How cross-validation and access to complementary intelligence improve the work behind an investigative conclusion.
A wallet can carry a high-risk label in one blockchain analytics platform and have no label in another. The transaction history hasn’t changed. The intelligence around it has.
Vendor-neutral blockchain investigations address that difference by selecting sources around the case, testing their findings and documenting the reasoning behind each conclusion. At Recoveris, we work across 7+ commercial blockchain analytics platforms alongside proprietary Recoveris intelligence. That approach supports both the quality of the evidence and our ability to keep working when an individual source becomes unavailable.
For banks, virtual asset service providers (VASPs), lawyers and law enforcement, the practical question is how much confidence they can place in a finding, and what they can do with it.
Why do blockchain analytics providers give different answers?
Blockchain analytics providers add intelligence to transaction records. They associate addresses with services or actors, group addresses believed to share control, and classify activity under their own risk frameworks. Their coverage, collection methods and update cycles can differ.
The distinctions within a label matter too. In its discussion of analytics data quality, Chainalysis separates grouping addresses under common control, attributing them to an entity, and determining whether that entity operates a wallet or uses someone else’s service. Each conclusion needs its own supporting evidence.
An address attributed to an exchange, for example, still leaves questions about the customer behind a deposit and the purpose of the transfer. A risk category can help an investigator decide where to look, while the underlying evidence determines how far the conclusion can go.
Our earlier article on blockchain evidence and Crypto Wallet Freezing Orders explores the consequences of confusing attribution, control and legal ownership. Vendor-neutral investigation brings that scrutiny into the analytical workflow.
How should investigators resolve conflicting findings?
Conflicting findings should trigger a closer examination of what each provider is actually saying.
Consider a hypothetical review of USDT moving through an Ethereum address. One platform flags indirect exposure to a scam-related cluster; another returns no attribution. The investigator needs to establish which transactions generated the flag, how remote the exposure is, when the attribution was recorded and what evidence links the cluster to the suspected activity.
The unlabelled result leaves an information gap. It doesn’t establish that the address is safe. Equally, the flag needs to be assessed against the transaction history and the question the client is asking.
Our position is that a disagreement belongs in the investigative record. The report should explain which finding is supported, which remains uncertain and what additional records could resolve the difference. An exchange account history, communications or other off-chain evidence may answer a question that another risk score cannot.
When does agreement count as corroboration?
Matching results become more useful when the investigator understands the evidence behind them. Two providers could repeat the same public attribution or rely on overlapping source material, so agreement alone doesn’t establish independent confirmation.
For a material finding, investigators should examine the available source history and distinguish directly observed transactions from inferred relationships. Where a provider’s underlying evidence is unavailable, that limitation should remain visible.
Cross-validation therefore requires judgment about the sources as well as their outputs. Counting matching labels gives the reader less assurance than explaining why a particular attribution is credible and which parts of it can be reproduced.
How does vendor neutrality help when the transaction trail becomes complex?
Vendor-neutral blockchain investigations allow the evidence requirements to guide the choice of tools. A case might involve Bitcoin transactions, a bridge into an Ethereum-based network and a deposit into a custodial service. Each transition creates a different analytical problem, and additional intelligence or service-provider records may be needed to continue.
Specialist investigation also becomes important when conventional tracing reaches an evidential gap. In our published 1inch investigation, Recoveris examined 6,231 Tornado Cash withdrawals and analysed behavioural patterns to identify possible connections to post-mixer activity. The work produced investigative leads to identifiable service environments, supporting potential enforcement coordination.
That case illustrates the role of methodology alongside analytics. A documented behavioural inference needs to explain its basis and limitations, particularly where a mixer obscures the direct link between deposits and withdrawals. The same discipline applies when reconstructing a bridge transfer or assessing activity inside a shared exchange wallet.
What happens when an analytics provider becomes unavailable?
Operational continuity depends on having usable alternatives before access is interrupted. In its 4 November security update, Chainalysis reported taking Reactor and Data Solutions offline during its investigation, followed by KYT and other screening products. The company also said it continued to have no evidence that investigation data had been accessed or attribution data manipulated.
For an investigative team, an interruption raises immediate questions: which records are already preserved, which tasks can continue elsewhere, and which findings depend on access to the affected source?
Maintaining continuity requires authorised access to alternatives, investigators who can use them, and case records that remain accessible outside a single interface. Teams also need to document any loss of coverage. Different platforms won’t necessarily provide equivalent data or support the same workflow.
Recoveris’s multi-provider approach gives our investigators alternative sources to work with while assessing those gaps. Its value depends on maintaining the working capability behind that access.
What should clients receive from a vendor-neutral investigation?
A vendor-neutral investigation should leave the client with an account of the evidence that can be reviewed beyond the original analytics interface. Transaction hashes, networks, dates and asset amounts establish the observable activity; source references, attribution methods and confidence assessments explain the interpretation.
The report should also identify the missing records and the next investigative steps. A lawyer may need exchange disclosure to connect a deposit to an account holder. A compliance team may need acquisition records to resolve a provenance question. Our Source of Funds evidence checklist applies the same principle: on-chain activity and supporting records need to form a coherent account.
Recoveris combines those analytical sources with specialist investigators and proprietary intelligence through our managed investigations service. We complement the tools an institution already uses, with the scope shaped around the case and the decisions the client needs to make.
As banks and VASPs handle more value on-chain, they need to understand the evidence behind their decisions and maintain the capacity to investigate when a source is unavailable. Vendor neutrality helps build that capability into the way the work is done.
If your team needs support with a complex investigation, conflicting analytics findings or gaps in its existing coverage, contact Recoveris about investigative support.
