Court-Tested Attribution Evidence Types

Core idea

Four distinct attribution mechanisms tested in landmark cases, each rated by evidentiary strength. Strength key: Definitive (consistently upheld across multiple jurisdictions), Corroborative (strong when combined with other evidence types), Indicative (establishes reasonable suspicion, not attribution alone).

Components

• Exchange KYC records via subpoena (strength: 5/5, Definitive): when a trail terminates at a centralised exchange (Coinbase, Binance, Kraken), the exchange holds KYC records binding a real identity to the deposit address; the gold standard. Requires formal legal process to compel; accepted across US, UK, EU. Cases: In re Coinbase (N.D. Cal. 2017, IRS summons for ~14,000 customers); US v. Lichtenstein (D.D.C. 2023, $3.6B Bitfinex-hack seizure, then the largest in DOJ history); FCA v. BitMEX operators (2021).
• Common Input Ownership Heuristic / CIOH (strength: 4/5): multiple inputs in one Bitcoin transaction are likely controlled by one entity, enabling clustering of hundreds of addresses. Referenced by Satoshi Nakamoto in the 2008 Bitcoin whitepaper. Key limitation: CoinJoin transactions deliberately pool unrelated inputs to defeat CIOH, investigators must identify and exclude these and document the exclusion explicitly, or face a damaging cross-examination challenge. Cases: US v. Ulbricht (S.D.N.Y. 2014, Silk Road); US v. Gratkowski (5th Cir. 2020, affirmed blockchain analytics as reliable methodology).
• Self-disclosed addresses & forum evidence (strength: 5/5, Definitive): wallets posted publicly by a subject under a username tied to their real identity are among the strongest signals available. Courts admit archived web evidence when collected with a documented chain of custody, use Wayback Machine, archive.ph, and local archiving tools, and record SHA-256 hashes of evidence files at time of capture. Cases: US v. Ulbricht (Ross Ulbricht’s 2011 “altoid” BitcoinTalk post listing his personal Gmail, found by IRS agent Gary Alford); UK NCA Bitcoin Fog investigation.
• IP address & transaction broadcast origin (strength: 3/5, Corroborative): a transaction first broadcasts from a specific IP; law enforcement can monitor the P2P network or request ISP records for the first-broadcasting IP. Volatile: UK ISPs retain connection records 12 months under the Investigatory Powers Act 2016, so secure a preservation order at the outset before the data disappears. VPN/Tor use can defeat it. Cases: US v. Sterlingov (D.D.C. 2023, Bitcoin Fog, used Mt. Gox IP logs; convicted, 12.5 years in 2024); US v. Ulbricht (node IP analysis).

When to use

When assembling a court-ready evidence package and deciding which attribution mechanisms will hold up and what corroboration or legal process each requires.

Example

A trail ending at a Binance deposit address is escalated via subpoena to obtain KYC records (Definitive), while an IP-broadcast lead is preserved immediately with a preservation order before the 12-month retention window closes.

Related

Crypto Address Attribution Process, Attribution Confidence Levels, Commercial Analytics & the Daubert Challenge, Advanced Attribution Techniques