1.25 Your First Blockchain Investigation

The final foundation lesson turns theory into practice. You will use public blockchain data to investigate a transaction, verify basic facts and explain what you can and cannot infer from the data. The goal is not to become an on-chain analyst in one lesson; it is to develop the habit of verifying claims against primary data.

Learning objectives

• Using a block explorer
• Transaction IDs
• Addresses and outputs
• Block timestamps
• Fees and confirmations
• Limits of on-chain inference

Why this matters

Everything Level 1 has taught you is only useful if you can apply it to a real, unverified claim. This final lesson is where the course stops being descriptive and starts being a practical skill you can use immediately.

Core teaching

A proper blockchain investigation starts by defining the claim precisely: which wallet address, which network, what exact transaction or time period. Vague claims ("a whale moved a huge amount of Bitcoin") cannot be checked; precise claims ("address X sent Y BTC to address Z at block height N") can. From there, a block explorer lets you inspect the actual on-chain data directly, rather than relying on someone else's summary of it.

The critical limitation to hold onto throughout: verifying that a transfer occurred on-chain is not the same as verifying who controls the addresses involved. An address is a cryptographic identifier, not a name — connecting it to a real-world identity generally requires additional evidence beyond the blockchain itself (an exchange's public statement, a labelled address database, or independent reporting). A reproducible investigation records exactly which explorer, address and transaction hash were checked, so someone else could follow the same method and reach the same verifiable conclusion.

Worked example

Suppose a social media post claims "Wallet X received 500 BTC from a major exchange yesterday". A proper investigation defines the claim precisely (which wallet address, which exchange, what timeframe), then uses a blockchain explorer to look up that specific address's transaction history and confirm whether a transaction of that size and timing actually appears on-chain. It is entirely possible to verify the on-chain transfer occurred while still being unable to verify who controls that wallet in the real world — an address is not automatically a confirmed identity.

A reproducible investigation records exactly which explorer, which address, and which transaction hash was checked, so someone else could follow the same steps and reach the same verifiable conclusion.

Deeper analysis

The final lesson introduces an analyst workflow: formulate a question, identify the primary data source, collect identifiers, record observations, separate inference from fact and state uncertainty. A public blockchain provides unusually rich data, but it does not reveal everything. You can observe addresses, transactions, amounts and block history. You usually cannot infer a real-world identity or intention simply from an address. Explorer labels and heuristics can help, but they should be treated as interpretations unless independently verified.

The investigation should finish with an evidence-based conclusion rather than a dramatic claim. A strong report can say that a transaction occurred, identify the block containing it and describe the movement of funds. It should be much more cautious about statements such as “this wallet belongs to X” or “this transaction proves why X acted.” The discipline learned here becomes the foundation for later on-chain analysis, fundamental research and eventually trading decisions.

Common misconceptions

• On-chain data shows activity, not necessarily the real-world identity of a person.
• Timestamps and explorer labels should be interpreted carefully.
• A transaction can be technically valid without being economically sensible.

Application lab

Pick any publicly known Bitcoin address (many are published by researchers or news outlets in relation to notable historical events) and use a blockchain explorer to look up its transaction history. Write down one fact you could verify directly from the data, and one claim about that address (its owner's identity, their intentions) that the data alone does not prove.

Practical exercise

Write a short "analyst note" with three headings — What I Know, What I Infer, What I Still Need To Verify — based on the address you looked up in the application lab above. Keep each section to one or two sentences.

Knowledge check

Question: You verify on a block explorer that a transaction really happened between two addresses. What have you NOT yet verified, even though the transfer itself is now confirmed?

Model answer: You have not verified who controls those addresses in the real world. An address is a cryptographic identifier, not a confirmed identity — linking it to a specific person or organisation generally requires evidence beyond the blockchain data itself.

Case study prompt

Pick any publicly known Bitcoin address (several are published by researchers, exchanges or news outlets in connection with notable events). Use a block explorer to review its transaction history, and write down one fact you can verify directly from the data, and one claim about that address's owner that the data alone does not prove.

Key takeaways

• A checkable claim names a specific address, network and time period
• Block explorers let you inspect primary on-chain data directly
• Confirming a transfer is not the same as confirming who controls the addresses
• A reproducible investigation records its exact method, not just its conclusion

Further exploration

You have completed the foundations. Level 2 builds directly on the mechanisms from this level — wallets, keys, transactions and consensus — applied to a wider range of blockchain infrastructure including Ethereum, smart contracts and Layer 2 networks.