MSTR Cat

Crypto Law/Level IX · Death, divorce and disputes/9.3 Going to court/Lesson 4

Blockchain evidence and tracing

How on-chain data gets into court: authenticating records, expert tracing software, the Bitcoin Fog rulings on Chainalysis Reactor, and an English case where a tracing report failed.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Collect the raw facts yourself at no cost: transaction hashes, addresses, amounts, block times and dated screenshots from a public block explorer; any later tracing report must start from them.
  2. Authenticate records by certificate instead of a paid live witness under Federal Rules of Evidence 902(13) and 902(14); the other side must get advance notice and can still dispute what the record means.
  3. In Vermont, 12 V.S.A. §1913 makes a blockchain record self-authenticating with a qualifying sworn declaration, saving expert time on authenticity; it does not prove who controls an address.
  4. Get exchange records by subpoena or court order before paying for analytics; they link addresses to identities and test any trace against independent data.
  5. Pay for an expert tracer only when stakes justify it, and insist on a stated method: since the 2023 amendment, Rule 702 requires reliability shown more likely than not; D’Aloia v Persons Unknown (2024) shows a weak trace failing.

MaterialsFederal Rules of Evidence 702, 901 and 902(13)-(14)United States v. Sterlingov, No. 24-3161 (D.C. Cir. 25 September 2026)D’Aloia v Persons Unknown Category A [2024] EWHC 2342 (Ch)A block-explorer page for one of your own transactions

Wonder

  1. Is a public blockchain record automatically accepted as evidence?
  2. Can a court rely on a private company’s tracing software?
  3. What happens when stolen coins are mixed with other people’s coins?

Explore

  1. A public blockchain records every transfer between addresses, with amounts and times, and anyone can read it on a block explorer, a website that displays the ledger. That makes crypto unusually traceable (lesson 1.1.5), but a court still needs two things: proof that a record is what it claims to be, and evidence linking addresses to real people or businesses. In US federal courts, Rule 901(a) of the Federal Rules of Evidence requires ‘evidence sufficient to support a finding that the item is what the proponent claims it is’, and Rule 901(b)(9) accepts evidence describing a process or system and showing that it produces an accurate result.
  2. Amendments in 2017 added Rules 902(13) and 902(14). They let a party authenticate a record generated by an electronic process, or data copied from a device or file by a ‘process of digital identification’, with a certificate from a qualified person instead of a live witness, after giving the other side notice. This settles authenticity only; the opponent can still dispute what the record means. Some states went further. Vermont’s statute, 12 V.S.A. section 1913, makes a digital record registered in a blockchain self-authenticating when accompanied by a sworn declaration stating, among other things, when the record entered the blockchain and when it was received from it.
  3. Linking addresses to people is where experts come in. Analytics software groups addresses into ‘clusters’ likely controlled by one entity. One method is the co-spend heuristic: addresses used together as inputs to a single bitcoin transaction probably share an owner, because each input needs its own private key. In the prosecution of Roman Sterlingov for operating the Bitcoin Fog mixer, the defence called Chainalysis Reactor ‘junk science’ that lacked peer review and a known error rate. In a 2024 opinion, Judge Randolph Moss admitted the evidence under Rule 702, noting that results could be checked against public blockchain data with ‘a pad of paper, a pencil, and hours of work’.
  4. A jury convicted Sterlingov in March 2024, and on 8 November 2024 he was sentenced to 12 years and six months in prison. On 25 September 2026 the D.C. Circuit affirmed the convictions and sentence, upholding the admission of testimony based on Reactor although the experts conceded it had not been peer reviewed and its error rate was unknown. It also upheld the refusal to require production of Reactor’s source code; instead Chainalysis had disclosed its heuristics and assumptions to defence counsel and experts under a protective order. A ruling that a tool is admissible still leaves each particular trace open to challenge before the jury.
  5. Civil cases show how tracing can fail. In D’Aloia v Persons Unknown Category A, decided on 12 September 2024, a man defrauded through a fake brokerage website sued the Thai exchange Bitkub, alleging his USDT reached a wallet it controlled. The English High Court accepted that USDT is property that can be traced, but found he had not shown that any of his funds reached that wallet. The judge described his expert’s evidence as ‘chaotic and, ultimately, contradictory’. He also held that tracing at common law cannot pass through a mixed fund, so only equitable tracing was available, and that the expert’s ‘first in, first out’ method was open to challenge.
  6. The point for anyone relying on tracing is that a chart is not proof. A court will ask which method was used, why it fits the facts, what assumptions were made at each step, and whether the result was checked against exchange records obtained by subpoena or court order (lesson 4.3.3). A practical check: open one of your own transactions on a block explorer and write down the transaction hash, the sending and receiving addresses, the block time and the amount, with a screenshot and the date you captured it. Those are the raw facts that any tracing report must start from and that an opponent can verify independently.

Key facts

  • Federal Rule of Evidence 901(a) requires evidence sufficient to support a finding that an item is what its proponent claims it is.
  • Federal Rules of Evidence 902(13) and 902(14), added in 2017, allow certain electronic records and copied data to be authenticated by a qualified person’s certificate.
  • Vermont’s 12 V.S.A. section 1913 makes a blockchain record self-authenticating when accompanied by a qualifying sworn declaration.
  • In United States v. Sterlingov, Judge Randolph Moss admitted blockchain tracing evidence based on Chainalysis Reactor under Rule 702 despite a challenge to its reliability.
  • Roman Sterlingov was sentenced on 8 November 2024 to 12 years and six months in prison, and the D.C. Circuit affirmed on 25 September 2026.
  • In D’Aloia v Persons Unknown Category A (2024) the English High Court held USDT traceable as property but found the claimant had not proved his funds reached the exchange wallet he sued over.

Exercise nine, six, three, one

9CollectList up to 9 pieces of on-chain or off-chain evidence that could show where a particular crypto transfer of yours went, such as hashes, addresses, screenshots or exchange statements (some lists are shorter).
6ClusterSort them into 6 groups: raw blockchain data, exchange or platform records, messages and emails, screenshots, expert or software analysis, and records you do not yet have.
3DistillReduce the 6 groups to 3: evidence anyone can verify independently, evidence that depends on someone’s method or assumptions, and evidence you would need a court order to obtain.
1CrystallizeWrite 1 sentence explaining why a public blockchain record still needs an expert or a witness before it proves who took the coins.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS