On-Chain vs Off-Chain Analysis: How the Two Layers Work Together
On-chain analysis reads the public ledger to show where crypto moved and which wallets act together. Off-chain analysis works with evidence the ledger never records, to show who controls those wallets. On-chain vs off-chain analysis is not a choice between tools: one traces the money, the other attributes the entity, and most cases need both.
Two of the best-known US crypto cases show the split clearly.
In June 2021, the Justice Department announced it had seized 63.7 bitcoin from the Colonial Pipeline ransom. According to the DOJ, investigators reviewed the Bitcoin public ledger, tracked multiple transfers and identified the address that received the proceeds. That is on-chain analysis doing exactly what it is built for.
In February 2022, the Department announced what it called its largest financial seizure ever: more than 94,000 bitcoin stolen in the 2016 Bitfinex hack. The decisive step was not on the ledger. After court-authorized search warrants of online accounts, special agents found files containing the private keys to the wallet that had received the stolen funds, as the DOJ press release describes. The trace said where the money was. Off-chain evidence said who held it.
What is on-chain analysis?
On-chain analysis is the study of public blockchain data to follow funds and group addresses that appear to share an owner. It answers "where did the money go?" with a precision traditional finance rarely offers, because every confirmed transaction is permanent and public.
Its core techniques are well established. Researchers showed more than a decade ago, in the 2013 paper A Fistful of Bitcoins, that addresses can be clustered by inferred shared control and that clusters can be named by interacting with known services. Modern blockchain analytics builds on the same idea: cluster the addresses, tag the known services, then follow the flows between them.
When a trace reaches a regulated exchange, the on-chain work produces something concrete: a deposit address tied to a verified customer account that legal process can reach. That is the highest-quality answer an investigation can get, and it is why the on-chain layer always comes first.
What is off-chain analysis?
Off-chain analysis covers every source of evidence that is not written on the blockchain. That includes exchange account records obtained through legal process, seized accounts and files, open-source intelligence, and off-chain attribution data that links wallets to the real-world entities that control them.
The Bitfinex case is a good illustration of the first two. The money trail ran through what the DOJ called "a labyrinth of cryptocurrency transactions", but the keys sat in an online account. No amount of ledger analysis would have surfaced that file.
The off-chain attribution layer is the newest part of this toolkit, and it is the layer Addressable Investigations built Spectra around. It does not depend on any on-chain connection between wallets, so it persists as actors change wallets. What it produces is leads and digital evidence: investigative starting points when the chain goes quiet, region-level attribution that narrows the jurisdiction, and time-stamped records structured for legal proceedings.
How do on-chain and off-chain analysis compare?
On-chain analysis is strongest at reconstructing money flows; off-chain analysis is strongest at attributing wallets to entities. The two answer different questions, read different data and fail in different places.
On-chain analysis
Question it answersWhere did the funds go?
What it readsThe public ledger: transactions, addresses, timestamps
Strongest atFund-flow maps, clustering, exchange touchpoints
Stops atMixers, fresh wallets, cross-chain hops, private handoffs
OutputA fund-flow map and exchange leads
Off-chain analysis
Question it answersWho controls the wallet?
What it readsEvidence beyond the ledger: records, seized accounts, OSINT, attribution data
Strongest atConnecting wallets to entities and jurisdictions
Stops atContinues past the on-chain walls
OutputLeads and digital evidence for the case file
The most useful way to read the comparison is by failure point. On-chain analysis stops where the wallet loses its last link to a known entity. Off-chain analysis does not start from that link, so it is unaffected when the link is removed.
Why can't on-chain analysis close a case on its own?
On-chain analysis cannot close a case on its own because attribution on the ledger depends on a connection to something already identified, and laundering is designed to remove that connection.
The Bitfinex complaint lists the techniques, according to the DOJ: fictitious identities to open online accounts, automated transactions, deposits and withdrawals across many exchanges and darknet markets to break up the fund flow, and conversion into anonymity-enhanced currencies, a practice known as chain hopping. Each one attacks the ledger's ability to tie a wallet to a person.
We mapped where this happens in practice in When Crypto Tracing Hits a Wall: a mixer, a fresh wallet, a cross-chain hop and a handoff that never touches a regulated venue. At each of those four walls the ledger still shows movement. It stops showing ownership.
When should investigators bring in off-chain analysis?
Investigators should bring in off-chain analysis when the on-chain trace stops producing a link to a known entity, not before. The ledger is free, permanent and fast to query, so it should always be worked first.
- Trace the ledger. Map the fund flow, cluster the addresses and pursue any exchange deposit where one exists.
- Name the wall. Note where attribution stopped: mixer, fresh wallet, bridge or private handoff.
- Query the off-chain layer. Run the wallets that stalled. If they share an attribution signal, the case continues with a lead and a likely jurisdiction.
- Confirm through legal process. Leads become evidence through the usual route: records requests, warrants and the case file.
Teams running criminal investigations, token recovery and corporate investigations follow the same order. The pig butchering investigation playbook shows it applied to a single case type.
What does a case file look like with both layers?
A case file built on both layers answers both questions: where the funds went, and who controls the wallets at the end of the trail. Each layer covers the other's blind spot.
The on-chain section documents movement: transactions, clusters, exchange touchpoints and the point where the trail went cold. The off-chain section documents attribution: which wallets resolve to the same entity, which region the activity points to, and the time-stamped records behind each lead. Together they give a prosecutor or a recovery team a path from transaction to entity that neither layer could produce alone.
That is also why "off-chain" should not be read as a replacement for blockchain analytics. It is the second half of the same file. The Tornado Cash investigation playbook shows where that second half becomes decisive.
FAQ
What is the difference between on-chain and off-chain data?
On-chain data is everything recorded on a public blockchain: transactions, addresses, amounts and timestamps. Off-chain data is everything else relevant to a case, such as exchange account records, seized files, open-source information and attribution data that links wallets to real-world entities. Investigators combine both to move from a transaction to an entity.
Is off-chain analysis a replacement for blockchain analytics?
No. Blockchain analytics remains the first and most efficient step, because the ledger is public and permanent. Off-chain analysis takes over where the ledger stops producing attribution, typically at mixers, fresh wallets, cross-chain hops and private handoffs. The strongest investigations use the two layers in sequence, not as alternatives.
What are the main limitations of on-chain analysis?
On-chain analysis depends on finding a connection between a wallet and something already identified, such as an exchange deposit or a tagged service. Laundering techniques like mixing, fresh wallets, chain hopping and private over-the-counter handoffs remove that connection. The ledger still shows the funds moving but no longer shows who controls them.
Can off-chain analysis attribute a wallet with no transaction history?
Yes, in many cases. A wallet with no history gives clustering heuristics nothing to work with, because there is no prior activity to link. Off-chain attribution does not rely on transaction history, so it can still connect that wallet to other wallets controlled by the same entity and produce a lead for the case file.
Does off-chain evidence hold up in legal proceedings?
Off-chain evidence is used in prosecutions regularly. In the Bitfinex case, files obtained through court-authorized search warrants led to the recovery of more than 94,000 bitcoin. Attribution leads are typically confirmed through legal process, and time-stamped records structured for legal proceedings make that step faster and cleaner for the case file.
