The Three Layers of Blockchain Evidence

Core idea

Blockchain evidence is not one thing. It splits into three layers, each with its own provenance and its own bar for admissibility. Conflating them is one of the most common reasons a case that should have held together falls apart in litigation. Tag every claim by layer before you write, so each gets the corroboration and legal process its layer actually demands.

Components

• Layer 1, on-chain data. Transaction hashes, addresses, balances, block heights, timestamps, and smart-contract calls. Independently verifiable facts that a competent investigator can defend directly.
• Layer 2, analytical conclusions. Clustering, behavioural pattern recognition, typology mapping, and hop-counting through transaction chains. These derive from a tool’s methodology. Uncorroborated, they remain the tool’s output, not your evidence. Layer 2 becomes admissible evidence only through independent corroboration (for example, rebuilding a cluster by hand from a co-spend spreadsheet).
• Layer 3, attribution. Statements about who controls an address or how it maps to a real-world identity. Defensible at trial only with proper legal provenance: subpoenas, court orders to vendors, or counterparty disclosures. A vendor’s attribution label alone is enough for the investigation stage (reasonable suspicion, probable cause) but not for trial.

When to use

Whenever you package findings for court or draft a report opposing counsel will scrutinise. Classify each sentence by layer first, then supply the provenance that layer requires.

Example

“The address held 12 BTC as of block 812,453” is Layer 1 (verify it yourself). “These 47 addresses form one cluster” is Layer 2 and needs manual co-spend corroboration to become your evidence. “The cluster is controlled by a named exchange customer” is Layer 3 and needs a subpoena or court order to the exchange.

Related

Separate On-Chain Fact from Analytical Inference, Fact Witness vs Expert Witness, Calibrate Your Testimony Language, Court-Tested Attribution Evidence Types, Glass Box Attribution