleading logs, and some tokens alter balances in ways that do not correspond directly to standard transfer events. The contract's state is the authoritative source for token balances.

In the UTXO model, a transaction can consume multiple inputs and create multiple outputs without specifying which input funded which output. Individual flows are therefore analytically inferred. In both account and UTXO models, when an address or transaction combines illicit and legitimate funds, the protocol does not necessarily identify which funds are subsequently spent. The amount of illicit value attributed to a transfer depends on the tracing method applied, such as FIFO, proportional allocation or taint-based methods. These methods are analytical conventions, not explicit on-chain facts.

Essays

  • The Transfer That Never Happened (Delta-Neutral Siphoning)

    “A trace of the funds comes back clean: deposits, trades, settlements, no transfer to anyone.”

    · Methods · 5 min read

  • A Finding Stands Without You

    “The record part is a set of transfers into one address.”

    · Methods · 7 min read

  • Two Sweeps Pointed at the Same Address

    “One transfer, out of an address that two parties can sign for, and the only thing left to win was position in the block after the credit.”

    · Investigations · 7 min read

  • The Desk Opens on Monday

    “I had sent an exchange the path as I had built it, with the bridge transfers evidenced from the transaction payloads, which is where the proof actually sits.”

    · Methods · 7 min read

  • A Scam Made to Measure

    “On-chain it reads as a single transfer, a row in a spreadsheet.”

    · Victims · 5 min read

  • What a USDT Recovery Actually Looks Like

    · Investigations · 5 min read

  • Guess Who? (On-chain)

    “So I laid its transfer history against his activity on X: the timing of each sale, the time and context of his posts, who held it when.”

    · Investigations · 3 min read