Provenance

Provenance

Provenance, in on-chain analysis, is the traceable history of where a wallet's funds originally came from — the chain of prior transactions and addresses that led to the current balance. Establishing provenance is the foundation that every other risk finding, from sanctions exposure to pattern detection, is built on.

What it means

Tracing provenance means walking a wallet's incoming transaction history backward, hop by hop, checking each prior address against known labels and sanctions lists, and following the chain as far as data availability and computational limits reasonably allow. The result is not a single number but a graph: a picture of how funds arrived, through how many intermediaries, and whether any of those intermediaries carried risk.

Provenance tracing has real limits. It can be interrupted by a mixer that breaks the deterministic link between deposit and withdrawal, by a cross-chain bridge if the receiving tool doesn't cover the destination chain, or simply by the practical depth limit any analysis has to impose. A responsible provenance finding says explicitly where tracing stopped and why, rather than implying a clean history beyond that point.

Real-world example

Investigators tracing the 2022 Ronin Bridge exploit followed the stolen funds' provenance through numerous intermediate wallets and partial mixer use over many months, eventually attributing a large share of the theft to North Korea's Lazarus Group based on the funding chain's eventual destinations.

Related terms

• Hop Distance
• Tainted USDT
• Attribution Confidence

In FreezeRadar

Provenance tracing is the backbone of a FreezeRadar scan — every sanctions, exploit, and pattern finding is anchored to a specific position in the wallet's traced funding history.

Check a wallet now