Evidence Tiers: Why a Good Report Says Consistent With, Not Proven

A bad report has one voice. Everything is proved, every pattern means the same thing, and every unanswered question is pushed out of sight.

A useful report has levels. It tells the reader what the public record establishes, what an interpretation supports, what describes infrastructure rather than a person, and where the record ends.

That is not cautious writing for its own sake. It is the difference between a document another investigator can use and one that sounds persuasive only until someone asks the next question.

The chain is unusually good at preserving events. A transaction happened or it did not. A contract emitted a log or it did not. A balance changed or it did not. But a chain record does not carry the identity, purpose, instruction, or legal meaning of every participant with it. Those are separate questions requiring separate evidence.

Four levels that should not be merged

I use four plain-language labels to keep the difference visible.

Observed on-chain is the hard record. A transaction exists. A transfer occurred. A contract call returned a value. This is where a report should be most precise, because a reader can check it directly.

Consistent with is an interpretation. The observed behaviour may fit one explanation better than another, but it does not settle intent or identity. The phrase is not a weakness. It tells the reader exactly how much the evidence can bear.

Infrastructure, not identity distinguishes what an address appears to be from who controls it. An address may be associated with an exchange, bridge, token contract, or service. That says something useful about the route. It does not name the customer, operator, or person behind a particular movement.

Requires off-chain records is the honest stopping point. Exchange account records, device records, contracts, bank material, witness evidence, and legal process may answer the next question. Public chain data cannot manufacture them.

Why a single confidence level fails

Take a simple statement: funds reached an exchange-related address. The movement may be directly visible. The address may be publicly labelled or behave like shared infrastructure. Neither fact identifies the account credited internally by the exchange.

If a report changes “funds reached exchange infrastructure” into “the suspect used Exchange X,” it has crossed two evidentiary gaps without telling the reader. It has moved from event, to infrastructure, to identity. That is how an apparently technical report becomes vulnerable.

The same discipline is why When a Crypto Theft Is Bigger Than One Transaction stops at the exchange boundary. The chain can show a route. It cannot disclose a customer record held privately by an institution.

Unresolved is a finding, not an apology

Writers often avoid the word unresolved because they think it makes the work look incomplete. It does the opposite when used correctly.

An unresolved item tells the next reader where public evidence stops, what would be needed to answer the question, and why the current conclusion should not be stretched further. It prevents a later analyst from mistaking absence of evidence for evidence of absence.

It also protects the client. A report that claims more than its records support can create a false sense of certainty at exactly the point where a lawyer, exchange compliance team, or law enforcement agency needs the boundaries most clearly stated.

A reader should be able to audit the language

There is a simple test for any forensic report. Ask whether a reader can highlight each conclusion and identify its tier. If every line says proved, the report is concealing differences in evidence quality. If it never says what remains unresolved, it has not shown its working boundary.

That is the standard behind the evidence boundary in How a Standing USDT Approval Can Expose Funds That Arrive Later. The public record supports a specific observed sequence. Identity, recovery, and prosecution remain outside what that record alone can establish.

The discipline is useful beyond crypto

Evidence tiers are not a blockchain trick. They apply wherever a technical record risks being read as a verdict: digital forensics, intelligence work, incident response, compliance review, and AI-assisted research.

The question is always the same: what does this record establish, and what have we added through interpretation? Good work keeps the answer visible.

Confidence is cheap. A report earns trust when it tells you where confidence ends.