On-chain evidence: what a Kenyan court will ask you
Blockchain analysis is only useful if it survives contact with a courtroom. Most reports we review would not, and the reasons are consistent enough to be worth setting out plainly.
There is a gap between analysis that is technically correct and analysis that is evidentially useful. We see reports that trace value accurately and would still be dismantled in twenty minutes of cross-examination, because they were written to demonstrate capability rather than to be tested.
The framing that helps most is simple. Assume a competent opposing expert will read every line looking for the weakest inference. Write the report so that expert finds nothing you have not already disclosed.
Distinguish the ledger from the interpretation
This is the distinction that matters more than any other, and it is the one most often blurred.
That a transaction exists, moved a stated amount, and was included in a block at a given time is a fact recorded on a public ledger. Anyone can verify it independently. It is close to incontrovertible.
That a particular address is controlled by a particular person is an inference. It rests on heuristics, on records obtained from third parties, and on reasoning that can be wrong.
Reports that present both categories in the same confident register invite the court to distrust both. Separate them explicitly, and the strong half stays strong when the weaker half is challenged.
We structure findings so that ledger facts and attribution inferences are visually and grammatically distinct. It costs nothing and it materially changes how the analysis holds up.
Be able to explain your method without your tools
"The software clustered these addresses" is not a method. It is a citation of a black box, and a good advocate will ask what the software did, why that approach is sound, what its error modes are, and whether you have independently verified the result.
If you cannot answer those questions, the clustering does not really belong in the report as a finding. Commercial analytics tools are extremely useful and we use them. They accelerate work that an analyst should still be able to justify from first principles.
State confidence, and state it in words
Analysts dislike committing to a confidence level because it feels like exposure. It is the opposite. An analyst who says "I assess this attribution as probable, resting primarily on the exchange's KYC record and secondarily on a co-spend pattern, and it would be materially weakened if the account was shared" has protected their credibility. An analyst who says "this address belongs to the defendant" and is then shown an alternative explanation has lost the court's trust for their entire report.
Avoid numerical probabilities unless you can defend the arithmetic that produced them. Courts handle calibrated language well and handle unjustified percentages badly.
Chain of custody applies to your working, not just the exhibits
Record which node or data provider supplied your chain data, at what time, and at what block height. Blockchain data is not static in the way people assume: reorganisations happen, and a provider's attribution labels are revised over time. An analysis run in March and an analysis run in September against the same addresses can differ, and you need to be able to explain why without it looking like an inconsistency.
Keep your queries and intermediate outputs. If your conclusion cannot be reproduced from your preserved working, it is not really a forensic product.
Write for a reader with no technical background
The magistrate or judge deciding the matter is unlikely to have a technical background, and will not become expert during the hearing. A report that requires the reader to already understand UTXO models has failed, however rigorous its contents.
We write a plain narrative section first, in ordinary language, stating what we assessed and what we found. The technical detail follows in a form the opposing expert can interrogate properly. Both audiences are real and they need different things from the same document.
Know the limits of your own role
An expert's duty is to the court, not to the party paying. In practice that means declining to state conclusions the analysis does not support, however much a client would like them, and disclosing findings that are unhelpful to the instructing party.
It also means being clear about where analysis ends. We can establish that value moved from one address to another and that a service received it. Whether a person had the requisite knowledge or intent is not something a blockchain can tell you, and an analyst who strays into that territory has stopped being useful to the court.
A note on procedure
How on-chain material is pleaded, admitted and challenged is a question of Kenyan evidence law and procedure, and it belongs to advocates rather than to analysts. What we can say is that the reports which cause the fewest procedural difficulties are the ones where methodology, sourcing and confidence were documented at the time the work was done, rather than reconstructed afterwards when a challenge arrived.
Written by the NuruTrace team
We publish what we learn from casework and from reading the regime closely. If something here is relevant to a matter you are handling, we are happy to talk it through.